Overview
overview
10Static
static
10Armageddon...ty.exe
windows7-x64
8Armageddon...ty.exe
windows10-2004-x64
8Armageddon...ht.dll
windows7-x64
1Armageddon...ht.dll
windows10-2004-x64
1Armageddon...ax.dll
windows10-2004-x64
7Armageddon...ub.exe
windows7-x64
1Armageddon...ub.exe
windows10-2004-x64
1Armageddon...ip.dll
windows7-x64
1Armageddon...ip.dll
windows10-2004-x64
1Armageddon...er.exe
windows7-x64
8Armageddon...er.exe
windows10-2004-x64
8Armageddon...k1.exe
windows7-x64
1Armageddon...k1.exe
windows10-2004-x64
1Armageddon...ub.exe
windows7-x64
1Armageddon...ub.exe
windows10-2004-x64
1AttWorm/AT...ed.exe
windows7-x64
8AttWorm/AT...ed.exe
windows10-2004-x64
8AttWorm/Jint.dll
windows7-x64
1AttWorm/Jint.dll
windows10-2004-x64
1AttWorm/js.exe
windows7-x64
1AttWorm/js.exe
windows10-2004-x64
3AttWorm/sk...et.dll
windows7-x64
1AttWorm/sk...et.dll
windows10-2004-x64
1AttWorm/sk...ip.dll
windows7-x64
1AttWorm/sk...ip.dll
windows10-2004-x64
1AttWorm/sk...er.exe
windows7-x64
8AttWorm/sk...er.exe
windows10-2004-x64
8AttWorm/skci/att.exe
windows7-x64
3AttWorm/skci/att.exe
windows10-2004-x64
3Aurora Wor...1N.exe
windows7-x64
8Aurora Wor...1N.exe
windows10-2004-x64
8Aurora Wor...ip.dll
windows7-x64
1Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 16:58
Behavioral task
behavioral1
Sample
Armageddon Stealer 1.0 by Krusty/Armageddon Stealer 1.0 by Krusty.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Armageddon Stealer 1.0 by Krusty/Armageddon Stealer 1.0 by Krusty.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Armageddon Stealer 1.0 by Krusty/mfc100cht.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Armageddon Stealer 1.0 by Krusty/mfc100cht.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Armageddon Stealer 1.0 by Krusty/mstscax.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Armageddon Stealer 1.0 by Krusty/stub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
Armageddon Stealer 1.0 by Krusty/stub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Ionic.Zip.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Ionic.Zip.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Launcher.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/Launcher.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/ak1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/ak1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/stub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
Armageddon Stealer 1.0 by Krusty/viewsource/stub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
AttWorm/ATTWorm Cracked.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
AttWorm/ATTWorm Cracked.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
AttWorm/Jint.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
AttWorm/Jint.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
AttWorm/js.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
AttWorm/js.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
AttWorm/skci/Extreme.Net.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
AttWorm/skci/Extreme.Net.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
AttWorm/skci/Ionic.Zip.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
AttWorm/skci/Ionic.Zip.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
AttWorm/skci/Launcher.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral27
Sample
AttWorm/skci/Launcher.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
AttWorm/skci/att.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral29
Sample
AttWorm/skci/att.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Aurora Worm v1/Aurora Worm v1-Cracked by RoN1N.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
Aurora Worm v1/Aurora Worm v1-Cracked by RoN1N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Aurora Worm v1/settings/Ionic.Zip.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
AttWorm/ATTWorm Cracked.exe
-
Size
206KB
-
MD5
65173345032c2910ed0e8ad3361be38c
-
SHA1
396fd05f6f867e1de7aef2a92065f7f901f6c8ce
-
SHA256
713f8d4ead380959fe809e0be9915fccd282d25d0ca22092f8cb3cd2568b15a1
-
SHA512
55478c8b238a76a37a2a52b36d90aefc5a6620459851c84f1b1108765b076dae21039ddafa130bb9265ba95ced8f0eb6365217a822812c202cc82d5a5a142a28
-
SSDEEP
3072:T4lNncqsLPc20jV9yI95qeeeRUeeeO41DMf6RNYZVyZVijCvu:T6NcqiPc9jn9ueeeRUeeeOgvY6
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2680 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 26 IoCs
