Resubmissions
17-01-2025 15:11
250117-sk4kzssrhv 1017-01-2025 15:09
250117-sjgd3asrbs 1017-01-2025 15:07
250117-shlbmasqgv 1017-01-2025 14:27
250117-rsndas1pgx 1016-01-2025 17:37
250116-v7e71s1ncy 1016-01-2025 17:30
250116-v27eba1lew 1016-01-2025 17:29
250116-v232ws1let 316-01-2025 17:29
250116-v21lrs1ldz 316-01-2025 17:27
250116-v1g32a1qfk 1016-01-2025 09:47
250116-lsajjsvrgn 10Analysis
-
max time kernel
364s -
max time network
772s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-01-2025 15:07
Errors
General
-
Target
4363463463464363463463463.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Malware Config
Extracted
meduza
62.60.217.159
-
anti_dbg
true
-
anti_vm
true
-
build_name
xss
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
1.048576e+06
-
port
15666
-
self_destruct
true
Extracted
quasar
1.4.0
Office04
192.168.31.99:4782
2001:4bc9:1f98:a4e::676:4782
255.255.255.0:4782
fe80::cabf:4cff:fe84:9572%17:4782
1f65a787-81b8-4955-95e4-b7751e10cd50
-
encryption_key
A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9
-
install_name
Neverlose Loader.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Java Updater
-
subdirectory
SubDir
Extracted
njrat
v2.0
HacKed
heo.ddns.net:5552
Windows
-
reg_key
Windows
-
splitter
|-F-|
Extracted
metasploit
windows/reverse_tcp
89.197.154.116:7810
Extracted
quasar
1.4.1
kys
192.168.100.2:4444
87964754-44e1-4ed3-a66e-f8de30cfe006
-
encryption_key
6B74F0C858B7E90573D4E97997F2A082B9781250
-
install_name
Panel.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Panel
-
subdirectory
SubDir
Extracted
xworm
HITROL-60505.portmap.host:60505
26.185.184.104:942
26.185.184.104:0942
-
Install_directory
%AppData%
-
install_file
svchost.exe
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:8080
127.0.0.1:18274
6.tcp.eu.ngrok.io:6606
6.tcp.eu.ngrok.io:7707
6.tcp.eu.ngrok.io:8808
6.tcp.eu.ngrok.io:8080
6.tcp.eu.ngrok.io:18274
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
remcos
dynu
borc.gleeze.com:2425
memoki.gleeze.com:2426
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
losts.dat
-
keylog_flag
false
-
keylog_folder
look
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
-8YFPV2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
quasar
1.4.0.0
Office
82.117.243.110:5173
edH11NGQWIdCwvLx00
-
encryption_key
aGPuRaDerdUDJPrAfXtB
-
install_name
csrss.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Framework
-
subdirectory
SubDir
Signatures
-
An open source browser data exporter written in golang. 1 IoCs
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Detect Xworm Payload 13 IoCs
-
HackBrowserData
An open source golang web browser extractor.
-
Hackbrowserdata family
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 1 IoCs
-
Meduza family
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Njrat family
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 8 IoCs
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Async RAT payload 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 13 IoCs
-
Loads dropped DLL 14 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 5 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\jhnykawfkth.exe"C:\Users\Admin\AppData\Local\Temp\Files\jhnykawfkth.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\jhnykawfkth.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Neverlose%20Loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\Neverlose%20Loader.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\heo.exe"C:\Users\Admin\AppData\Local\Temp\Files\heo.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Macro2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Macro2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\KeePassRDP_v2.2.2.exe"C:\Users\Admin\AppData\Local\Temp\Files\KeePassRDP_v2.2.2.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Panel" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Panel.