Overview
overview
10Static
static
6DUMP_00A10...iR.exe
windows7-x64
7DgH5SjZFle...DI.exe
windows7-x64
10Dumped_.exe
windows7-x64
7EntrateSetup.exe
windows7-x64
9ErrorFileRemover.exe
windows7-x64
10ExtraTools.exe
windows7-x64
7F45F47EDCE...54.exe
windows7-x64
10decrypt_00...00.exe
windows7-x64
6dffde400ad...3d.exe
windows7-x64
10dircrypt.deobf.exe
windows7-x64
10dma locker 4.0.exe
windows7-x64
9downloader.js
windows7-x64
10dump.mem.exe
windows7-x64
6e0ff79cc94...ss.exe
windows7-x64
7e37dc428ec...ad.vbs
windows7-x64
1e5df2d114c...8a.exe
windows7-x64
10e6c4ae4709...ss.exe
windows7-x64
7e77df2ce34...2d.exe
windows7-x64
1e8e07496df...d2.exe
windows7-x64
ea8292721a...1e.exe
windows7-x64
5eaa857c95f...er.dll
windows7-x64
1ed3a685ca6...91.exe
windows7-x64
9edffa07d66...9d5.js
windows7-x64
10encrypter.exe
windows7-x64
10encryptor_...81.exe
windows7-x64
9f002618c01...35.apk
windows7-x64
3f213e54c85...ea.exe
windows7-x64
1f2c8eee2cd...3f.exe
windows7-x64
10f31bfe95e3...7_.exe
windows7-x64
7f6a8d7a429...da.exe
windows7-x64
10f915110765...da.exe
windows7-x64
7fb8823e949...-0.dll
windows7-x64
1Analysis
-
max time kernel
599s -
max time network
600s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:25
Behavioral task
behavioral1
Sample
DUMP_00A10000-00A1D000.exe.ViR.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral3
Sample
Dumped_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
EntrateSetup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
ErrorFileRemover.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
ExtraTools.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
decrypt_0000000000000020-000A0000.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
dircrypt.deobf.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral11
Sample
dma locker 4.0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
downloader.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
dump.mem.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral15
Sample
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.vbs
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral17
Sample
e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc_not_packed_maybe_useless.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
e8e07496df5370d2e49ecce5a47c1fd2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
ea8292721a34ca2f1831447868bbe91e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d_Stealer.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
encrypter.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635.apk
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral27
Sample
f213e54c8520e7458751020edf15a5ea.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
f2c8eee2cd88b834e9d4c0eb4930f03f.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral29
Sample
f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7_.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
f6a8d7a4291c55020101d046371a8bda.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
f9151107655aaa6db995888a7cb69ada.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
fb8823e9494016f59ab25ec6cc0961da_api-ms-win-system-softpub-l1-1-0.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe
-
Size
1.2MB
-
MD5
0ced87772881b63caf95f1d828ba40c5
-
SHA1
6e5fca51a018272d1b1003b16dce6ee9e836908c
-
SHA256
ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791
-
SHA512
65f3a52930dd560cf27a9a6e7386ae1bba22d663a1112b44fa1db043bd0b980f7dcb1d5fe21b873bb93db69c5c4d0b3c7dcf13ea110836970454b56dc16e57bb
-
SSDEEP
24576:DxIWmj1GwuqWt6GoXrxv7EJoD7p1YQzA+GdctrOvpk5P4TB5tP9P6F:Dnqqo5PzA+Gda4TB5tFP6F
