njrat | 4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe
Size

564KB
MD5

c709aa33c0165cebde24123555769a7a
SHA1

ad4813cd0461fbdbc7265dc7880e22978ffc7b54
SHA256

4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b
SHA512

ccd0ffc52ed12a4f2e74a0aef982dbd67b271412102e2373e07f24142560e0a0006d60166b1ba789bbb8745067c2d50e3e822f3355bdff2c52d22444151ab7eb
SSDEEP

12288:6yB0aI78IV40HioBu3yCeOr0rS6KsXr7ieWCU:BB07EyCTr0rFf7aC

Score

10^/10

njrat hacked defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

cpanel.hackcrack.io:2222

Mutex

Windows Explorer

Attributes

reg_key
Windows Explorer
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4824	powershell.exe
2920	powershell.exe
4808	powershell.exe
2908	powershell.exe
4856	powershell.exe
3544	powershell.exe
3408	powershell.exe
4636	powershell.exe
4808	powershell.exe
2908	powershell.exe
4856	powershell.exe
3544	powershell.exe
3408	powershell.exe
4636	powershell.exe
4824	powershell.exe
2920	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
35	4472	Process not Found

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4072	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	version.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 9 IoCs

pid	Process
2624	Setup.exe
2260	Setup.exe
1008	Mullvad.Checker .exe
4116	svchost.exe
4524	svchost.exe
2308	explorer.exe
2724	version.exe
400	explorer.exe
3824	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4460	cmd.exe
264	cmd.exe
3444	cmd.exe
2384	cmd.exe
2596	cmd.exe
1896	cmd.exe
1940	cmd.exe
4172	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3884	MicrosoftEdgeUpdate.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3896	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	svchost.exe
Token: SeDebugPrivilege	4116	svchost.exe
Token: SeDebugPrivilege	2308	explorer.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe
Token: 33	3824	explorer.exe
Token: SeIncBasePriorityPrivilege	3824	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2308	explorer.exe
2308	explorer.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2624	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	89
PID 1832 wrote to memory of 2624	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	89
PID 1832 wrote to memory of 2260	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	90
PID 1832 wrote to memory of 2260	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	90
PID 1832 wrote to memory of 1008	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	91
PID 1832 wrote to memory of 1008	1832	4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe	91
PID 2624 wrote to memory of 4116	2624	Setup.exe	93
PID 2624 wrote to memory of 4116	2624	Setup.exe	93
PID 2260 wrote to memory of 4524	2260	Setup.exe	94
PID 2260 wrote to memory of 4524	2260	Setup.exe	94
PID 4116 wrote to memory of 2308	4116	svchost.exe	99
PID 4116 wrote to memory of 2308	4116	svchost.exe	99
PID 2308 wrote to memory of 3400	2308	explorer.exe	100
PID 2308 wrote to memory of 3400	2308	explorer.exe	100
PID 2724 wrote to memory of 2384	2724	version.exe	106
PID 2724 wrote to memory of 2384	2724	version.exe	106
PID 2724 wrote to memory of 2596	2724	version.exe	108
PID 2724 wrote to memory of 2596	2724	version.exe	108
PID 2724 wrote to memory of 1896	2724	version.exe	109
PID 2724 wrote to memory of 1896	2724	version.exe	109
PID 2724 wrote to memory of 1940	2724	version.exe	112
PID 2724 wrote to memory of 1940	2724	version.exe	112
PID 2724 wrote to memory of 4172	2724	version.exe	114
PID 2724 wrote to memory of 4172	2724	version.exe	114
PID 2724 wrote to memory of 4460	2724	version.exe	116
PID 2724 wrote to memory of 4460	2724	version.exe	116
PID 2724 wrote to memory of 264	2724	version.exe	118
PID 2724 wrote to memory of 264	2724	version.exe	118
PID 2724 wrote to memory of 3444	2724	version.exe	120
PID 2724 wrote to memory of 3444	2724	version.exe	120
PID 2596 wrote to memory of 3408	2596	cmd.exe	122
PID 2596 wrote to memory of 3408	2596	cmd.exe	122
PID 1896 wrote to memory of 3544	1896	cmd.exe	123
PID 1896 wrote to memory of 3544	1896	cmd.exe	123
PID 1940 wrote to memory of 4824	1940	cmd.exe	126
PID 1940 wrote to memory of 4824	1940	cmd.exe	126
PID 264 wrote to memory of 4636	264	cmd.exe	127
PID 264 wrote to memory of 4636	264	cmd.exe	127
PID 2384 wrote to memory of 2920	2384	cmd.exe	128
PID 2384 wrote to memory of 2920	2384	cmd.exe	128
PID 4172 wrote to memory of 4808	4172	cmd.exe	129
PID 4172 wrote to memory of 4808	4172	cmd.exe	129
PID 3444 wrote to memory of 2908	3444	cmd.exe	130
PID 3444 wrote to memory of 2908	3444	cmd.exe	130
PID 4460 wrote to memory of 4856	4460	cmd.exe	131
PID 4460 wrote to memory of 4856	4460	cmd.exe	131
PID 4524 wrote to memory of 400	4524	svchost.exe	133
PID 4524 wrote to memory of 400	4524	svchost.exe	133
PID 2308 wrote to memory of 3824	2308	explorer.exe	137
PID 2308 wrote to memory of 3824	2308	explorer.exe	137
PID 3824 wrote to memory of 4072	3824	explorer.exe	140
PID 3824 wrote to memory of 4072	3824	explorer.exe	140

