Analysis
-
max time kernel
323s -
max time network
323s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
01-01-2025 14:57
General
-
Target
https://webtinq.nl/getorbitalxploit/index.html
Malware Config
Extracted
discordrat
-
discord_token
MTMyMjkzMDUwMjc4MDQ1NzA0MA.G-Oknz.TO4nTCOESqqwzv5-Ob_qYyDtcT60GdqwykyyMQ
-
server_id
1322930371872165898
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Indicator Removal: Clear Windows Event Logs 1 TTPs 5 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs
-
Drops file in System32 directory 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 12 IoCs
-
Modifies registry class 40 IoCs
-
NTFS ADS 1 IoCs
-
Opens file in notepad (likely ransom note) 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3d7b1e4b-7363-48b4-98ef-3d72debfe3f8}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://webtinq.nl/getorbitalxploit/index.html2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddaba3cb8,0x7ffddaba3cc8,0x7ffddaba3cd83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 /prefetch:83⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13377863643515159039,9010947618978733223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1220 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Orbital.zip\Orbital\open me password.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Orbital.zip\Orbital\instructions.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalXMain.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalXMain.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"2⤵
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Fixer.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Fixer.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Fixer.exe" /tr "'C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Fixer.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"2⤵
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"2⤵
-
-
C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"C:\Users\Admin\Downloads\Orbital\Orbital\OrbitalMain\Orbitamain.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\67660ae6e7744ef2b1ef630fad0fc417 /t 1216 /p 35802⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400B
MD5b14a19d72b1e8dad569764e6c075c0cf
SHA117ae4e58d1a78c1c7b64bbc018f9e78892cd946a
SHA256aae97bfdaed97bad69f05f0f5dbcd86bc8dbf1dbdae2f8d98246658724b069c9
SHA5121f6f33869cee91e6d83726097e140975546b09fd65d3104aa43bc878bb7751b2a6f2872ef38685aa68f04a6da668daf5587a6dd9500066f299bc9456efb097d3
-
Filesize
328B
MD5ff28fa1b1351ce4e782e3d24b4a49aaa
SHA1bc90c5487596704f48dfc7d84ed59c3f18ee1883
SHA256793b5e3f9374bdbb17c8d2dfdf8591ef5442bd23d08ac77ab95a7e1ecd25e0ad
SHA51256d2b696ee6042b8b4de91d92670612743cd5d8f148a9aa59ea5a1a544cc047d22789327bd119283253e6ac62a928277fcda66cabba6d64d0c3be88d400f3e83
-
Filesize
412B
MD5abdcc07acfce691be41733af0e8b196e
SHA13f0f04b0ae3d003b3b5dae1de62e70f9b095c2f9
SHA2566ccfcab6141442c4d8d0efdbbef41292cd5527d42111521c95098cbd343d6281
SHA512cf29783083bd809a17bc5c0aebe7dbfff976927a6ed2e562b96256184f9c83a6b3a3ab88ca376822562299e6bf2e38a75fd6697b7dae3f8e5d556ea46af78f13
-
Filesize
64KB
MD5b0a40f6847934b610c24822c5c1e60b4
SHA17a984562d0765a185ab4af0f6b574b326410e7eb
SHA256baa3c6350471601390dda37570a20a23567c582df132eb0fbe997f36ac831da2
SHA51205453981b9bd66438c4e707a2763e00f58929f41bc2802f01ba240f3d7d46a6f2a7be9c28192ba783ef42c33d0f1e50766a70edbd61e8c48f299e0da75712a8f
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
