Analysis
-
max time kernel
900s -
max time network
712s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 04:25
General
-
Target
bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exe
-
Size
3.3MB
-
MD5
c883ea559bee9a0cb393aa32dcaf5d80
-
SHA1
995dfd0d9d504bec628e7d7297962677d8ab32cb
-
SHA256
bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9
-
SHA512
9ee8ef8a9912b14bcbeb3c13b2670c92eecc17c4a8a719d6bd9935f17239a244457e2f711c01e374febd767c866d6c563bad97e687680919ca0c017d738626ee
-
SSDEEP
98304:db5Nf/dq7yqKM1TcGZ6gtq1/Lko4uVa8N7:hMyqKM1TogtqT44NN7
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings 2 TTPs 53 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Adds Run key to start application 2 TTPs 16 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 29 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 52 IoCs
-
Runs ping.exe 1 TTPs 29 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 59 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exeC:\Users\Admin\AppData\Local\Temp\bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exeÂc:\users\admin\appdata\local\temp\bfd1aabb65dfce7b7c5f2d444917baa23fd04d6047e62cd1aaf9cb2a9ca9d3a9.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\blockcomSession\containerReview.exe"C:\blockcomSession/containerReview.exe"5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0gdgrh1u\0gdgrh1u.cmdline"6⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4A8.tmp" "c:\Windows\System32\CSC72561D34D764DE786A95813C8702816.TMP"7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R9Wtkv8OgE.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost9⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HqVvjk53aP.bat"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CtBPmh6epj.bat"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HqVvjk53aP.bat"14⤵
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wckvReZrUI.bat"16⤵
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat"18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sFt2vWrbZi.bat"20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost21⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y182dPLPTa.bat"22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bjcQ5hKx2L.bat"24⤵
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eyO6VICV7m.bat"26⤵
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost27⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZFxA7ALGfV.bat"28⤵
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost29⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJeeA8Mqtp.bat"30⤵
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost31⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VXTmetMh5k.bat"32⤵
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aUnIbwK7qQ.bat"34⤵
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost35⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UeH86Hd8X1.bat"36⤵
-
C:\Windows\system32\chcp.comchcp 6500137⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:237⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"38⤵
-
C:\Windows\system32\chcp.comchcp 6500139⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost39⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KyXgl7nTK4.bat"40⤵
-