C:\Users\Admin\AppData\Local\Temp\4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe
"C:\Users\Admin\AppData\Local\Temp\4314ab3773ddf65e9a290d0889bb09d57fb4968ca49522453e5c9b92ef32f40b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2308
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\vdccuqd0.inf
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4072
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Executes dropped EXE
      PID:400
- C:\Users\Admin\AppData\Local\Temp\Mullvad.Checker .exe
  "C:\Users\Admin\AppData\Local\Temp\Mullvad.Checker .exe"
  2⤵
  - Executes dropped EXE
  PID:1008

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjI5QzVEMUEtNEJFMy00QTU2LUE1QkYtNjY1OTBBNkU2RDRBfSIgdXNlcmlkPSJ7MURFMzkyOTAtMDg2NC00MDM2LTg1RTAtRDEwMDQyNDgyNkJFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7N0NGRDk0RjEtNTU3Ri00QzY5LUE3MDEtMTE1MUIxMDE2MDJGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDM5NjQzMzY0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2908

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log

Filesize
408B

MD5
8e1e19a5abcce21f8a12921d6a2eeeee

SHA1
b5704368dfd8fc7aeafb15c23b69895e809fe20e

SHA256
22cf24d10cc11a9bb23268f18afbc8f3481c27e1feb4cb42ba5c8775e12720e3

SHA512
48365f858592d677ef5d0e2948f672234898e47a153eec32592a2e079353702a64e41e1aa59250f05bd690690b9edfb8455dfac90c6695fb7c0b6907a057fe78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\explorer.exe.log

Filesize
676B

MD5
79d206410500f74a6f755f82d514c459

SHA1
67782eff101d316ad1eb79ee76dc4095f5994db3

SHA256
697be2be7b14b3ef2953b93cc2d380b350c19e2ef41399ab289fe1c8e2281f36

SHA512
72848557148090200726fbfa30c008e54067d79e804ef604c78ee4fdc0c77d3da6c60abedb5c05e4943eb768d737873db585619b2559a1b6d1e6b917d216d822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.log

Filesize
588B

MD5
8e9089cad91c0c44ed582752be2e0ba7

SHA1
9f46ad1051543ec908413a8b323fe39d663c82a0

SHA256
d607a7cb2f3bc8a26b58212f8ffa0688610bdb7ed0c455913ca8d39b8f17ca38

SHA512
8a21f2f3d6c229e17c545f5cc09a0614e54a3d84d2bd62b5ba745d942d898e958e09c0216e0f8fffbbc3453f1e47417369be08237a3eeb4e787b7ba40222b8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mullvad.Checker .exe

Filesize
139KB

MD5
ea0d62cc90eea87352e272bea77b97e2

SHA1
429d582e0f294ade34084a4eafe472fb97c31013

SHA256
8a187dd1b587c6d8ef942c4ddc32f1cb14ae0894c0943286cb3f74386d27dc04

SHA512
4de7c405ef263eca0a1e9ad7ba74a04c8ace55935031bb18689ed5a7aa5290c32e30908852ccbb1121b1f3038eaec94f35db82b05e9426ea05c76de0f9ff2068

