Overview

overview

10

Static

static

3

b8a3b35b68...4a.exe

windows7-x64

10

b8a3b35b68...4a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 00:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe

  • Size

    4.9MB

  • MD5

    a450c06717644483e3437db615ea4114

  • SHA1

    93ece99062cee7344d7059986cc4727c92dbfca9

  • SHA256

    b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a

  • SHA512

    cb7d295f30fa69e98f52ac240e76ed9e776142a898a15c0a8911a693ccdcea441281a79c2b7f0e1e6567cc0bb73a9a6320c359a4a775b943fc84b78df6e42a24

  • SSDEEP

    49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8+:e

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 36 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3084
    • C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:904
        • C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"
          4⤵
          • Executes dropped EXE
          PID:1468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Recovery\WindowsRE\dwm.exe
      "C:\Recovery\WindowsRE\dwm.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:760
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da4cef27-218d-48db-893a-a4713930ed0a.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Recovery\WindowsRE\dwm.exe
          C:\Recovery\WindowsRE\dwm.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4284
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f164aae2-fd64-47fb-a8a3-5b56ece06f74.vbs"
            5⤵
              PID:4008
              • C:\Recovery\WindowsRE\dwm.exe
                C:\Recovery\WindowsRE\dwm.exe
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:2256
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e682f238-c660-4c97-a3c9-32b67418a067.vbs"
                  7⤵
                    PID:3416
                    • C:\Recovery\WindowsRE\dwm.exe
                      C:\Recovery\WindowsRE\dwm.exe
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:512
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4535f9d-5017-42b1-95f7-a8b9effdc2c3.vbs"
                        9⤵
                          PID:1156
                          • C:\Recovery\WindowsRE\dwm.exe
                            C:\Recovery\WindowsRE\dwm.exe
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:3372
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abfc63f4-f30e-4630-8d98-985425c91807.vbs"
                              11⤵
                                PID:4160
                                • C:\Recovery\WindowsRE\dwm.exe
                                  C:\Recovery\WindowsRE\dwm.exe
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:5068
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42857aee-e807-477b-939c-8859e32a5aa9.vbs"
                                    13⤵
                                      PID:400
                                      • C:\Recovery\WindowsRE\dwm.exe
                                        C:\Recovery\WindowsRE\dwm.exe
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:824
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98d5c167-da9b-4266-9cae-c74c1840b68e.vbs"
                                          15⤵
                                            PID:1884
                                            • C:\Recovery\WindowsRE\dwm.exe
                                              C:\Recovery\WindowsRE\dwm.exe
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:4156
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3761a890-eaa6-4d54-af61-23fde9fdcfbc.vbs"
                                                17⤵
                                                  PID:3136
                                                  • C:\Recovery\WindowsRE\dwm.exe
                                                    C:\Recovery\WindowsRE\dwm.exe
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1576
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff37afd9-d75a-47d2-9a62-afd18befaabf.vbs"
                                                      19⤵
                                                        PID:4716
                                                        • C:\Recovery\WindowsRE\dwm.exe
                                                          C:\Recovery\WindowsRE\dwm.exe
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:5044
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3c581fa-1004-4c33-a985-dcdcd4862abf.vbs"
                                                            21⤵
                                                              PID:2284
                                                              • C:\Recovery\WindowsRE\dwm.exe
                                                                C:\Recovery\WindowsRE\dwm.exe
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:4036
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41062ffb-b70d-43b4-87fe-86127f45f6b4.vbs"
                                                                  23⤵
                                                                    PID:1516
                                                                    • C:\Recovery\WindowsRE\dwm.exe
                                                                      C:\Recovery\WindowsRE\dwm.exe
                                                                      24⤵
                                                                        PID:2968
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72ee8e35-23be-48fd-b786-ca471ba919df.vbs"
                                                                      23⤵
                                                                        PID:2692
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"
                                                                        23⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4640
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"
                                                                          24⤵
                                                                          • Executes dropped EXE
                                                                          PID:4728
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b467758-745b-4f83-8725-0dc21e29467e.vbs"
                                                                    21⤵
                                                                      PID:3644
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"
                                                                      21⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5004
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"
                                                                        22⤵
                                                                        • Executes dropped EXE
                                                                        PID:1480
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f28c2f0e-87bd-438e-ade5-f88e9bde86d9.vbs"
                                                                  19⤵
                                                                    PID:1708
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8466ad8-97b6-4e1c-84a6-724662beb28f.vbs"
                                                                17⤵
                                                                  PID:4980
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"
                                                                  17⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4248
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"
                                                                    18⤵
                                                                    • Executes dropped EXE
                                                                    PID:4656
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e92c58f-9dd3-4d09-9dbf-4e3367ffd455.vbs"
                                                              15⤵
                                                                PID:2672
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"
                                                                15⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1516
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"
                                                                  16⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4036
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"
                                                                    17⤵
                                                                    • Executes dropped EXE
                                                                    PID:3752
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ceebe32-aa29-4aeb-a236-aff838452ad9.vbs"
                                                            13⤵
                                                              PID:2444
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"
                                                              13⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2284
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"
                                                                14⤵
                                                                • Executes dropped EXE
                                                                PID:4424
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2043775b-9ee5-4619-9919-1677013f9de8.vbs"
                                                          11⤵
                                                            PID:3656
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3560
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"
                                                              12⤵
                                                              • Executes dropped EXE
                                                              PID:3880
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35fab6db-b684-4647-b872-06dea049bcba.vbs"
                                                        9⤵
                                                          PID:1464
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2112
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"
                                                            10⤵
                                                            • Executes dropped EXE
                                                            PID:2568
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4395dec-2ab2-4d86-9195-4875a363085c.vbs"
                                                      7⤵
                                                        PID:680
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2552
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:1796
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8d24e6e-1460-4ae8-914e-5b567a02af09.vbs"
                                                    5⤵
                                                      PID:2116
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4656
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:1032
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5ffec77-0447-4c7d-acd8-b82c3be3d0de.vbs"
                                                  3⤵
                                                    PID:1184
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1376
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2672
                                                      • C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:1472
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\services.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4916
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3560
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3644
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4160
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2772
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3856
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\System.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1900
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1796
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4660

