Overview

overview

10

Static

static

3

0oj3.exe

windows7-x64

1

0oj3.exe

windows10-2004-x64

10

interception.dll

windows7-x64

1

interception.dll

windows10-2004-x64

1

libcrypto-3-x64.dll

windows7-x64

1

libcrypto-3-x64.dll

windows10-2004-x64

1

onnxruntime.dll

windows7-x64

1

onnxruntime.dll

windows10-2004-x64

1

opencv_world490.dll

windows7-x64

1

opencv_world490.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 21:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0oj3.exe

  • Size

    37.0MB

  • MD5

    d57050cc8f1d71bb068a181301146855

  • SHA1

    564deb2344ea43dd519ee0000642cb0ced55da83

  • SHA256

    08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

  • SHA512

    43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

  • SSDEEP

    786432:b/gO+cE2+qOnY9ZBLcf5jJGlbarkt0PAmyrL+rXrO37:bEcEGbLwjubcktYbO37

Score
10/10
asyncratserviceexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 63 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 28 IoCs
  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:612
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:796
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:316
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:668
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:780
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        2⤵
        • Executes dropped EXE
        PID:2960
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        2⤵
          PID:3756
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          2⤵
          • Executes dropped EXE
          PID:3848
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          2⤵
          • Executes dropped EXE
          PID:3912
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          2⤵
            PID:4000
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:3600
          • C:\Windows\system32\SppExtComObj.exe
            C:\Windows\system32\SppExtComObj.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:3320
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            2⤵
              PID:928
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
              2⤵
              • Executes dropped EXE
              PID:4328
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:1992
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              2⤵
              • Checks BIOS information in registry
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:2132
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:1720
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:4340
                • C:\Windows\System32\mousocoreworker.exe
                  C:\Windows\System32\mousocoreworker.exe -Embedding
                  2⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  PID:3488
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:224
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                    2⤵
                    • Loads dropped DLL
                    PID:1156
                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                    2⤵
                    • Loads dropped DLL
                    PID:3964
                • C:\Windows\system32\fontdrvhost.exe
                  "fontdrvhost.exe"
                  1⤵
                    PID:788
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k RPCSS -p
                    1⤵
                    • Executes dropped EXE
                    PID:900
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                    1⤵
                    • Executes dropped EXE
                    PID:952
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                    1⤵
                    • Executes dropped EXE
                    PID:604
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                    1⤵
                    • Executes dropped EXE
                    PID:1008
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                    1⤵
                    • Executes dropped EXE
                    PID:1052
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                    • Executes dropped EXE
                    PID:1088
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                    • Executes dropped EXE
                    PID:1096
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    PID:1172
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                      • Executes dropped EXE
                      PID:2936
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Executes dropped EXE
                    PID:1244
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                    • Executes dropped EXE
                    PID:1272
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                    1⤵
                    • Executes dropped EXE
                    PID:1320
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                    • Executes dropped EXE
                    PID:1360
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                    1⤵
                    • Executes dropped EXE
                    PID:1468
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2608
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                    1⤵
                    • Executes dropped EXE
                    PID:1500
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                    1⤵
                    • Executes dropped EXE
                    PID:1516
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                    1⤵
                    • Executes dropped EXE
                    PID:1524
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                    1⤵
                    • Executes dropped EXE
                    PID:1640
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                    1⤵
                    • Executes dropped EXE
                    PID:1688
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                    1⤵
                    • Executes dropped EXE
                    PID:1732
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                    1⤵
                    • Executes dropped EXE
                    PID:1804
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                    1⤵
                    • Executes dropped EXE
                    PID:1816
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                    1⤵
                    • Executes dropped EXE
                    PID:1916
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                    1⤵
                    • Executes dropped EXE
                    PID:1924
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                    1⤵
                    • Executes dropped EXE
                    PID:1972
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                    1⤵
                    • Executes dropped EXE
                    PID:2004
                  • C:\Windows\System32\spoolsv.exe
                    C:\Windows\System32\spoolsv.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1832
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                    1⤵
                    • Executes dropped EXE
                    PID:2104
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                    1⤵
                    • Executes dropped EXE
                    PID:2164
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                    1⤵
                    • Executes dropped EXE
                    PID:2268
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2296
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                    1⤵
                    • Executes dropped EXE
                    PID:2400
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                    1⤵
                    • Executes dropped EXE
                    PID:2408
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                    1⤵
                    • Executes dropped EXE
                    PID:2660
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:2668
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                    1⤵
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2756
                  • C:\Windows\sysmon.exe
                    C:\Windows\sysmon.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2776
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                    1⤵
                    • Executes dropped EXE
                    PID:2808
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                    1⤵
                    • Executes dropped EXE
                    PID:2804
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                    1⤵
                    • Executes dropped EXE
                    PID:3012
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                    1⤵
                    • Executes dropped EXE
                    PID:3332
                  • C:\Windows\Explorer.EXE
                    C:\Windows\Explorer.EXE
                    1⤵
                    • Executes dropped EXE
                    PID:3444
                    • C:\Users\Admin\AppData\Local\Temp\0oj3.exe
                      "C:\Users\Admin\AppData\Local\Temp\0oj3.exe"
                      2⤵
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: RenamesItself
                      • Suspicious use of WriteProcessMemory
                      PID:3620
                      • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                        cmd.exe
                        3⤵
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: RenamesItself
                        • Suspicious use of WriteProcessMemory
                        PID:2116
                        • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                          "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                          4⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4604
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3596
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                              6⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:1824
                          • C:\Windows\System32\sc.exe
                            "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                            5⤵
                            • Launches sc.exe
                            PID:3476
                          • C:\Windows\System32\sc.exe
                            "C:\Windows\System32\sc.exe" start AutoRunService
                            5⤵
                            • Launches sc.exe
                            PID:3108
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                    1⤵
                    • Executes dropped EXE
                    PID:3552
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:4420
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                    1⤵
                    • Executes dropped EXE
                    PID:5072
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                    1⤵
                    • Executes dropped EXE
                    PID:536
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:4544
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                    1⤵
                    • Executes dropped EXE
                    PID:3988
                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:1980
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                    1⤵
                    • Executes dropped EXE
                    PID:3696
                  • C:\Windows\System32\WaaSMedicAgent.exe
                    C:\Windows\System32\WaaSMedicAgent.exe e925220f565adef4a5fedd1261527601 ZtO0/6pQd0WPvrioZKqEYQ.0.1.0.0.0
                    1⤵
                    • Sets service image path in registry
                    PID:388
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      2⤵
                      • Loads dropped DLL
                      PID:1148
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                    1⤵
                    • Loads dropped DLL
                    PID:4940
                  • C:\Program Files\cmd.exe
                    "C:\Program Files\cmd.exe"
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:1956
                  • C:\Windows\servicing\TrustedInstaller.exe
                    C:\Windows\servicing\TrustedInstaller.exe
                    1⤵
                    • Loads dropped DLL
                    PID:5112
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                    1⤵
                    • Loads dropped DLL
                    PID:4276