C:\Windows\system32\chcp.comchcp 6500141⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost41⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ng14EOm2tp.bat"42⤵
-
C:\Windows\system32\chcp.comchcp 6500143⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost43⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jvhcSLBvsS.bat"44⤵
-
C:\Windows\system32\chcp.comchcp 6500145⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost45⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F1DAo4o4YO.bat"46⤵
-
C:\Windows\system32\chcp.comchcp 6500147⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:247⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat"48⤵
-
C:\Windows\system32\chcp.comchcp 6500149⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:249⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat"50⤵
-
C:\Windows\system32\chcp.comchcp 6500151⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost51⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lOMsQrAcGI.bat"52⤵
-
C:\Windows\system32\chcp.comchcp 6500153⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:253⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Phxc9FejmL.bat"54⤵
-
C:\Windows\system32\chcp.comchcp 6500155⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:255⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m3jNUitKc7.bat"56⤵
-
C:\Windows\system32\chcp.comchcp 6500157⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost57⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CtBPmh6epj.bat"58⤵
-
C:\Windows\system32\chcp.comchcp 6500159⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost59⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EMqflE6MDZ.bat"60⤵
-
C:\Windows\system32\chcp.comchcp 6500161⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:261⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y182dPLPTa.bat"62⤵
-
C:\Windows\system32\chcp.comchcp 6500163⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:263⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfQPUbaSjc.bat"64⤵
-
C:\Windows\system32\chcp.comchcp 6500165⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost65⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aUnIbwK7qQ.bat"66⤵
-
C:\Windows\system32\chcp.comchcp 6500167⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost67⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"67⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Phxc9FejmL.bat"68⤵
-
C:\Windows\system32\chcp.comchcp 6500169⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:269⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"69⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6HUNmoPWiE.bat"70⤵
-
C:\Windows\system32\chcp.comchcp 6500171⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:271⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"71⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dxSYZSKoEG.bat"72⤵
-
C:\Windows\system32\chcp.comchcp 6500173⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:273⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"73⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oXOdSEs2zx.bat"74⤵
-