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files\VideoLAN\services.exe
                                                Filesize

                                                4.9MB

                                                MD5

                                                a450c06717644483e3437db615ea4114

                                                SHA1

                                                93ece99062cee7344d7059986cc4727c92dbfca9

                                                SHA256

                                                b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a

                                                SHA512

                                                cb7d295f30fa69e98f52ac240e76ed9e776142a898a15c0a8911a693ccdcea441281a79c2b7f0e1e6567cc0bb73a9a6320c359a4a775b943fc84b78df6e42a24

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log
                                                Filesize

                                                1KB

                                                MD5

                                                4a667f150a4d1d02f53a9f24d89d53d1

                                                SHA1

                                                306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                                SHA256

                                                414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                                SHA512

                                                4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                Filesize

                                                2KB

                                                MD5

                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                SHA1

                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                SHA256

                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                SHA512

                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                944B

                                                MD5

                                                28d4235aa2e6d782751f980ceb6e5021

                                                SHA1

                                                f5d82d56acd642b9fc4b963f684fd6b78f25a140

                                                SHA256

                                                8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

                                                SHA512

                                                dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                944B

                                                MD5

                                                a8e8360d573a4ff072dcc6f09d992c88

                                                SHA1

                                                3446774433ceaf0b400073914facab11b98b6807

                                                SHA256

                                                bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                                                SHA512

                                                4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                944B

                                                MD5

                                                3a6bad9528f8e23fb5c77fbd81fa28e8

                                                SHA1

                                                f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                SHA256

                                                986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                SHA512

                                                846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                944B

                                                MD5

                                                e243a38635ff9a06c87c2a61a2200656

                                                SHA1

                                                ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                SHA256

                                                af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                SHA512

                                                4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\42857aee-e807-477b-939c-8859e32a5aa9.vbs
                                                Filesize

                                                705B

                                                MD5

                                                f7809dcc24aa019d39341ac901e07a76

                                                SHA1

                                                4ce4fc1bff95bd62ddba1aa575bf5134b86c95ff

                                                SHA256

                                                1c6af3bdf964021c76dfce7ac8f29b542449a36914d64b60e0a371a52e904ecf

                                                SHA512

                                                49e7d5e29195431041bc3a36e5bf260ad503b69feee4a2cb3b42798fbedcd8fd10e5db38816c1dd7e64abb0bad0096a654b6edf697829e35ccb8920fb9d60c93

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\98d5c167-da9b-4266-9cae-c74c1840b68e.vbs
                                                Filesize

                                                704B

                                                MD5

                                                9e90a5648fbf1c98833b29065f152d15

                                                SHA1

                                                2ee021a3dbc5dc2bd61441ec5880a46ef67c1f60

                                                SHA256

                                                d7b87371008eb04393ec03fc445cf68281232c236ea5efcb7d6b1d7055fe3817

                                                SHA512

                                                e268153410c4ebe6c6a00c4af15f02d117411e47e8a02e68c961fd33f66e5405a89e4350c32cc353ebecbee0bda066ab20a9becb4ba07bf0a4ddd9bc1a47f066

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oi0q1jzh.sfw.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\abfc63f4-f30e-4630-8d98-985425c91807.vbs
                                                Filesize

                                                705B

                                                MD5

                                                14c3c862a3bcb16c79a6d7bd9431a50f

                                                SHA1

                                                faec24a971b40044388c4964b9aeeeae8e2f4dac

                                                SHA256

                                                03d4db47117b335d102ba1a651ca4a04c280675cb018ae5593d27eb820182d94

                                                SHA512

                                                4c77ccd99e47697cbea37aff19fac752d5661405a38f5fa18a9bdc55a37dc234d34c3caf534d4991e6585854df2921fee3353fd08cd045f30ed92813b980b264

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\c4535f9d-5017-42b1-95f7-a8b9effdc2c3.vbs
                                                Filesize