pid Process 1916 Windows Services.exe 2372 Secure System Shell.exe 2128 Runtime Explorer.exe 332 Runtime Explorer.exe 1504 Runtime Explorer.exe 2732 Runtime Explorer.exe 1652 Runtime Explorer.exe 2908 Runtime Explorer.exe 2144 Runtime Explorer.exe 2204 Runtime Explorer.exe 1692 Runtime Explorer.exe 964 Runtime Explorer.exe 1616 Runtime Explorer.exe 3068 Runtime Explorer.exe 564 Runtime Explorer.exe 2628 Runtime Explorer.exe 2884 Runtime Explorer.exe 1972 Runtime Explorer.exe 2336 Runtime Explorer.exe 2736 Runtime Explorer.exe 2768 Runtime Explorer.exe 2968 Runtime Explorer.exe 2564 Runtime Explorer.exe 2976 Runtime Explorer.exe 1044 Runtime Explorer.exe 2912 Runtime Explorer.exe -
Loads dropped DLL 51 IoCs
pid Process 2812 Launcher.exe 2812 Launcher.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\LICENCE.dat Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe File created C:\Windows\IMF\LICENCE.zip Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows Services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATTWorm Cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language att.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Secure System Shell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Launcher.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2812 Launcher.exe 2680 powershell.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 2372 Secure System Shell.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe 1916 Windows Services.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2812 Launcher.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 1916 Windows Services.exe Token: SeDebugPrivilege 2372 Secure System Shell.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2128 Runtime Explorer.exe 332 Runtime Explorer.exe 1504 Runtime Explorer.exe 2732 Runtime Explorer.exe 1652 Runtime Explorer.exe 2908 Runtime Explorer.exe 2144 Runtime Explorer.exe 2204 Runtime Explorer.exe 1692 Runtime Explorer.exe 964 Runtime Explorer.exe 1616 Runtime Explorer.exe 3068 Runtime Explorer.exe 564 Runtime Explorer.exe 2628 Runtime Explorer.exe 2884 Runtime Explorer.exe 1972 Runtime Explorer.exe 2336 Runtime Explorer.exe 2736 Runtime Explorer.exe 2768 Runtime Explorer.exe 2968 Runtime Explorer.exe 2564 Runtime Explorer.exe 2976 Runtime Explorer.exe 1044 Runtime Explorer.exe 2912 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2224 wrote to memory of 2812 2224 ATTWorm Cracked.exe 30 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2812 wrote to memory of 2680 2812 Launcher.exe 31 PID 2224 wrote to memory of 2572 2224 ATTWorm Cracked.exe 33 PID 2224 wrote to memory of 2572 2224 ATTWorm Cracked.exe 33 PID 2224 wrote to memory of 2572 2224 ATTWorm Cracked.exe 33 PID 2224 wrote to memory of 2572 2224 ATTWorm Cracked.exe 33 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 2812 wrote to memory of 1916 2812 Launcher.exe 34 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2372 1916 Windows Services.exe 35 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 2128 1916 Windows Services.exe 36 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 332 1916 Windows Services.exe 37 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 1504 1916 Windows Services.exe 38 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 2732 1916 Windows Services.exe 39 PID 1916 wrote to memory of 1652 1916 Windows Services.exe 40 PID 1916 wrote to memory of 1652 1916 Windows Services.exe 40 PID 1916 wrote to memory of 1652 1916 Windows Services.exe 40 PID 1916 wrote to memory of 1652 1916 Windows Services.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\AttWorm\ATTWorm Cracked.exe"C:\Users\Admin\AppData\Local\Temp\AttWorm\ATTWorm Cracked.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\AttWorm\skci\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\AttWorm\skci\Launcher.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:332
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3068
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:564
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AttWorm\skci\att.exe"C:\Users\Admin\AppData\Local\Temp\AttWorm\skci\att.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD503f5e0141f4519f0c5ac26ce0b036a0f
SHA14f7a2a230e7a194a898cc9f2d563ac8777fe99c0
SHA25678a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef
SHA51286a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53