njrat | e480c8945eb3750a57c2544a72059177b7b8cebdb0814c9e0155165daf83c53f

Analysis

max time kernel
60s
max time network
62s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-01-2025 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aquatic/loader.exe
Size

5.2MB
MD5

c136329a989aad9543c913f9197a01fe
SHA1

0b3bdab50947cf330243938c9ccb3e685c43457b
SHA256

9b802ef1b1e58a521a45dbd45c48c75c5b7f9ac53b273d6d2cf868c1f6d46885
SHA512

fa7a7efa10b4da760b7d281aa235fa4bb4ce28d12796f28632fd653ae184a6f09bc796c18ba1aa3253f713af0334d97f040dc762a8a1d25352dc7308d49b8590
SSDEEP

98304:fKYhdZRJ8os9WXz/DsEAE4SfTQ3+5wJCn9cK4KwrUWxeNVSreDGknLjiSXBI:CYhdo0D/D1J8+mM9Y/gNIsGkLj

Score

10^/10

njrat umbral xworm defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

testarosa.duckdns.org:7110

Mutex

5ZpeoOe6AtQfr6wU

Attributes

Install_directory
%AppData%
install_file
Ondrive.exe

aes.plain

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0011000000027d07-7.dat	family_umbral
behavioral2/memory/4008-28-0x000001D4E55F0000-0x000001D4E5630000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000027dd9-65.dat	family_xworm
behavioral2/memory/3280-79-0x0000000000EB0000-0x0000000000EC0000-memory.dmp	family_xworm

Njrat family
njrat
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1104	powershell.exe
4224	powershell.exe
1828	powershell.exe
4532	powershell.exe
1156	powershell.exe
4168	powershell.exe
3896	powershell.exe
3852	powershell.exe
680	powershell.exe
1520	powershell.exe
3616	powershell.exe
1180	powershell.exe
2440	powershell.exe
3668	powershell.exe
1360	powershell.exe
4808	powershell.exe
1168	powershell.exe
3820	powershell.exe
880	powershell.exe
3372	powershell.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Aquatic.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Aquatic.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Aquatic.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Aquatic.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3476	netsh.exe

Checks computer location settings 2 TTPs 29 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\Control Panel\International\Geo\Nation	loader.exe

Executes dropped EXE 64 IoCs

pid	Process
4008	Aquatic.exe
1196	Server.exe
1776	loader.exe
1824	Server.exe
3280	conhost.exe
4520	Aquatic.exe
4076	Server.exe
3768	loader.exe
4800	Server.exe
1772	conhost.exe
2736	Aquatic.exe
3940	Server.exe
4780	loader.exe
4696	Server.exe
1076	conhost.exe
4604	server.exe
3380	Aquatic.exe
2216	Server.exe
1180	loader.exe
1988	Aquatic.exe
4864	Server.exe
2016	loader.exe
1304	Aquatic.exe
2404	Server.exe
2812	loader.exe
4076	Aquatic.exe
1744	Server.exe
1784	loader.exe
1736	Aquatic.exe
1196	Server.exe
4448	loader.exe
3684	Aquatic.exe
2644	Server.exe
3864	loader.exe
3432	Aquatic.exe
2308	Server.exe
4516	loader.exe
3600	Aquatic.exe
4400	Server.exe
3888	loader.exe
228	Aquatic.exe
1836	Server.exe
252	loader.exe
4320	Aquatic.exe
680	Server.exe
1072	loader.exe
5092	Aquatic.exe
5016	Server.exe
4864	loader.exe
4680	Aquatic.exe
2700	Server.exe
1520	loader.exe
1960	Aquatic.exe
3764	Server.exe
3420	loader.exe
2148	Aquatic.exe
1736	Server.exe
3208	loader.exe
1640	Aquatic.exe
4956	Server.exe
3504	loader.exe
4816	Ondrive.exe
4448	Aquatic.exe
1744	Server.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6a8a3b6e5450a823d542e748a454aa4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6a8a3b6e5450a823d542e748a454aa4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
32	discord.com
58	discord.com
59	discord.com
9	discord.com
10	discord.com
18	discord.com
20	discord.com
31	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ip-api.com
4	ip-api.com
14	ip-api.com
26	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2520	PING.EXE
4188	cmd.exe
2516	PING.EXE
1584	cmd.exe
4952	PING.EXE
4536	cmd.exe