992B
MD52e286dd0367aaf12ac7a61923b48c1e6
SHA16757cfcc28a86552fa5d535bd8e2c247ef7b722d
SHA256d33e3afd37e7150f69f78c16355a039925bb53b624587ef37727f8954c801973
SHA512c347fd6731e59da059863918e3bafa07bd50ea8f3e6f88ad8837b3301c3971376a0665d081df3d8501ae5538a306a97f06e237e679ea3bd725256cb497307511
-
Filesize
152B
MD5e9a2c784e6d797d91d4b8612e14d51bd
SHA125e2b07c396ee82e4404af09424f747fc05f04c2
SHA25618ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6
SHA512fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1
-
Filesize
152B
MD51fc959921446fa3ab5813f75ca4d0235
SHA10aeef3ba7ba2aa1f725fca09432d384b06995e2a
SHA2561b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c
SHA512899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06
-
Filesize
72B
MD568a8f1d9d10be68673daf45ec03d23fc
SHA160b79884b4afcfaac4aa09b982cfc0fd840c11bc
SHA25608c9dbaf5204af9fdd7fe466d1e4b255c3921b0fc2b62e8d31d2660dbf839f89
SHA512bc065dbc989c19e83a07c782dca9ba8ec92ab5d586aa3194a429b3fe3c8ad392332bf7d9acd09eb963cab2698341da98ee002a383f4cbab77792a4345517adba
-
Filesize
1KB
MD563281958a6506f9562f9035af3630e7b
SHA1965ca382ccddcfb22c2ef5fb4fe02dd1dcfeb017
SHA25673ba6c1e501d099663adba47f38b0f381d8bbbe7482c9481d21598d8ead64ad7
SHA51280ee82319198f2a553341d38620c5b44d77962200a2d308183d153fae19214ae88c4753e694357d5f2993f51c85497387af4f3c612550b05d90673c633f1efdc
-
Filesize
719B
MD523fc28ba429bcf8231cebbc351f290cb
SHA15244cf61a27697298c30eb44b76abdaae420d2b9
SHA256a98fa8268a5e33f7e378e27b1eaf74fb68a31e71b5fbef6f1058bda728e7d917
SHA512fd6244dd495e27b76a652812f773cac594f01ebe73e8fa46b0fc7ebb5547de9995b6b1beb29d88acdfee737841a11feb42e63d2dbb54f250ee31ad9acc7cb78d
-
Filesize
5KB
MD5c9a61bcc2e5dc46ee754fd9bf4033f2d
SHA13a208a5b491b06bb636fac76dee6d49154d68c54
SHA256c70de4a3923b59a6d806d088b105978c8eeb014cecf0317fae019eba1abcf27e
SHA512e64cc165dded063cedeab930409f27b3f9177e21c317af621554d21c8f9fcaa71dc87b6c53adff831c3f3d8756090b98c6414d7963a5b00d8b3e78810e30aa7b
-
Filesize
6KB
MD55505a2cf9900081da9609aa88951144f
SHA1a46bb307498005a274bf43fd7a3b33e61f3eef32
SHA2568676dbcf50ed1c649d6347e79160c836d454f1549079e28db20455d6a2de36e2
SHA512f354a4bf0063e81d21266f20cd13d88dbcf551bbc5ae7c061daffd15c8099013c074ce598da1a70d6993d1dcb65e8150b96ce4ebd1bf9e50f20b9cc8f7a1a38f
-
Filesize
6KB
MD57d08a42b07710de480ab5096277b2dd8
SHA14ab4c9dffd422744b6dfa6273d45932b6934cc97
SHA25624a8eaa684934fcf447759a4f6c0c22da965b05236e3e3588c1018c506540c08
SHA51239d374aee55e0e28d06f61c51f17a4a0e4a540546f11067b59b1b28d94dafa33ad6e7e647667c7c9b6d1bc25fba93fea2fae0bef6cc5f70b8c32c85abb12cc7b
-
Filesize
1KB
MD5e64ec6524fe4e9e5f13af224b2c972fd
SHA1daf7dd104c172a2045fcbb10e9b626f9960c22dd
SHA2563dd4c1efe6a8dc8aacac8c4834d4628d3c52488fa1221752b4a9747895c5ec86
SHA5123683a358dd2db5c2b0dc994038ccf3fd9099da2777c2a3324f2e813d363e1752201ab652cc277aa6ea2d56f6e210e421229ce1a7b5f4d2a8ba314e3b5b24eedb
-
Filesize
372B
MD557b56cd6714ee326f40569e04d9fdc33
SHA1eb001045b3228c84c40ea37d358ba9797146c1da
SHA256536faf2f6fd50fef03f932d85ceefe1a757065f32b7f9b88d6bf2dbd349377a1
SHA51255cb36848fa8f996d3e5d6e9a3fcfb107c591d970ab7dd0e8ae963a8b8b6b05cb6d31f59896b1a0c77366feb45865f43b28dda409ca0a7a867182e20fb7f208b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53eac4972b22b5108fadffe9f8d14c955
SHA1aeb6a50d013c451aec2406b621bec3b6567b0aad
SHA256a523000b0944ddebb34b9e380c6d6941aa5784f68dea1ac3bd4b28ede14426dc
SHA5125deef816257c5fefe21c56aa9f3d54a97df74918673e00f19ea21f67e2738e90318f212fd0ee3524030ed98f2c548fbc7587174e5a4d08ee108aaa6d5f4ea00e