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  System Services

                  1
                  T1569

                  Service Execution

                  1
                  T1569.002

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Modify Registry

                  2
                  T1112

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  7
                  T1012

                  System Information Discovery

                  7
                  T1082

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\cmd.exe
                    Filesize

                    1.9MB

                    MD5

                    5d864ba27836417dbbb494b3a5d888a9

                    SHA1

                    66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                    SHA256

                    0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                    SHA512

                    6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                    Filesize

                    2.2MB

                    MD5

                    dd2b4161313175caffafa7fa4ee184c6

                    SHA1

                    e660e3063e7771425e1edfffc45d8387c090fb59

                    SHA256

                    c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                    SHA512

                    ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                    Filesize

                    2KB

                    MD5

                    8abf2d6067c6f3191a015f84aa9b6efe

                    SHA1

                    98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                    SHA256

                    ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                    SHA512

                    c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                    Filesize

                    2KB

                    MD5

                    f313c5b4f95605026428425586317353

                    SHA1

                    06be66fa06e1cffc54459c38d3d258f46669d01a

                    SHA256

                    129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                    SHA512

                    b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                    Filesize

                    2KB

                    MD5

                    ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                    SHA1

                    a3879621f9493414d497ea6d70fbf17e283d5c08

                    SHA256

                    98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                    SHA512

                    1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                    Filesize

                    2KB

                    MD5

                    7d612892b20e70250dbd00d0cdd4f09b

                    SHA1

                    63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                    SHA256

                    727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                    SHA512

                    f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                    Filesize

                    2KB

                    MD5

                    1e8e2076314d54dd72e7ee09ff8a52ab

                    SHA1

                    5fd0a67671430f66237f483eef39ff599b892272

                    SHA256

                    55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                    SHA512

                    5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                    Filesize

                    2KB

                    MD5

                    0b990e24f1e839462c0ac35fef1d119e

                    SHA1

                    9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                    SHA256

                    a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                    SHA512

                    c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                    Download Submit

                  • C:\Windows\system32\ASChelp.dll
                    Filesize

                    112KB

                    MD5

                    6a0f36515a46c1a29da10d9aaf6c2193

                    SHA1

                    47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                    SHA256

                    ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                    SHA512

                    3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                    Download Submit

                  • memory/1956-31-0x0000016C03F10000-0x0000016C040FC000-memory.dmp

                    Filesize

                    1.9MB

                    Download

                  • memory/2116-10-0x00007FF651B90000-0x00007FF652B90000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/2116-17-0x00007FF651B90000-0x00007FF652B90000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/3620-0-0x00007FFF7F570000-0x00007FFF7F572000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/3620-6-0x00007FF651B90000-0x00007FF652B90000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/3620-2-0x00007FF651B90000-0x00007FF652B90000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/3620-1-0x00007FFF7F580000-0x00007FFF7F582000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/4604-19-0x000001F27C440000-0x000001F27C446000-memory.dmp

                    Filesize

                    24KB

                    Download

                  • memory/4604-18-0x000001F27BE50000-0x000001F27C092000-memory.dmp

                    Filesize

                    2.3MB

                    Download