Detects videocard installed 1 TTPs 4 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2616	wmic.exe
632	wmic.exe
4092	wmic.exe
460	wmic.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2520	PING.EXE
2516	PING.EXE
4952	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2936	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3280	conhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2348	wmic.exe
2348	wmic.exe
2348	wmic.exe
2348	wmic.exe
4008	Aquatic.exe
4168	powershell.exe
4168	powershell.exe
1520	powershell.exe
1520	powershell.exe
3616	powershell.exe
3616	powershell.exe
3896	powershell.exe
3896	powershell.exe
4256	powershell.exe
4256	powershell.exe
3852	powershell.exe
3852	powershell.exe
1748	wmic.exe
1748	wmic.exe
1748	wmic.exe
1748	wmic.exe
1104	powershell.exe
1104	powershell.exe
3044	wmic.exe
3044	wmic.exe
3044	wmic.exe
3044	wmic.exe
1948	wmic.exe
1948	wmic.exe
1948	wmic.exe
1948	wmic.exe
1168	powershell.exe
1168	powershell.exe
4224	powershell.exe
4224	powershell.exe
2616	wmic.exe
2616	wmic.exe
2616	wmic.exe
2616	wmic.exe
972	wmic.exe
972	wmic.exe
972	wmic.exe
972	wmic.exe
1988	Aquatic.exe
1828	powershell.exe
1828	powershell.exe
3820	powershell.exe
3820	powershell.exe
880	powershell.exe
880	powershell.exe
3348	powershell.exe
3348	powershell.exe
4420	wmic.exe
4420	wmic.exe
4420	wmic.exe
4420	wmic.exe
4976	wmic.exe
4976	wmic.exe
4976	wmic.exe
4976	wmic.exe
1416	wmic.exe
1416	wmic.exe
1416	wmic.exe
1416	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	Aquatic.exe
Token: SeDebugPrivilege	3280	conhost.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeIncreaseQuotaPrivilege	4168	powershell.exe
Token: SeSecurityPrivilege	4168	powershell.exe
Token: SeTakeOwnershipPrivilege	4168	powershell.exe
Token: SeLoadDriverPrivilege	4168	powershell.exe
Token: SeSystemProfilePrivilege	4168	powershell.exe
Token: SeSystemtimePrivilege	4168	powershell.exe
Token: SeProfSingleProcessPrivilege	4168	powershell.exe
Token: SeIncBasePriorityPrivilege	4168	powershell.exe
Token: SeCreatePagefilePrivilege	4168	powershell.exe
Token: SeBackupPrivilege	4168	powershell.exe
Token: SeRestorePrivilege	4168	powershell.exe
Token: SeShutdownPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeSystemEnvironmentPrivilege	4168	powershell.exe
Token: SeRemoteShutdownPrivilege	4168	powershell.exe
Token: SeUndockPrivilege	4168	powershell.exe
Token: SeManageVolumePrivilege	4168	powershell.exe
Token: 33	4168	powershell.exe
Token: 34	4168	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4008	3432	loader.exe	83
PID 3432 wrote to memory of 4008	3432	loader.exe	83
PID 3432 wrote to memory of 1196	3432	loader.exe	84
PID 3432 wrote to memory of 1196	3432	loader.exe	84
PID 3432 wrote to memory of 1776	3432	loader.exe	85
PID 3432 wrote to memory of 1776	3432	loader.exe	85
PID 1196 wrote to memory of 1824	1196	Server.exe	86
PID 1196 wrote to memory of 1824	1196	Server.exe	86
PID 1196 wrote to memory of 1824	1196	Server.exe	86
PID 1196 wrote to memory of 3280	1196	Server.exe	87