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
375KB

MD5
8e4f8329f0837d6a3801dd96973a05fe

SHA1
7309226e370a33000c08653504f2ac5786944b2b

SHA256
0d8f6fc81065fc6f20ea5b9de9a85fbfffe2deb1f2055f1b304b5b0f3e99407d

SHA512
9df93293a5fec2a2fca0838f43b24af8347f229884fab4338f7804ef0050b0aba02235ae2368ffef7dd42640420b42f69eaf974f5107bdab0bf0a8c9b39671cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofkntmba.1em.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdccuqd0.inf

Filesize
619B

MD5
6f1420f2133f3e08fd8cdea0e1f5fe27

SHA1
3aa41ec75adc0cf50e001ca91bbfa7f763adf70b

SHA256
aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242

SHA512
d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
355KB

MD5
f41a73cdd753f77e4da0a16b131d67dd

SHA1
d213d85d0d8d39a2775549b2495680a789e981d8

SHA256
dff8e155e78054e4be440619c04f0bd64613ae8dbdd5f8d3ffa3a0f7a9f78ed2

SHA512
58384b24d9e2620295363db801923e7f34d92297ba57d3eed51adb5c195b5dc4eecb37403c9f06ac92e86d27cf853e56fd44c48562bdb69dea6aa78b216c6c42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.zip

Filesize
461KB

MD5
1a51a402b6b5f79648f02dbfd0cc7879

SHA1
cf3d0cecdfe552e82abc25efdd0d706dcf6d2d4c

SHA256
059f64eb1e0b0e6806dbe21c3d542cf89d9b1a91345df2f60c2dcc18ff124de4

SHA512
be834f24b3f60d4f27f5500e28d6d871c438ee9dcc0e5fbe0a9e127d98c554de2d38eecd2f70302af06a1e861a073a8fb9dac0dd87161ac4c19ce6d87855705d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
252KB

MD5
e5d01a5a8cc5c5ca9a5329459814c91a

SHA1
00ec50ab1cdab87816ec0f3e77fa8ad00ea9c067

SHA256
612bbbf476228032ebab743100c98dae7f01a1dc854298cd8ece588351acb3c6

SHA512
2d0d0d964e9100b0586043b16f91532e0f81347ef3697dee7ab0cd90469e6c118ac58e630d9a7fe0a84f5c275440813aeede0e0c44cacf316f59cb760081ab07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

Filesize
84KB

MD5
15ee95bc8e2e65416f2a30cf05ef9c2e

SHA1
107ca99d3414642450dec196febcd787ac8d7596

SHA256
c55b3aaf558c1cd8768f3d22b3fcc908a0e8c33e3f4e1f051d2b1b9315223d4d

SHA512
ed1cceb8894fb02cd585ec799e7c8564536976e50c04bf0c3e246a24a6eef719079455f1d6664fa09181979260db16903c60a0ef938472ca71ccaabe16ea1a98

Download Submit
memory/1832-2-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/1832-3-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/1832-5-0x000000001BFA0000-0x000000001C03C000-memory.dmp

Filesize
624KB

Download
memory/1832-43-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/1832-1-0x00000000016F0000-0x0000000001796000-memory.dmp

Filesize
664KB

Download
memory/1832-4-0x000000001C550000-0x000000001CA1E000-memory.dmp

Filesize
4.8MB

Download
memory/1832-0-0x00007FFB99F75000-0x00007FFB99F76000-memory.dmp

Filesize
4KB

Download
memory/2260-51-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2260-30-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2260-42-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2260-29-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2308-75-0x00000000012C0000-0x00000000012CC000-memory.dmp

Filesize
48KB

Download
memory/2308-72-0x00000000012A0000-0x00000000012A8000-memory.dmp

Filesize
32KB

Download
memory/2624-48-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2624-19-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2624-18-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/2624-17-0x00007FFB99CC0000-0x00007FFB9A661000-memory.dmp

Filesize
9.6MB

Download
memory/4636-86-0x000001229AE70000-0x000001229AE92000-memory.dmp

Filesize
136KB

Download