-
Filesize
10KB
MD5c177a794e0a83de226ffe44a1bddacdd
SHA1fcfb38a592d4decd76cc204aa53375f4ca855589
SHA256fc3d613d931fc6e269995d6177e348ad5820591e463b84fb84d33a9ea4ac6c54
SHA512db184266d29e9ff8b79f81d4de51cc59201bf49d9359328431e49d8167920daca314f9404761928d4c2f53581f8b7ad509f9db586192d82580a3abe7727e50ae
-
Filesize
1KB
MD576f78e3e5c1037907fb39472ed929f93
SHA105a3b3be7efecee2adcc7e3dc3da2a48173ddc64
SHA2562a340d9f2006a1c4a7aab982e7d873581492bc9e48e5cb8bcc6e90b9250eb241
SHA5123b99e6c4a7255429c90cbe8b467b9150830f5741b043610713f02c410afabf083566f9e36dafab5e8ce349132272524689a5b27d6eb6c69021673f73353d3bd1
-
Filesize
1KB
MD548b0eaf1bb162151984a1a5e8f42f5d2
SHA11b76807636ca871614f8a6651b69db7f4d321c4c
SHA25680cce177d970965bb35cb376bb1c4e9f8da4a4f131286f2a3279ee3e8aa52260
SHA512dd047d6e834769783bd1fa285b9d09e37ef6cb30acc57a0079ebb95e6a595faa2da854fc0d9d14e22dd300328ceb0ff7a54c5b6f1ab542f25f8ad02be844b32d
-
Filesize
1KB
MD5af4a155ac3f8681f96a9497a8e4d466e
SHA1f54c6751fb0e0e6d7b07d8c1a9045a80884d717a
SHA2569339ace77cb337d1a875653e1b470d2c463420dd9a92c9a57c5d7a1430702c46
SHA512d992b730e4f71c2afb7dd7540afba754e7dc177bab65616c0d94ac515f5d9f2e961de214a2e57ca2c3549768d092a5de43141e808e90a8dc2df98a7a93f02263
-
Filesize
1KB
MD568c2368f8350fdfbfbf520a18aa6e322
SHA1ed2c15bc40db6f3f7383900a9b20cffe270414db
SHA256ff72162a5b7c5d0110202de3ec68eb24749a98e6b9176061e0be5165846fbefb
SHA5124630a9cce40457bfead01b62d6b23064a5a08aee98dde35fe22085615af3013d521e3c252456ff3617fbc7208adb1610095ff7f2fee6c94e788069a81be5974e
-
Filesize
1KB
MD581beda1216d86da86d46e6722cc52902
SHA11f67adcd43502b0e1a4b2441b58120be4395696e
SHA25613743ee7f4bb850512a4705376f9cae963cea98f77009642d1b034a6dd910f60
SHA512cae9ba2e8a244a7faf577fa4ee8d5007a575f934a2329caeee3a2f3601a2c2157f3011ce89648426a4f6b1e62826f7ec67dc19e454644a94e9142d8755f384ae
-
Filesize
555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
263KB
MD5c4ccd9c5e716ef71827dc5d040ef17bc
SHA14125c4b181bf88fb6ce973db1c6bc9561a9271aa
SHA25663a121192cf416ac3d3fcadbe4fdd47528791dc1a4292b766ba4d4bc0a7c260e
SHA51286eec5d8d3c70aea560bace1323048b1f503938cfbc048ff2f25fa3db4e4bf8d10e7b8dd87dcedc54d5698dc45ca077002f28339e4f1d08c4f27261087f75f30
-
Filesize
626B
MD53fb89c7dbaaaa8b7f97e392adc38ea2f
SHA1581c3b2434a1228b0faf482d9dbe5bf2277974c7
SHA2564a6308a758d24dbea45c11bd9de9afbe7a627ff2630d9f2a6a83446877e11fdc
SHA51245e92a8ba9696ee211c8f919a40f1bf202e6740819bf4912bbea5c485f001993e62dda0b9ca1d426c83a0be3341700c9995129054ff91d67d7c3f2704c182170
-
Filesize
9KB
MD54f157b5055b21ae34028756156c332f4
SHA1d9c1427ea79fcfb6187b32f206ff796c539e6f67
SHA25635d66d80352ea77ddab275e0656bb5870bed7b7d60db2e6dc6d7626f63eceb7d
SHA5125afd347c51f1176b9d2b7e98d2748e14a1c52751c1734e5b2c753a45c9b1e0f032aa0f4277cdb02712e29cf47b4d01a95d3677e854d936391f82ea13c362d71b
-
Filesize
10KB
MD59cedb829e302e2b712316919e9f14e47
SHA16324836e7802efbb5f41987efac6e1f0015611eb
SHA25697142929bbe9cf39de7d69a3af19c7a1fd4db531f7e7851dbe20f36f746e416f
SHA512d94a4925a276e148a679b88be740017a965dd6f8a815a5e57954a7f70c053f4896a7fad38b0fd192d28ee11f83d6ad321cb2ab68afaae11aed05afc76df78ade
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
756KB
-
Filesize
1.8MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
248KB
-
Filesize
1.7MB
-
Filesize
120KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
96KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
256KB
-
Filesize
256KB