PID 1196 wrote to memory of 3280	1196	Server.exe	87
PID 4008 wrote to memory of 2348	4008	Aquatic.exe	88
PID 4008 wrote to memory of 2348	4008	Aquatic.exe	88
PID 4008 wrote to memory of 4764	4008	Aquatic.exe	91
PID 4008 wrote to memory of 4764	4008	Aquatic.exe	91
PID 4008 wrote to memory of 4168	4008	Aquatic.exe	93
PID 4008 wrote to memory of 4168	4008	Aquatic.exe	93
PID 1776 wrote to memory of 4520	1776	loader.exe	95
PID 1776 wrote to memory of 4520	1776	loader.exe	95
PID 1776 wrote to memory of 4076	1776	loader.exe	96
PID 1776 wrote to memory of 4076	1776	loader.exe	96
PID 1776 wrote to memory of 3768	1776	loader.exe	97
PID 1776 wrote to memory of 3768	1776	loader.exe	97
PID 4076 wrote to memory of 4800	4076	Server.exe	98
PID 4076 wrote to memory of 4800	4076	Server.exe	98
PID 4076 wrote to memory of 4800	4076	Server.exe	98
PID 4076 wrote to memory of 1772	4076	Server.exe	100
PID 4076 wrote to memory of 1772	4076	Server.exe	100
PID 4008 wrote to memory of 1520	4008	Aquatic.exe	101
PID 4008 wrote to memory of 1520	4008	Aquatic.exe	101
PID 4008 wrote to memory of 3616	4008	Aquatic.exe	103
PID 4008 wrote to memory of 3616	4008	Aquatic.exe	103
PID 3280 wrote to memory of 3896	3280	conhost.exe	105
PID 3280 wrote to memory of 3896	3280	conhost.exe	105
PID 4008 wrote to memory of 4256	4008	Aquatic.exe	107
PID 4008 wrote to memory of 4256	4008	Aquatic.exe	107
PID 3280 wrote to memory of 3852	3280	conhost.exe	109
PID 3280 wrote to memory of 3852	3280	conhost.exe	109
PID 4008 wrote to memory of 1748	4008	Aquatic.exe	111
PID 4008 wrote to memory of 1748	4008	Aquatic.exe	111
PID 3280 wrote to memory of 1104	3280	conhost.exe	113
PID 3280 wrote to memory of 1104	3280	conhost.exe	113
PID 4008 wrote to memory of 3044	4008	Aquatic.exe	115
PID 4008 wrote to memory of 3044	4008	Aquatic.exe	115
PID 4008 wrote to memory of 1948	4008	Aquatic.exe	117
PID 4008 wrote to memory of 1948	4008	Aquatic.exe	117
PID 3768 wrote to memory of 2736	3768	loader.exe	119
PID 3768 wrote to memory of 2736	3768	loader.exe	119
PID 3768 wrote to memory of 3940	3768	loader.exe	120
PID 3768 wrote to memory of 3940	3768	loader.exe	120
PID 3768 wrote to memory of 4780	3768	loader.exe	121
PID 3768 wrote to memory of 4780	3768	loader.exe	121
PID 3940 wrote to memory of 4696	3940	Server.exe	122
PID 3940 wrote to memory of 4696	3940	Server.exe	122
PID 3940 wrote to memory of 4696	3940	Server.exe	122
PID 4008 wrote to memory of 1168	4008	Aquatic.exe	123
PID 4008 wrote to memory of 1168	4008	Aquatic.exe	123
PID 3940 wrote to memory of 1076	3940	Server.exe	124
PID 3940 wrote to memory of 1076	3940	Server.exe	124
PID 3280 wrote to memory of 4224	3280	conhost.exe	126
PID 3280 wrote to memory of 4224	3280	conhost.exe	126
PID 4008 wrote to memory of 2616	4008	Aquatic.exe	128
PID 4008 wrote to memory of 2616	4008	Aquatic.exe	128
PID 3280 wrote to memory of 2936	3280	conhost.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4764	attrib.exe
1012	attrib.exe
1812	attrib.exe
3380	attrib.exe