C:\Windows\system32\chcp.comchcp 6500175⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:275⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"75⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 12 /tr "'C:\blockcomSession\containerReview.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 12 /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\All Users\wininit.exe"C:\Users\All Users\wininit.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wckvReZrUI.bat"2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\All Users\wininit.exe"C:\Users\All Users\wininit.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Recovery\WindowsRE\SearchApp.exeC:\Recovery\WindowsRE\SearchApp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\igsUyaB4hX.bat"2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Phxc9FejmL.bat"6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NS7UfUfsaQ.bat"8⤵
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sFt2vWrbZi.bat"10⤵
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KyXgl7nTK4.bat"12⤵
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HVsQnaolwE.bat"14⤵
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eyO6VICV7m.bat"16⤵
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sFt2vWrbZi.bat"18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jvhcSLBvsS.bat"20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost21⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hR2MTpBDVc.bat"22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Phxc9FejmL.bat"24⤵
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJeeA8Mqtp.bat"26⤵
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost27⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files\Windows Defender\it-IT\upfc.exe"C:\Program Files\Windows Defender\it-IT\upfc.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xqZ3vPYigC.bat"2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\unsecapp.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Recovery\WindowsRE\csrss.exeC:\Recovery\WindowsRE\csrss.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Phxc9FejmL.bat"2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\csrss.exe"C:\Recovery\WindowsRE\csrss.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\blockcomSession\containerReview.exeC:\blockcomSession\containerReview.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5935ecb30a8e13f625a9a89e3b0fcbf8f
SHA141cb046b7b5f89955fd53949efad8e9f3971d731
SHA2562a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9
SHA5121210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa
-
Filesize
176B
MD55e870e9cd2a08d412b102b3a61726c18
SHA1cdc3eb983a7ccafec8343fc86ef0bc18fea36d8f
SHA25600fcd1de10549c4274da1c17388ba2ae110d5d4f9cc7d0afe5ce00cdc71822d0
SHA5123d23396bf819c4d867a88e2eef9600eaaa78e8e4502e39cf36ef069b1d5a55e8ccb08cdac9f89c63592bb29c5a094b520972b3a06c5fc31f947a6d7c2dca8abd
-
Filesize
176B
MD56c3a8d4b099eda991c027ed37bc2b76f
SHA184bbc7cc7e521786cb53dba79bfae319eeff1be9
SHA25643ccdc4ef948ef1745bd247a1abff0bb765bdeeecbabc87b41bda8cb9f474e30
SHA512a0e7b90b5dedbc7a73460844bda23ce09006b7fb6b4c72614c78a231cfb1bd69afaae5068b21ae39dddfadea0bd42566bf069df3ed39ed2460ad4c5f505e9f12
-
Filesize
224B
MD5d7cf75ba202660057ac3dc6bffdbbc83
SHA10cf62951a239d43704b4692304068d1a5ee2e5fb
SHA256b24c0b71e52ee469c95fd0dce2183434106f5ca81e188eebbd6eebfe9b5fde9e
SHA512e7f44b8283d5442693d047c709875ef3a72af7c847daa380e32832284b115c9e935bafd15f026bf8a907e865bd664e0dcde5f7bab5cfec9c5015eb76cdceb073