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1168 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1424 WMIC.exe Token: SeSecurityPrivilege 1424 WMIC.exe Token: SeTakeOwnershipPrivilege 1424 WMIC.exe Token: SeLoadDriverPrivilege 1424 WMIC.exe Token: SeSystemProfilePrivilege 1424 WMIC.exe Token: SeSystemtimePrivilege 1424 WMIC.exe Token: SeProfSingleProcessPrivilege 1424 WMIC.exe Token: SeIncBasePriorityPrivilege 1424 WMIC.exe Token: SeCreatePagefilePrivilege 1424 WMIC.exe Token: SeBackupPrivilege 1424 WMIC.exe Token: SeRestorePrivilege 1424 WMIC.exe Token: SeShutdownPrivilege 1424 WMIC.exe Token: SeDebugPrivilege 1424 WMIC.exe Token: SeSystemEnvironmentPrivilege 1424 WMIC.exe Token: SeRemoteShutdownPrivilege 1424 WMIC.exe Token: SeUndockPrivilege 1424 WMIC.exe Token: SeManageVolumePrivilege 1424 WMIC.exe Token: 33 1424 WMIC.exe Token: 34 1424 WMIC.exe Token: 35 1424 WMIC.exe Token: SeBackupPrivilege 2332 vssvc.exe Token: SeRestorePrivilege 2332 vssvc.exe Token: SeAuditPrivilege 2332 vssvc.exe Token: SeIncreaseQuotaPrivilege 1424 WMIC.exe Token: SeSecurityPrivilege 1424 WMIC.exe Token: SeTakeOwnershipPrivilege 1424 WMIC.exe Token: SeLoadDriverPrivilege 1424 WMIC.exe Token: SeSystemProfilePrivilege 1424 WMIC.exe Token: SeSystemtimePrivilege 1424 WMIC.exe Token: SeProfSingleProcessPrivilege 1424 WMIC.exe Token: SeIncBasePriorityPrivilege 1424 WMIC.exe Token: SeCreatePagefilePrivilege 1424 WMIC.exe Token: SeBackupPrivilege 1424 WMIC.exe Token: SeRestorePrivilege 1424 WMIC.exe Token: SeShutdownPrivilege 1424 WMIC.exe Token: SeDebugPrivilege 1424 WMIC.exe Token: SeSystemEnvironmentPrivilege 1424 WMIC.exe Token: SeRemoteShutdownPrivilege 1424 WMIC.exe Token: SeUndockPrivilege 1424 WMIC.exe Token: SeManageVolumePrivilege 1424 WMIC.exe Token: 33 1424 WMIC.exe Token: 34 1424 WMIC.exe Token: 35 1424 WMIC.exe Token: SeIncreaseQuotaPrivilege 2900 WMIC.exe Token: SeSecurityPrivilege 2900 WMIC.exe Token: SeTakeOwnershipPrivilege 2900 WMIC.exe Token: SeLoadDriverPrivilege 2900 WMIC.exe Token: SeSystemProfilePrivilege 2900 WMIC.exe Token: SeSystemtimePrivilege 2900 WMIC.exe Token: SeProfSingleProcessPrivilege 2900 WMIC.exe Token: SeIncBasePriorityPrivilege 2900 WMIC.exe Token: SeCreatePagefilePrivilege 2900 WMIC.exe Token: SeBackupPrivilege 2900 WMIC.exe Token: SeRestorePrivilege 2900 WMIC.exe Token: SeShutdownPrivilege 2900 WMIC.exe Token: SeDebugPrivilege 2900 WMIC.exe Token: SeSystemEnvironmentPrivilege 2900 WMIC.exe Token: SeRemoteShutdownPrivilege 2900 WMIC.exe Token: SeUndockPrivilege 2900 WMIC.exe Token: SeManageVolumePrivilege 2900 WMIC.exe Token: 33 2900 WMIC.exe Token: 34 2900 WMIC.exe Token: 35 2900 WMIC.exe Token: SeIncreaseQuotaPrivilege 2900 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1532 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 30 PID 1076 wrote to memory of 1532 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 30 PID 1076 wrote to memory of 1532 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 30 PID 1076 wrote to memory of 1532 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 30 PID 1076 wrote to memory of 2408 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 32 PID 1076 wrote to memory of 2408 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 32 PID 1076 wrote to memory of 2408 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 32 PID 1076 wrote to memory of 2408 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 32 PID 1532 wrote to memory of 1168 1532 cmd.exe 34 PID 1532 wrote to memory of 1168 1532 cmd.exe 34 PID 1532 wrote to memory of 1168 1532 cmd.exe 34 PID 1532 wrote to memory of 1168 1532 cmd.exe 34 PID 2408 wrote to memory of 1424 2408 cmd.exe 35 PID 2408 wrote to memory of 1424 2408 cmd.exe 35 PID 2408 wrote to memory of 1424 2408 cmd.exe 35 PID 2408 wrote to memory of 1424 2408 cmd.exe 35 PID 2408 wrote to memory of 2568 2408 cmd.exe 36 PID 2408 wrote to memory of 2568 2408 cmd.exe 36 PID 2408 wrote to memory of 2568 2408 cmd.exe 36 PID 2408 wrote to memory of 2568 2408 cmd.exe 36 PID 1076 wrote to memory of 2732 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 39 PID 1076 wrote to memory of 2732 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 39 PID 1076 wrote to memory of 2732 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 39 PID 1076 wrote to memory of 2732 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 39 PID 2732 wrote to memory of 2900 2732 cmd.exe 41 PID 2732 wrote to memory of 2900 2732 cmd.exe 41 PID 2732 wrote to memory of 2900 2732 cmd.exe 41 PID 2732 wrote to memory of 2900 2732 cmd.exe 41 PID 2732 wrote to memory of 2928 2732 cmd.exe 42 PID 2732 wrote to memory of 2928 2732 cmd.exe 42 PID 2732 wrote to memory of 2928 2732 cmd.exe 42 PID 2732 wrote to memory of 