C:\Users\Admin\AppData\Local\Temp\aquatic\loader.exe
"C:\Users\Admin\AppData\Local\Temp\aquatic\loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
  "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
    3⤵
    - Views/modifies file attributes
    PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Aquatic.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1748
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3044
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1168
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:2616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4536
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2520
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Roaming\Server.exe
    "C:\Users\Admin\AppData\Roaming\Server.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4604
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3476
- - C:\Users\Admin\AppData\Roaming\conhost.exe
    "C:\Users\Admin\AppData\Roaming\conhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Ondrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ondrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4224
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Ondrive" /tr "C:\Users\Admin\AppData\Roaming\Ondrive.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2936
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
    "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
    3⤵
    - Executes dropped EXE
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Users\Admin\AppData\Roaming\Server.exe
      "C:\Users\Admin\AppData\Roaming\Server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4800
  - - C:\Users\Admin\AppData\Roaming\conhost.exe
      "C:\Users\Admin\AppData\Roaming\conhost.exe"
      4⤵
      Executes dropped EXE
      PID:1772
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
      "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
      4⤵
      Executes dropped EXE
      PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Users\Admin\AppData\Roaming\Server.exe
        
        "C:\Users\Admin\AppData\Roaming\Server.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Roaming\conhost.exe
        
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\loader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        5⤵
        Executes dropped EXE
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:972
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Aquatic.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3348
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4420
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4976
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1180
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:632
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe" && pause
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4188
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        7⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        8⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        9⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        10⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:4440
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        11⤵
        Views/modifies file attributes
        
        PID:1812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Aquatic.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        11⤵
        
        PID:4388
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        11⤵
        
        PID:4224
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        11⤵
        
        PID:4732
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        11⤵
        
        PID:3120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3668
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        11⤵
        Detects videocard installed
        
        PID:4092
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe" && pause
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1584
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        11⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        12⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        13⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        14⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        15⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        16⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        17⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        18⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        19⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        20⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        20⤵
        Checks computer location settings
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        21⤵
        Drops file in Drivers directory
        
        PID:3384
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        22⤵
        
        PID:3092
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        22⤵
        Views/modifies file attributes
        
        PID:3380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Aquatic.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        22⤵
        
        PID:4240
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        22⤵
        
        PID:2356
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        22⤵
        
        PID:3612
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        22⤵
        
        PID:4084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4808
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        22⤵
        Detects videocard installed
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        21⤵
        Checks computer location settings
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        22⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        22⤵
        Checks computer location settings
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        23⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        23⤵
        Checks computer location settings
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        24⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        24⤵
        Checks computer location settings
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Aquatic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aquatic.exe"
        25⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        25⤵
        
        PID:4524

C:\Users\Admin\AppData\Roaming\Ondrive.exe
"C:\Users\Admin\AppData\Roaming\Ondrive.exe"
1⤵
- Executes dropped EXE
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log

Filesize
319B

MD5
c03c52b5629516eb3271791af4a68fda

SHA1
21e3c5aa9d016632d558439b36749c14a54438a3

SHA256
52561d8d593a3fc07353a74c4e59650770e998ae08c1b168ba31f0456ba5d2b1

SHA512
186c267ae7079f9b0c9852daec79aea8ff4746309f2dd9ec3dbc50ebb0146bea2e566621a01fe6f4580f187850271b854bd8e5f20bb2715970386ac85326f0cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Aquatic.exe.log