-
Filesize
176B
MD501ba22e0c4a1c85e635a76bb0a4bb97b
SHA16c4636c65f89de17a329696ef2de2ba42024a532
SHA2567b8f2ab6a972a87978bd49e9bb67e610724dfe128d51d910b5944ed152e5e013
SHA5120c865330d87a504d0b7e5348771e9991cf63c6eb93c5bb336ea1b3d50e89fd1afa54f11661c1b16c56a236e7c725b26076419c43f4165ce521fdf5ed124523e4
-
Filesize
176B
MD57b42f14e11e859925c688d04ed3cc7de
SHA108d8a8f9969fa58be291072fb5484f7f609795bb
SHA256fc7681440b1d2f03cf908dd4c281dc9d949b13af4d1496edbe81e696d33ade43
SHA5120f88a0589117eb24e37a9576573023a132c2e75d8e6520730b333e8e971364ff94e51ecc7950b8cc0336c523d30b8d19e3d34bed1b2bd2ee5f24d1db909f6813
-
Filesize
176B
MD5dabf051180e9de0b44fe8f1f038d075a
SHA1d7799f2f6d8ec7eec51eea52ab6a97137214359a
SHA2562acf223ff5b4be76a9c711601b9a120d27a4c524e8485417ff0e40b3553ebdb0
SHA512a392674ed43d4acc02d48c674d8f46eb1ab082c2609799ba9144945e90b8d1f37e349a68e3fde63b8d7e6f8422827593c3a3086905000df190b28a07aa8a9c29
-
Filesize
224B
MD5af2005b91d3fd8d4d5c8fa4555fcad12
SHA183936e32d4d009ac6955b694ea396d9ea1315ca9
SHA2560c62b3abd1f41758423bed7736d9038439bcc19f9511831e8902da3f8cd2234f
SHA512f766701222bf21a185fdf357772dde4320219e95d9b16d4c70cc96bc9fc897ac695700e90284a71a79255a0dc682e5c7f157c46613f3d1e3c9b94ab8970b391e
-
Filesize
176B
MD56f82d121ae75b09a9245276d06b98812
SHA18e08ab798e30524bf8a9c4dc4c454adc7806e2cc
SHA2569410849db1f21c9acb3e4a5d82dfda261126b437724d3936e9e74fda4a661361
SHA5128d561beb840218a734393e8fb85dc6dea5ca83e31a4ee52ef94bc76404d9f15149f2f764eff75647afa198fd1d684c781046e37afe2b68241ab84add610cf1e1
-
Filesize
1KB
MD51f6807543405f4cae670d67d8939b1b5
SHA12e635f6b96b20941740fef0ef95918e5d21d5cde
SHA2560720bf9cb444352a3bb6a54b8d11dac9c36409ab674d958d539eec5bc8295852
SHA512b8a43a649cb32a23d4acb0bf5b213476f0282a6ac9c9d20de985d76210581625ee7969315c48e565284650db9f2e6d1fc74ff2528b6f12c2290ed11644341e39
-
Filesize
176B
MD5d6931df40e393ce8b3cb00155f60113f
SHA18736f3e78fbca7352b9153fca3943cd7463335ac
SHA2562852c86f0deda6ecb9b1eb804e434182b50bf8b7d69a2cca96ba7a829db53bce
SHA51252382b5530cb1d465c8d334893560d18466527072729663b9a408938d66c2b43c5f1dadb37f00f261ca8231d431ae9ba7d8df61daadf3da126dce54719201ad2
-
Filesize
25B
MD51914d68728123bb5932fefdf53851ee1
SHA13a4419ca7e739661dc0c78b08ccd9f208bebf5c3
SHA256f3ebeea70869a6604add824b99d96f8d77500e5604b16f36564cd880829989db
SHA5124e14facc7cae69622e1e9bed647cb6c0656cddfa2f962ac26fa4b59caa5efcf61f589793b2f6125be60fa68a33e544b4ec193e1ab4dec1240f166155925a69e2
-
Filesize
176B
MD5d9180e63333fa1fab08107603143857a
SHA12c0c9649829ef84b604043bb093e390cdae13971
SHA2567b9221adfe7a5444e78556f6f821d8963c5e3f5f82d860387218e79faedc91e0
SHA512d9df67bf332fd5829a21ad723ea7b2d6b0761ee2d2865736e07f4d29fff19dbd0278ef72664717712653430c6cef85a3e96abaeb6c6b45cdc906e444ef709681
-
Filesize
224B
MD594c3f722049b6aae75526a3889fac216
SHA1000f45d391ea1f32f83a3159b3ffa5ae8fc6e689
SHA256da26a6cdc2474b31cdb20f19c679c6b6bd39ac91198d1f75a2d2527b71996708
SHA512eb5dd183773a24c230ba7bea099938545b47b434cc26f41a147f6b5c0b90535e16bc085dbd8175f21640e91ac349f3a4819696b19da7f69f0751ac4f7e23c31d
-
Filesize
224B
MD59c03f912c4fdc80e50cdd2a4a3b33797
SHA11653528ab1782d7b860d161758f92c8ca08747c5
SHA25642908985daf033bfc9d233c7c45c4a363eefb7e6c375f1833c4132b9084a4a35