2928 2732 cmd.exe 42 PID 1076 wrote to memory of 2636 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 43 PID 1076 wrote to memory of 2636 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 43 PID 1076 wrote to memory of 2636 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 43 PID 1076 wrote to memory of 2636 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 43 PID 2636 wrote to memory of 2744 2636 cmd.exe 45 PID 2636 wrote to memory of 2744 2636 cmd.exe 45 PID 2636 wrote to memory of 2744 2636 cmd.exe 45 PID 2636 wrote to memory of 2744 2636 cmd.exe 45 PID 2636 wrote to memory of 2780 2636 cmd.exe 46 PID 2636 wrote to memory of 2780 2636 cmd.exe 46 PID 2636 wrote to memory of 2780 2636 cmd.exe 46 PID 2636 wrote to memory of 2780 2636 cmd.exe 46 PID 1076 wrote to memory of 1496 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 47 PID 1076 wrote to memory of 1496 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 47 PID 1076 wrote to memory of 1496 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 47 PID 1076 wrote to memory of 1496 1076 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe 47 PID 1496 wrote to memory of 2040 1496 cmd.exe 49 PID 1496 wrote to memory of 2040 1496 cmd.exe 49 PID 1496 wrote to memory of 2040 1496 cmd.exe 49 PID 1496 wrote to memory of 2040 1496 cmd.exe 49 PID 1496 wrote to memory of 2144 1496 cmd.exe 50 PID 1496 wrote to memory of 2144 1496 cmd.exe 50 PID 1496 wrote to memory of 2144 1496 cmd.exe 50 PID 1496 wrote to memory of 2144 1496 cmd.exe 50 PID 1496 wrote to memory of 448 1496 cmd.exe 51 PID 1496 wrote to memory of 448 1496 cmd.exe 51 PID 1496 wrote to memory of 448 1496 cmd.exe 51 PID 1496 wrote to memory of 448 1496 cmd.exe 51 PID 1496 wrote to memory of 2260 1496 cmd.exe 52 PID 1496 wrote to memory of 2260 1496 cmd.exe 52 PID 1496 wrote to memory of 2260 1496 cmd.exe 52 PID 1496 wrote to memory of 2260 1496 cmd.exe 52 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe"C:\Users\Admin\AppData\Local\Temp\ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet && exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic logicaldisk where drivetype=2 get deviceid | findstr . > %tmp%\y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic logicaldisk where drivetype=2 get deviceid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic logicaldisk where drivetype=3 get deviceid | findstr . > %tmp%\y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic logicaldisk where drivetype=3 get deviceid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:2928
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic logicaldisk where drivetype=4 get deviceid | findstr . > %tmp%\y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic logicaldisk where drivetype=4 get deviceid3⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic path win32_physicalmedia get SerialNumber | findstr . > %tmp%\y && wmic cpu get ProcessorId | findstr . >> %tmp%\y && wmic path win32_BASEBOARD get Product | findstr . >> %tmp%\y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_physicalmedia get SerialNumber3⤵
- System Location Discovery: System Language Discovery
PID:2040
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get ProcessorId3⤵
- System Location Discovery: System Language Discovery
PID:448
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:2260
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_BASEBOARD get Product3⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
C:\Windows\SysWOW64\findstr.exefindstr .3⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83B
MD5445e94a8ece8238758d3a897fef6822b
SHA12c5e5cb3ce480d98d74fe5a0ed23d31848ebb407
SHA256543e763d191bc04c5564cf6521eeff6c154b74415575303c72b46f32bd24594b
SHA512c6347eb9214eab5b8e2f61358153244203480c11d4d83f83e1e37cdd3f922a6e50c5568618fb27cb2a70487d7b9bea44614a065631934fca5894a6daec1f82a6
-
Filesize
39B
MD5730a1c06f8273df68828bbebb3e1fab0
SHA11c269bdd515ca992df2c07c2b4c0eda26f1a6c91
SHA256da51411ba8d69f112382c4ada4c02ad9e5ab3fcececca4bd50bb11122e473679
SHA5121d56e0d3704d75dff9f20347ff3e712c114a1d9e5383e6356a71a9705dd4a3bb311c174c6d026cc60707abc56f7bfda011293a8dbd7f79a299fb712d3ad33f30