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\Panel.exe"C:\Windows\system32\SubDir\Panel.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Panel" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Panel.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe"C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\aaa%20(3).exe"C:\Users\Admin\AppData\Local\Temp\Files\aaa%20(3).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Host.exe"C:\Users\Admin\AppData\Local\Temp\Files\Host.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hbfgjhhesfd.exe"C:\Users\Admin\AppData\Local\Temp\Files\hbfgjhhesfd.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Framework" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\hbfgjhhesfd.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\Files\OneDrive.exe"2⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"3⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ExSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\ExSync.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ExSync.exe"C:\Users\Admin\AppData\Local\Temp\ExSync.exe" -l "C:\Users\Admin\AppData\Local\Temp\Files\ExSync.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\000.exe"C:\Users\Admin\AppData\Local\Temp\Files\000.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' set FullName='UR NEXT'4⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' rename 'UR NEXT'4⤵
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /f /r /t 04⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5549758,0x7fef5549768,0x7fef55497782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1680 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1168 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3448 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1372,i,15734869634326432188,12989567710319006724,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "563542819-20990728832122925684-201956525717265599061782283940-3684977312011396144"1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {60DB1DE4-8588-4DD7-BF87-E832DCB64601} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
342B
MD59081bbdd90f525ad5088cebe122f748a
SHA1565a996d5d837f192233ac3a90572292a4d94d9c
SHA2566451e286dc641d8b69c8d6519a95cbabbf23ae72e5be180496e02191bd3b1ced
SHA51238eb20b629f32078f4fc7df11e45bc875099c465b72ff4bf45b9078b7f85b2080fd8d74c7672e5bac72781b14c230368d4cd62e830437057e96d64bc9ece2888
-
Filesize
342B
MD59f7cd4ea59f7b84bb820c97fa3c00a4b
SHA158a4fce1339f454772d92b160b703be0088ec5ff
SHA256d8860ba475898c5f90189a0be075ed3cb41c17acff04cf3381d961737d1b8c56
SHA512134a0c23863f4799641411ad268d16f0d49bf665b9d27dbbb2335c5d90cfefa989a3cf2a1152f7b34987c19ab1c0d0fcf240fd4ab2a3113621163b72b8f26766
-
Filesize
342B
MD59df996b5890b9f1b20a6d99cae3cc26c
SHA1d842d87cd6349d4751c621fde0891c429f37d0a9
SHA2566763ea18622ab17be4b8838f50c0719e9ecc843ed405f0e74cd67897a2bf2f1d
SHA512af9e59058b730ab7d8844e5cf9f5f57697208ced06d1c9406dbfdfcec1efba370d7225ad3bdc17510d07ebf66be8dea4a90a55ceac368226a61370753f4df5ec
-
Filesize
242B
MD5d6c7458c76484f37b7b4ba66fa9b6e81
SHA12b5763ad26e3f8347fd5891919a7d3e0f78f0e5b
SHA256f54403161d4773f7f3113b99aea188765585b3e144ed9c323431112c01bac19c
SHA5122d30636d511a190257b527e2c47fc10163bd6db74e3a820dc2eb8a266731248183a04d3b13d743ad5da81dd47aaebc4c63bbf0ebb59429531886380bdc9bbdb3
-
Filesize
215KB
MD5d474ec7f8d58a66420b6daa0893a4874
SHA14314642571493ba983748556d0e76ec6704da211
SHA256553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69
SHA512344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348
-
Filesize
1KB
MD553c66e63de54b7bc5c059f25f770f3cc
SHA1f03aac0f3e66b1bcdb14540f6abd572e5345f46a
SHA256ae254e5a0b8bbf0db307711df027415c08278be9ab7b807ad99bae5f31df5adc
SHA5124059b448e12183c4ab4150cf5b73d62f8f6f389afeff580e4f978483f4ff660825e18f354bc4d6c198e823b06c78ba95cfb995e5f9a02e0b974a0a718a15a914