SHA512cb0713f6c9030ceabe6e5d3e025fff76e71355981a54d608c432f41ea6cdc7b5c5fbb23ee4f37c60d966af799161431e8c8db59fd51ea85a23f41c6c59a67fec
-
Filesize
224B
MD58a1afeb2459447c6af0da0aac4a7c378
SHA135f1759c1368815870c3f021ad2de7b0b1687ac9
SHA256bfbdd6e5d9657c4dc21e5185e65c0a0b3f68adab234c4111545ff7276083bfbf
SHA512fe5a943c35c64cea4a57e87f6a59ab8cd1cac0851b3a0664faa0c9e63bebe4594558358969daf571a1823841af513561f88c8d6c047e62c2e4382fe27a55cefe
-
Filesize
224B
MD55c7127f2dc5c767ea161c6eb61fb0884
SHA118be4d589cf3dcd1b472d205c82e7558c3f2f275
SHA25658a4d810fac481cc67196e95f79267d61bf7e5e614bb9a8ec47500984760ea9e
SHA51298e66d980cbe66a4572074aeb5edbb35784eb7bffbfa7ad145d2b4b60fc8271aba6b3dd1b12189d62a0ab06b8a4866896e0953b34189fca50348763dcf39fa18
-
Filesize
176B
MD5624e3bae46490f5cb1f5234ccc242e19
SHA12db49ffdb6830c4844d81a2d20e73a8cda487e42
SHA2560fa0655b4ac4e579dac117f3a87373b61d043c54202b91e0a0cd709cdad418ed
SHA512e0c84da4d65d389e5867180dbff43a29103132340b47b07efb42c8df32c1a5307426c08b57824fd0187160af3664908cc7f4e5a3d5be3972d1d8dc49809b91e0
-
Filesize
176B
MD5f92fc7467815ca757ab275e899c938fd
SHA1bcae844202836c14a28fec9ef6d5807e2b82c8d8
SHA256299224524f2dbae0062bc858b6a9844694cf4ad27adc5b64d7e9620a0d79523a
SHA5121de1cbd2a76775d681fe2e3da243c0343888d80e4ad35a30e730a522865050d97ccbc7b0e3adb32cad1794231829fc7597634d1f6564c2c682f1b2bc9870a989
-
Filesize
3.2MB
MD5a7040b85fc683f088f4c6e5b44052c43
SHA17e3d644d1a1fb7b9bcccb6406d2e7fbd062eae66
SHA256b786f31f1c89c71d0510bbd32510595d9891c67db516f968261b02594a423a8d
SHA512e225f6f7e114690aad25e9c67460e50f5b84cc8ca87a69ba94ff63ab42415df176a3ed6c3456cddb849927604a4888b17e5e781ac97d2ba0197f9687bbb2c301
-
Filesize
224B
MD592ee6acca5c3f8438b1152bb969b1512
SHA168c07f0126b1313e5e2233f9ce563bca5fb61999
SHA25650086f9ba53a95f4f31a95ccd61034c73677a05b6be03d58502d3606d1accd7e
SHA5123adba27905b36f8a2f7ff60893877a8bc790bfa9674456b5a3c71b6137cea2b1ba204fed756d9767b4cd0945d640babfb59819ba56638d7081a1119c177d0878
-
Filesize
176B
MD507adbf5ab26c3dbd58b3ff22f350f63a
SHA15e31662276292f1a8bd695a338185782f6bd1604
SHA256f102ac2d7385c07c988e5b130df6cc914fe987d4538a16e39d19794dc70d3554
SHA512db31674f932bbc65148d1fb687529ea048bb0fa975bf60a328e1f4f1c9af77192767d2757b2d303b74880e6613f86e1f7ce33fffa0317dfb40dc191b383e9d6f
-
Filesize
176B
MD54c974f77968dc12554ad1c8a8691f600
SHA181cf5687025eee9e015ecfce00c4086525edc953
SHA25654bdf22568b9d751ae10708c659e8bfe8c7f740af493e1172786b3fabfc84be0
SHA512f0c4bf1912b23f41fd3ab76eadc306c52fb8f8938c305230443aee7e9472ab0235ef7123fb32ecc7254ae6cc92f992868a6d95f20b745bc989f93babb9797ee0
-
Filesize
176B
MD56e8b195b6b99788206a3091c9090d1b4
SHA1daced52954df2b19a078b593e254b3ceef2d1e1b
SHA2564c86d9af3c2ace9eaae4bd8897413e21b2ab44391f469b675a2181b21dfff003
SHA512beedebdf91269978a0d0cfeb6e2f931100ca3bebe7f63ddea5dc428a32120334646abf0e079d27d66b260482d1932713a03461ebf60d752a701edcf3a53f9840
-
Filesize
176B
MD500a7ac262c0a509c61e1f2c9abd2274b
SHA1bdcfaac0e4586171f082015dca3ac0414c542b23
SHA2563529d64e9e986e22cde0dbeb53efba27dcbb26146a29056cbc3a141535dfce30
SHA5120aef89e16a12df15e1547f7f38375e5c803a39e66eb152112958326f13f9442acbf57b54d18a2ede9c4d533b5b290c4a799673fd518e877cbebfccfff523702f
-
Filesize
224B
MD580db051ba04939a597499be1c85d0bb8
SHA13c42c9bc738a3f86164f43d955567f569e4e5756
SHA2569fb471fd6ba08349e50fc914b29b3baa406b74681f065e2aeff41f1592b3effc