Filesize
1KB

MD5
dcbdf62e96e679168e99bb26c3f28d37

SHA1
b4dd47ce9094a450cd6e03a2f1d61ea4c8b85208

SHA256
c44d43f12dedac8a011cf40417f28b4d7e0d961ac4503829f01891ce7212fa35

SHA512
679b07b35c90abdb029a202bb14c424d2497d1b8e99396d369629a066a3978e77c6257148a22c48abcbcb6370c722673d0cbb3d1fd33880fa32107d5a20869b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log

Filesize
654B

MD5
11c6e74f0561678d2cf7fc075a6cc00c

SHA1
535ee79ba978554abcb98c566235805e7ea18490

SHA256
d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

SHA512
32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
60b3262c3163ee3d466199160b9ed07d

SHA1
994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

SHA256
e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

SHA512
081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
a9ab4419e3986b8e240c9478cc52eb51

SHA1
7e1b1b31bc47b9d4dccea76e6511d3632cb0395e

SHA256
87c993fd034df762cdf24506c046959e98985d38697b234f7ca092db49671846

SHA512
8f3d3ac39795b11719f40d3eb9a574576c8a5e6b837a1f3d63f7996faaf728e02ec5e26f4bed71ab850c9fa9272ec94fb6449b251eadc82672f84bdd5ec256a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8e1fdd1b66d2fee9f6a052524d4ddca5

SHA1
0a9d0994559d1be2eecd8b0d6960540ca627bdb6

SHA256
4cc7c1b79d1b48582d4dc27ca8c31457b9bf2441deb7914399bb9e6863f18b13

SHA512
5a5494b878b08e8515811ab7a3d68780dac7423f5562477d98249a8bedf7ec98567b7cd5d4c6967d6bc63f2d6d9b7da9a65e0eb29d4b955026b469b5b598d1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
240B

MD5
62c677d1b01376f5a983a8cadc098583

SHA1
7d12949782b65732c663b69890ca3559e210d1e7

SHA256
e1d4fbe4b5e1c21e2093d41ad8e46d9f8106bce044387ef611c3341edc914921

SHA512
c964c81ed47e1fc634e0eb53fc14af9256baec9a17cea68728b2553cb6d3c8cb20f403b5282fbb0575a5fba620d84afa996ef612f69ebf96da87d6baf2c4b710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8275d2c2245e8de8c281ba2a9d2d9b69

SHA1
5c88d14d3b25a7a6e2d0fd12fa44db5f59ddacbe

SHA256
9f8d1a40b5373201843032d3c85f4dde4a20110323a62b91c4a843cee52b2370

SHA512
8c4907649932b2c698e5e97bcd26cef1080cbab2bfb5a06d4bd230de2cd7e701e3966b1c8c8d8be3f39ee570feafce5daf0a3c7014abb1e77e4141664639f4ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
75ae08a4a068b23ce626d07e9f3788aa

SHA1
a32274e443918e1a3c70cc2d60fab562be0a8fe8

SHA256
d43e73ad55648e865173cf4552cf1f812d299c5d58f8cdc83a2f10365633840d

SHA512
0597f93a8ed7e7fbabdb0d088723a0b8d4e6277c65e3d732bd593930dfb8d454cbba7a483f1173fe63ec3f548ece1825e312876a5ec4569d54b0bef12f2196d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6beb9db6d7549b07271688e9772067dc

SHA1
410b3c6ffa33c17697a005ae2ca02abb92c2e8ac

SHA256
6b830d4238dcf55ab6d900a1422bc43c1fea43e8b0f4746b3a18d978cefd9142

SHA512
ab84281af54d1d217fe9feb8d18b9b2b1893437ab84c160a93a9edffe0e4b95e67a5a6412cedb938c463d9e8ad45ea8582fe91c0ed42a5946ae3e0a1857add1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c76456f917f2454b11094307cddf538e