-
Filesize
1KB
MD5509fd6e7630d3ad2d5cfdb5e261f0af9
SHA1ba892289704e2251318a758f21ec1167888e615d
SHA256742dd12cd273a7c280489e4de2f966f8353d3ac4bcf8a4e11d97c36afafee8db
SHA512fc88b1a17a9d73adc5da12d2219fe2b0c7611e9396964f37048af63a2830c450d63ea3aeb3d591bebff9f3ecc8296e89da1b448d51afa3e7cdeb800d32a558ae
-
Filesize
5KB
MD5768bc7b1aee8279b6c37dc0d02e09869
SHA1896957e4298689d36a08136bd635bc184b815def
SHA2560a1a95f365ccf1d21267fe0cdcdf6529ca60e1a8908dcec4dc4548622878776a
SHA5126de4edb5605ba974840ed9f0d708539f116f4a1fc1c2d4452f48bfa53856bac72a1eccec2623ea0c01e29a3ee9a37cc127d6014dba462c819520147f09eabc32
-
Filesize
5KB
MD5848dda704b8119bdde398b4090928737
SHA17d11504936cbfaae82d16a5a8334152a83293487
SHA2564ec8c5a636dc0604bf2b344cfffe959896519aeba50a4b602e30ac380fb6be5a
SHA5126c0a106024c61f5843e82c0e21f985d1ddf531eb0ea97f27d2d01fdf35c242754b3623e4952d31370e6fe4f317d8454a4d0e36932569ad2274059e043c54908c
-
Filesize
4KB
MD5447a7060ce1693db55c0907393fc6566
SHA1e98dad51ddfb9c58e539b214a0d3521f849e1798
SHA2563407aa51628df74b6917a7e58cd96246436c8dc5d31ebbdc2e79865056a5fde5
SHA51295b835f3d6fff58b840bf9596374e9b19be1a0c8b02b9eda00be366e4c2ed8a5223aa14f2a350fb972236bf70ba2eeba49dd0cf00542f1abb20562b7c8b641bc
-
Filesize
5KB
MD5e5939fb689a9c9a07172ce87e8a2e1fe
SHA115bf77dfc3b0c4041e982c388871491f33c4af07
SHA2560a216f0dd4349c9b91998e6d3bb980e373f51df860a1820eedaeea1986384e17
SHA51223464aacc4a5b9d7de899b9e86c594e86d97dfe53df8b3e27608aaf496abe5fb2b9993a59b3671126c0eedfa679598659eb269980b85e7d72ccb7afe558d47ce
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
330KB
MD5c7b6b5e8eeb60a15e1f5d322ee7f4c07
SHA14519c83fe04d1ca78e2d2b13116cc5021e92916d
SHA256a046356d1aa50a0c0b7b32299d7cacc843a1d532a3044bc8e45cd0692754f7b2
SHA512d691b240f6a40a3937e1437ecff8169ebc0b9f252f1004fa46c58474a41b825f392ab548217f8686fa4c353c080aa84cb6b58c815d55cf895e24072cba1bef89
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
81KB
MD5d2774b188ab5dde3e2df5033a676a0b4
SHA16e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA25695374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA5123047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131
-
Filesize
771B
MD5a9401e260d9856d1134692759d636e92
SHA14141d3c60173741e14f36dfe41588bb2716d2867
SHA256b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA5125cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
-
Filesize
7KB
MD538a261f46e2edf9e8bfd17ba16cf2c84
SHA160fd73212a0d292a3167c7011b5dec152504f26d
SHA256148eabe1431cc34b41098efee3349ecfe0ebff7d5c941cb1baec004326989710
SHA5122adf8f2f0428274a88cdf6fde09e2e3a666ea2c57cdc665d18e56907326d0b2c06d94639df9817b4485b347b319afb69ece66bc797d131b94e259eb260e22570
-
Filesize
7KB
MD578e9ce7133cebcf09f7a3a720d9f99dd
SHA1a4c9fd16367d874e115eaa5b25b04e285abd4c76
SHA25683ba252ec90c817fe164a6fc05646786e2e8977a5f83eb28624b7d538d374158
SHA512dc396d47f2f17dd07e4b7bf511e8a9f4fb646ecc57584e88c7a60b7106a16972965486cb43eee2e554f475fa36f4716f03037353b8628da92774c2256e8af243
-
Filesize
3.2MB
MD57056e050ebbfca6ae325797d51eb2d0a
SHA1055cd6e4bde3449d72f7061620647ecb73d6b9cd
SHA256c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00
SHA5120c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e
-
Filesize
102B
MD5c7b69cb328a7f8e43de06683234b61fa
SHA1a2ce6c0ecb4d48e3565e50130db21677d168b5fd
SHA256971c13904b520ff552aa039d0a0874a4af920930d94fb456dcf9091c3364bf5b
SHA51232c37eb539a76f1c4e5c062d103b471e7468e2cf6076db746d4c24c3b3b849efa9106eed8d0297cc18918225165e900588079ce73d5629c51d71a15d9a348748
-
Filesize
396B
MD59037ebf0a18a1c17537832bc73739109
SHA11d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA25638c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA5124fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
-
Filesize
3.1MB
MD53c8875bb8a38b7b3a8ae874e24461da5
SHA1c2cbcf60e8c3639ec777fbdd614c97a5ae854117