SHA51254fa1defea8ab0d216be0ccada12dc8b33a4c4d5dabbdd09d2a1c7667dd61f8d63fb2b12fc221e8b246290efe854ccd477da73ab990eb049af546ce21458e187
-
Filesize
135KB
MD50f5eee176fd520119f942c75c0f61b0f
SHA1f094a16f73019d99f50dfadb8e53a449cc3fc41c
SHA256b9d0d1e3290e6ade8ca74b9eda64ace170eaab5d5e6588ab60e088af2751cd3f
SHA512bdb093133063399b6f3b1d2d590afb19070ddfa4b57af4e6fa959d06653b2b309c42bfc4776dccf71a8f0e08ec80aa5e0d497d48166dcf24cf4581d84aead661
-
Filesize
135KB
MD5d36cc2935ae0e7a5d2936db589a9b8cc
SHA1082bd58c0ad60fa4783b63a4f681a5c5fad8e1a6
SHA2564c93adb50768feb3cdea95f1fedc5d6fdc262d59f12c4b66601d377e2709c2e3
SHA512547452ba0de7c8ebeec8e4bb2d916c7a881b6743e6d1fb6d2761a202b7cf5bb30c3f541957de70c584b46b7171f3f20338b4985341829b408c366aeaeced9290
-
Filesize
135KB
MD5d63cd31ff5fbd41966164e2dba97dbb7
SHA17d95af735d6e51ebac61b7ccf5ee9b4e064d6b2e
SHA256383876cb605c461e802639805465c64e8ccdd5823e8d6377dc9f254a490a1e00
SHA512e7c1c2cb44ea9d17a373a47dd7999a575528c14bf51dc2fac43c0a99c2d5be14421556648545f97e68eb3ba84b71523bacca78c36a982805f82a036fb9e5bdce
-
Filesize
135KB
MD56e176510e8d75afc1b8c9591f6563f3a
SHA1c84932d503c85d7df62c897c6f5601dc92202404
SHA2566f86bdb3f13aa9622544ff99763dc97bacccdd88bc6819ddcd2fad871f4f0bc1
SHA512c3c29d101a8d4bb8f9d31e339671a206822f27f9e7fab7825ac69a4b178e8939c987c12089f400b92a0588ed63332a376aca8800b07a29f377cc33b88b66f548
-
Filesize
89B
MD5de5b4fde5bc10d0f76a55eb9d249ab56
SHA1751938b6ab03340842b429805fd2da1aa0d8c964
SHA256009aa3f866391c87bd840efb9b6b4eb33fc4dcb625cd23e436d0c9383e033f0f
SHA51258f02657db363b742c6aee66ccd5a6b279280e2dd09d7394b7b9907ca2cd005cd67ee88ca98d533605e30608fc61abc6f51f7d3be4a3813d7414d280b6f16a1f
-
Filesize
236B
MD5d2dd350044ce1fe408a44a036a7e6a0d
SHA13597e45deb69f4aa4749855e9ed452a39a9c7d42
SHA256487bfe07abff347481f10c648717aab8008c7606c026b920358544f85c25e1b2
SHA51281147d83dc5ffd1adb10add8486f6dac65df0e7c579f8244ef8f3d6f646ced97fad3f55a178ced9b60f5f23bb77a0e29bccb22651280a9eae135976af71c366a
-
Filesize
1.9MB
MD5f568e43bc473cd8ceb2553c58194df61
SHA114c0fff25edfd186dab91ee6bcc94450c9bed84d
SHA256c91375814e8a5bb71736ce61fa429bc7b98a2b7b2a254b9967c51f3fccfacd52
SHA51247cf66ce90fecd147077c72dc3f06db2199b9bc96e887915d6b0d4bfea7577d60a7345da6e5bc59967d02528fbdf6c8bf86233261338f782b9185c890fbc400e
-
Filesize
362B
MD5333b886645af34523278a6c234d3d1a3
SHA1455f271c635bb6cb81b25b6b5d7a66c07781aca6
SHA256d12ccc835bfbef7d44cdb24dd5d84c5231546d544ecd98982594c62a5ffc0b06
SHA512c1e8683eda003332cfcd64699219a5c7541d04ff1e667d83581e5c736564d8c67098ac01b96f033caab006e4f9ca291f5d36343b4ff4c5808ed6260f33cdaa1c
-
Filesize
235B
MD54624855d8377e2d7fa346d398332fed0
SHA1992361d4e88c425caef3291c4eae902ae84ea521
SHA256a6a21057fde7d0bbd8be852cb76b960b7a1aa1c864f6f46ccd0c21516d1551af
SHA51201c17f7c477d2e246075e1f3d4cc7378a9b770f4553dd2a73418dcdb55183f89a79c26a1e070afe79aa055952a24ef70d27a7040ecd96248e1d575caabb1ccf0
-
Filesize
1KB
MD5ad61927912f86c7c9f1e72720f4ef0ef
SHA1dbb61d9d5c7310c85716fe9f445fee2151cef437
SHA256bf2696fc2183af293d74c988add5772c1c7257c2e85ae754e43cbe0e1d105a1e
SHA51233b6f9f93672bd0ecb68e553de0ce92dd6b773c62da7721c9544171df7de8b8588e9ba42e13836db5d5ffc078ca656993f8d06a857dda5a27e1d639d5a6fb3ee
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
48KB
-
Filesize
1.9MB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
56KB