SHA1
8b71666f6377822817af0e471223561d6b3c307e

SHA256
658bb703eca2dad2e2b2473799bdda84625e4089aec8d03f287bc049fa10eb7d

SHA512
ef516fc2599af34ec1d495a5fd05529fb8f3456bf361d3229b86ab3220c7a839b937d460c0c12884932965f87ce1af148a4e1a67a60b2420aa9fcae0f5fd7ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fbb72f45b0688bd1988ee5448e79936b

SHA1
3db7dac3f7ebd5299d828d19e5afa4f9cd691ff4

SHA256
b03a2f8a2dc39c65d2286135151ad3bc79c1bd8b1e1ee14548d679da83370419

SHA512
d2f16b55532159e148e2428b04c9b325f8023c75a6188a068963c91648e6619268f39f6d209d3918e2fde80e344fa9ff39bb0cd327417f1e7e54a81ad0eae84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
f399941d756e9826f3a5aa6aec2b7885

SHA1
323c93f09c6608541ec2923ce0396bd4e72e1bda

SHA256
18539741dcc043451ddf1627ce2819385200fbec3d9f827ea928f9757e5f5811

SHA512
d47ea930bf088d349278db5ce1c3c8d72ee0eca4e935b54815ac0dc54fd956bec7520f242845f8605df4dcc8d7ee679fcbdc58d0a3c2fa8191487016ca7f570f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
beaa733206e6159a16f84258a3868738

SHA1
5d973073d1fb8bf3b4654ad9172b1519c5ee3ce7

SHA256
d5387e07c332114cd393c847f7e0fe5108ec208798391a756fc1298daab786dd

SHA512
0fa50d16101a53ff2c43c62e370462feeae1283b6c33167d1ca9e293d2373f00e16f289f07caabe5789aa633c3a622bca4d3e499fd6af38001a3dbcee454b73f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
b68ab4ca7e39baffff644d4820c98f0c

SHA1
25aee3c71f29c4520c9a89a13ce47864b75ced4e

SHA256
974a01642047984dcc7429b685decc35b22bfb88926f25174f77721f4afaf676

SHA512
5c96c46ba870ced22f9956ecec737fe2a6d4d73a52a1db323b29a82324f3fbd298ecb0a79ce55828bcb9e813b64815bae137d480f26e9d69f6cf7830dfd4ab9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
df55b2040cf60bbaaed4946ec47d9ec3

SHA1
8e85ce63481c7ef33b9414c2e84a3a63677e5cc1

SHA256
fa9cc5dac95adda87c5e09a8daed9701de298b9706a9b4473c459ca1208332c6

SHA512
9f707130fbef0665d929f63cfa6e34331df46a059059d8dfcd144eb02669d85bd5d38f015ff53453338beeed9cff8804cb09d6fe1c2d2cb735f5e94a585929f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aquatic.exe

Filesize
229KB

MD5
56c788116da32ec8e9ac3b1b0e66b520

SHA1
545f203f2bdf6fac2f131a76a5f36e21637b27ca

SHA256
f67268d2659ceb1e8cf8a7560784372294bcd8f249f7c0efdf33216722a5f0bb

SHA512
7da85b8e5f92f4a448a10f5c60c21f46b3eb511fda461b15956339ca7130c901e05ad58856a3a3903cdb52b81c4051d3bb0222e87aefab87136351d1ff01734f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
71KB

MD5
f9b08bd21b40a938122b479095b7c70c

SHA1
eb925e3927b83c20d8d24bdab2e587c10d6ac8cd

SHA256
c96cde2e96021c266a202286d644ceb28543d6347e21006d72b29b8a72c505e8

SHA512
fcc5784936b7f85a550883c472b99b5edfa7e5c6fd3872fd806b81c2ce1f195ca34342b230a89456066885579fe55aea46d91074ac08af192fbd04ea158473ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p3c5e4vs.quu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
5.1MB