SHA256fdb43a2f99ffb4ac9cd2a2a0eeffa531de224b45f4b8cce0bd700a89f1f54e01
SHA51223c8975c12f5d88bbb3845b0154f3bb3ea4e24bdc98f571a3ecb61cfbbc0aa25cbbb0176d2ab990c811c1d15ff7ba1fb92a185bad2c52114e7d0fdf721009f53
-
Filesize
481KB
MD541b61fec0cf85f2c46e803003580f7c3
SHA1ce2f606e9d6585df4ebf1627e9e206ad5809951a
SHA25648f6e705944c626cca75bb3dd1f46befd40ab4eae243f6f8be9dd142a2106ac2
SHA512702a338ad0254a25a197166de4868b89b6ed5f133f1052473af923918c147d6e61418b662514219b1d04f753deddb1c19be12810b398073fbc8bacd92b13f826
-
Filesize
593KB
MD5732746a9415c27e9c017ac948875cfcb
SHA195d5e92135a8a530814439bd3abf4f5cc13891f4
SHA256e2b3f3c0255e77045f606f538d314f14278b97fd5a6df02b0b152327db1d0ff6
SHA5121bf9591a04484ed1dab7becb31cd2143c7f08b5667c9774d7249dbd92cf29a98b4cabfa5c6215d933c99dc92835012803a6011245daa14379b66a113670fbb08
-
Filesize
72KB
MD5e0dbf63fbaba9fd87d48a9a0f1147c18
SHA128fc4efb669a4198234b55e0cfb6bdd39b500692
SHA2567f03382b370fbe1864dd6a4e488c0c35366aa83542916cce18fa7785b454025c
SHA5123a4f86ac97c06b0bc420552f42537c6451fbb4137c3e6cb2589551d72733b2021ee491a041ed77c01e2dcc95ec70090732fcea6b952f26323cef85d9d157300e
-
Filesize
502KB
MD5f5b150d54a0ba2d902974cbfd6249c56
SHA192e28c3d9ff4392eed379d816dda6939113830bd
SHA2561ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80
SHA51257aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688
-
Filesize
66KB
MD540a811802a354889f950014cf3228c2d
SHA1d078ed020a3183b8923d5f6dfc93020ce46b71c1
SHA25601d0ab8bbc0c166a46a3424dda8716614b7605ea04d7254d3200ecf1a2131caf
SHA51245e9b7de2757415d7a76744103a7a39f6158da73cb73637818a9172895de3714544c603f0f955f2e83a70d2c287c8161ba6af155bbee38e1fcb3a06ca6fa125b
-
Filesize
45KB
MD58123d15bb6100a19ac103b4ec3d592bf
SHA1713d2344beb28d34864768e7b2c0463044bdc014
SHA25668e92585378abdd8a5e6ba42c20a66558ebbcc964c08ba3ce56d020568ebf16d
SHA512ca048fc1aa53af7b517c2b894e038ed7e413690f2a9e9838c0a5624f9530b20ec8ca22c8d99b8b7ed1e049753970880ee047de984557e2e6c28a55ba2c974351
-
Filesize
288KB
MD52b3a191ee1f6d3b21d03ee54aa40b604
SHA18ecae557c2735105cc573d86820e81fcff0139c4
SHA256f0d45f8340cd203ee98c7765267175576d8017df5166f425f8a7483cb35a91c8
SHA51231f621fd96bf2964529607ae64a173c4a99f3976a91283a3609edc3799d98f59de80da6266ca10c26e5c8733644f1764aab00c7ba3e4dc5456573b9b20b6a393
-
Filesize
27KB
MD5feaca07182c6be327551ba4402a338c7
SHA15c699eb735def4473b9b02de282ccead84af1061
SHA25626e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc
SHA5120ada77bc81af9b5d865f06cd6f91457281bdebbf07183367b7d3d0bd598ad7d3ce081b0d1f0741efbbe6c3839620bb17b637ff9727cb3440d5b96b3eab70dda1
-
Filesize
2.0MB
MD5d3435ebfc26894fe8b895267ca8712b4
SHA160bcea02905c09e691043d05837e4942b8c4ae25
SHA2569bb3c3efac7be81d22c386057fe49041d7e7ef3da1974ecb987cc83eae8da103
SHA5128e884c0dcb76ca08c9674fb430b89e1bb9a3f999ac2c0078d2cefedfe72283d3249c5b9851064449294f8e39096f95c760d4c991238ed6338bb9409394872849
-
Filesize
14.6MB
MD50d53256905411410fcfbbbcda13abdbb
SHA1cdea834f452864559cf7471614948cbc575e0fcb
SHA256d336273cee697dec1b8f9e1643005a2cd8b80305e9f8dc257ab69d2322f38927
SHA512d6d2f8973cfda896edd0869a76773d14dc9a866be31fd1629c8cc9139ff18f1c7d84a6321cac1369d254eb64edb6bc7f7ba3d905c0622a6e5dc84faa813122f9
-
Filesize
87KB
MD549e8233c88a22e4dd05dc1daa1433264
SHA1154327c7a89a3d6277d9fb355a8040b878c7b12b
SHA25647169c00735dc8287955be416ea9f3ba9b6d8a8586b25b789370a96531883d8d
SHA5127679f8bb2868a840560b71fd9b1ffc6b1758870381161171d09c0db7179b13b71ff4cff8d1119e44283f1415424ffc491e959fb1216c4861ad0f0578fdf8e4d6
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
112KB
-
Filesize
3.1MB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
20KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
112KB
-
Filesize
312KB
-
Filesize
112KB
-
Filesize
88KB
-
Filesize
528KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
3.1MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
112KB