                                                704B

                                                MD5

                                                0388ef0af8f4568756e600c3fa50e990

                                                SHA1

                                                b6fdaee3f4c933f9117305292137ff302b013175

                                                SHA256

                                                cc8bdbdc8ea0addaf717a62083831ac5671fe84d4ed958315e42d417e7f3daea

                                                SHA512

                                                9f05c7593cd2ae07c197e9e7e44c516ee3f7cbc6f8614cb34c4a4898c15585ded43efdd1538befee1f0ed37eff25f613165ca75cca56281a00e8a85ef3281aa0

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\da4cef27-218d-48db-893a-a4713930ed0a.vbs
                                                Filesize

                                                704B

                                                MD5

                                                502178fae6ea4345983f055976b0c87b

                                                SHA1

                                                8b90d67eebaef68148038fb00c374518776291fe

                                                SHA256

                                                2908bc75e12090c3616d7b5099a22022377983ab5ad5b7bd4a95a7caa00149d2

                                                SHA512

                                                7e735a9bd5f956011be5cbba4a241aac270ece6ca92daa8ff98deb1c3b7ca0a83231b7242f323d8167288ec87492c9a36e00a94ac521212e3e4e73dd73c4dea8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\e5ffec77-0447-4c7d-acd8-b82c3be3d0de.vbs
                                                Filesize

                                                481B

                                                MD5

                                                720b210bd578c4ad17eff83e2c112e2b

                                                SHA1

                                                a599a63b297f2cd8ebf2f59bba4a3d617a0e22d1

                                                SHA256

                                                246f5cdf2cb389f21b1ceabda077343bbc8d66149a83de3f3c458d5a19a2dfb4

                                                SHA512

                                                2faf0abdd13273672ded3b07a936d198104cc8e21c37561edb60fb45572f340b062030853e8c6fd4ee1e4f1eac0f8e9fac86f2e117ca2ceccf934f7d0a65c954

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\e682f238-c660-4c97-a3c9-32b67418a067.vbs
                                                Filesize

                                                705B

                                                MD5

                                                7dc0d22094baa712a33b4225699a7ca1

                                                SHA1

                                                2107139e189abcb5a1d284418e1211086a0d9077

                                                SHA256

                                                21db8b93f4c4fd66da6ef2d6bd412c6efcfbf7358ec052dbc1b2d21899470ef1

                                                SHA512

                                                c028e5ea240a1f3a521a0a552cd795422efa1e622be66cfca5ba7aeb24a06ad66afeedd890da0c58808dc2bbb890a957b30a9d6389d4de50bb7c6e08112a76eb

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\f164aae2-fd64-47fb-a8a3-5b56ece06f74.vbs
                                                Filesize

                                                705B

                                                MD5

                                                addb2dab2c06e572228238d9d43e9a2e

                                                SHA1

                                                3806a720ffff1b1792a2ca3840cade725a63c362

                                                SHA256

                                                05cf326a307ae13f0e98e1dccea661d6693b5dbb44a2e8e5404d66e112b7bc41

                                                SHA512

                                                2fddb1650a8d43270026fba234ec9e61f02d5647292d1d09a09b2dab38fbf6557464f9c46fcb783ded23226c3f582c58e956cfce66d67165d6061d6c65701956

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe
                                                Filesize

                                                75KB

                                                MD5

                                                e0a68b98992c1699876f818a22b5b907

                                                SHA1

                                                d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                                SHA256

                                                2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                                SHA512

                                                856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                                Download Submit

                                              • memory/1468-61-0x0000000000400000-0x0000000000407000-memory.dmp

                                                Filesize

                                                28KB

                                                Download

                                              • memory/1544-121-0x0000022782BB0000-0x0000022782BD2000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3084-12-0x000000001C0E0000-0x000000001C608000-memory.dmp

                                                Filesize

                                                5.2MB

                                                Download

                                              • memory/3084-8-0x000000001BB10000-0x000000001BB26000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/3084-16-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/3084-18-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/3084-13-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/3084-223-0x00007FFC2E370000-0x00007FFC2EE31000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/3084-14-0x000000001BBB0000-0x000000001BBBE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/3084-15-0x000000001BBC0000-0x000000001BBCE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/3084-17-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/3084-11-0x000000001BB40000-0x000000001BB52000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3084-10-0x000000001BB30000-0x000000001BB3A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/3084-0-0x00007FFC2E373000-0x00007FFC2E375000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/3084-9-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3084-6-0x000000001B200000-0x000000001B208000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/3084-1-0x0000000000150000-0x0000000000644000-memory.dmp

                                                Filesize

                                                5.0MB

                                                Download

                                              • memory/3084-7-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3084-5-0x000000001BB60000-0x000000001BBB0000-memory.dmp

                                                Filesize

                                                320KB

                                                Download

                                              • memory/3084-4-0x000000001B1E0000-0x000000001B1FC000-memory.dmp

                                                Filesize

                                                112KB

                                                Download

                                              • memory/3084-3-0x000000001B3E0000-0x000000001B50E000-memory.dmp

                                                Filesize

                                                1.2MB

                                                Download

                                              • memory/3084-2-0x00007FFC2E370000-0x00007FFC2EE31000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/4284-274-0x000000001C210000-0x000000001C222000-memory.dmp

                                                Filesize

                                                72KB

                                                Download