MD5
24b1beaf827ed5732cc435c76170afb0

SHA1
dbab0b15b40f22765af4219d6db16579396b0ae7

SHA256
5365a7256f9b85da3eb0aaaf1ddf50ee2928c0d3b23b89a21a9400b6502ad4f2

SHA512
00cf09d9066d654776d835597cfa228b7b33a4a083e8564c172d3ac78bf249feb87187e88de22be4720484d60a34dfbfd4f47bff404960627bde4837d896e4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\qmo1BZDk3EVgsm6\Display\Display.png

Filesize
414KB

MD5
90e223bf18b03806310ece78fa3d0f7a

SHA1
2e826b6144240fd6474e20b4f5546fccaa8c20c2

SHA256
be0acb1b44409370cecb19d243b1a420484fc195fe30b58fbe896357ee3b8dc1

SHA512
f6310f0bcd27ecfcfd86714c8b3b8cb26160cd214ec6a80457985aec7628d7cddb1bf2b4958dce72c588489ec010f56bd818c0a754e5f0fd02999dfb5cc216cd

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
23KB

MD5
32fe01ccb93b0233503d0aaaa451f7b2

SHA1
58e5a63142150e8fb175dbb4dedea2ce405d7db0

SHA256
6988ee719a54c93a89303dcff277c62ae4890274cc45f074bc7effde315fbf43

SHA512
76945f23a49d594e325d80ffc0570341044ac0b97bd889c92f90bc56d3cdff5c1b29178be4f157c8c1bb9ce7cc311765309f2e6f7b08b24e7acf983ea67635a6

Download Submit
C:\Users\Admin\AppData\Roaming\conhost.exe

Filesize
37KB

MD5
b37dd1a1f0507baf993471ae1b7a314c

SHA1
9aff9d71492ffff8d51f8e8d67f5770755899882

SHA256
e58e8918a443c0061add029f8f211f6551a130202195cc2b9b529ea72553e0bc

SHA512
ac76d5b10540eb292341f30c7abfd81f03be65f6655c814aba6ac6a0ecf4f0f2c34c3b8e63ceef8c4579f98b7459e51b9fdd30d601c6d1930860ab7c154da460

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1196-39-0x0000000000F40000-0x0000000000F58000-memory.dmp

Filesize
96KB

Download
memory/1196-78-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/1196-48-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/1776-76-0x0000000000D80000-0x0000000001294000-memory.dmp

Filesize
5.1MB

Download
memory/3280-79-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

Filesize
64KB

Download
memory/3432-52-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/3432-0-0x00007FFF5DC73000-0x00007FFF5DC75000-memory.dmp

Filesize
8KB

Download
memory/3432-1-0x0000000000170000-0x00000000006AE000-memory.dmp

Filesize
5.2MB

Download
memory/3432-3-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/4008-126-0x000001D4FFCF0000-0x000001D4FFD66000-memory.dmp

Filesize
472KB

Download
memory/4008-249-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/4008-253-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/4008-164-0x000001D4FFCD0000-0x000001D4FFCE2000-memory.dmp

Filesize
72KB

Download
memory/4008-127-0x000001D4FFD70000-0x000001D4FFDC0000-memory.dmp

Filesize
320KB

Download
memory/4008-38-0x00007FFF5DC70000-0x00007FFF5E732000-memory.dmp

Filesize
10.8MB

Download
memory/4008-28-0x000001D4E55F0000-0x000001D4E5630000-memory.dmp

Filesize
256KB

Download
memory/4008-128-0x000001D4FFC90000-0x000001D4FFCAE000-memory.dmp

Filesize
120KB

Download
memory/4008-163-0x000001D4FFC80000-0x000001D4FFC8A000-memory.dmp

Filesize
40KB

Download
memory/4168-90-0x000001D978580000-0x000001D9785A2000-memory.dmp

Filesize
136KB

Download