Resubmissions
09/03/2025, 01:58
250309-cdv29swybs 1008/03/2025, 06:55
250308-hp35xatjt9 1008/03/2025, 04:53
250308-fh1ebssky5 10Analysis
-
max time kernel
4s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
09/03/2025, 01:58
Errors
General
-
Target
My-Skidded-malwares-main/Run All.bat
-
Size
45B
-
MD5
1d4de1822af1bb3991e6eb67a12a69b5
-
SHA1
41c9d68bf5ad00072b9e6b0c02e8a71fce2dbd52
-
SHA256
ca791170602f2254493246550438de14c3e7b61b72b8bd4079f70178a1aaa102
-
SHA512
c59dd96701d41b281e24e602aab78bc8db77070365dea78ca2e72bc8a772121dbd110f67410490d8d1bee1b25edbf05d3517c357868f471aa7b8c652cf0ade50
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
remcos
AUGUST CRYPTER TOOLZ GRACE STUB
teamfavour222.ddns.net :6767
odogwuvisual123.duckdns.org:6767
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
-YFLE4M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect PurpleFox Rootkit 3 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 15 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Run All.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\6abdd72e82088f5aab90dc9e02f2d9781cea1b3f1c84b3f16df4810956f68ef2.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\6abdd72e82088f5aab90dc9e02f2d9781cea1b3f1c84b3f16df4810956f68ef2.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Bahhhh.exe"C:\Users\Admin\AppData\Local\Temp\Bahhhh.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Berkelium.exe"C:\Users\Admin\AppData\Local\Temp\Berkelium.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Boron.exe"C:\Users\Admin\AppData\Local\Temp\Boron.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Californium.exe"C:\Users\Admin\AppData\Local\Temp\Californium.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe"C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN CustomMBR /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\CatDaMBR.exe -BypassWarning"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cobalt.exe"C:\Users\Admin\AppData\Local\Temp\Cobalt.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Curium.exe"C:\Users\Admin\AppData\Local\Temp\Curium.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eee.bat" "4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Einsteinium.exe"C:\Users\Admin\AppData\Local\Temp\Einsteinium.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EternalOrange.exe"C:\Users\Admin\AppData\Local\Temp\EternalOrange.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\AnaRAT.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\AnaRAT.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe"C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\62264.exe"C:\Users\Admin\AppData\Local\62264.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\1231234.exe"C:\Users\Admin\AppData\Local\1231234.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe"C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\chat_im_cooked.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\chat_im_cooked.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN CustomMBR /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\chat_im_cooked.exe -BypassWarning"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Cirno.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Cirno.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\DAMK.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\DAMK.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN CustomMBR /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\DAMK.exe -BypassWarning"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Discord Expliot Kit.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Discord Expliot Kit.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe"C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 2325⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fellos RAT-Pack.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fellos RAT-Pack.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAawB2ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHAAcABxACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAWQBvAHUAIABhAGMAYwBpAGQAZQBuAHQAbAB5ACAAbwBwAGUAbgBlAGQAIABhACAAUgBBAFQALQBQAGEAYwBrAC4AIABTAGEAeQAgAGcAbwBvAGQAYgB5AGUAIAB0AG8AIAB5AG8AdQByACAAaQBuAGYAbwAgAGEAbgBkACAAUABDACEAIAA6AEQAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGoAZwByACMAPgA="4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAaQB6ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHQAagBsACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAWQBPAFUAJwAnAFIARQAgAEMATwBPAEsARQBEACAATwBOAEMARQAgAEEARwBBAEkATgAgAEIAWQAgAEYANdhs3DXYKd012CndbwAgAEwATQBBAE8AIQAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBzAHUAZgAjAD4A"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\gado.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\gado.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\KonataMBR.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\KonataMBR.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\llrainbowalexll.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\llrainbowalexll.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaFumoDownload.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaFumoDownload.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaMBR.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\MarisaMBR.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210FACEREVEAL.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210FACEREVEAL.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Marlon2210KeyGen.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Megumin.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Megumin.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\NazrinMBR.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\NazrinMBR.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PanKoza2.0 Discord Token Stealer 2024.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker_x64.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker_x64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Rias.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Rias.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\TouhouHacks.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\TouhouHacks.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Trojan.Aqua.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Trojan.Aqua.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\UtsuhoMBR.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\UtsuhoMBR.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\VXUG.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\VXUG.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3999855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3972 -ip 39721⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa39b2855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa39b4855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Obfuscated Files or Information
1Command Obfuscation
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD5385585748cd6feff767a913bd76c2457
SHA11bedac2bc0da78c4dbaaf3914816d84f5c08f005
SHA2560430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5
SHA51280619ee207d6c5a352d811405c40bcb9043fb2b2759ad40575e03e9e7b89f4ad55f6bc01dfe62a64b42dcd9b3b5bfef10503ce72f4efa0d2e39546f92047a880
-
Filesize
37KB
MD58f00376c7ee9fb1653dc2ae09afa5589
SHA10005d278c062b496628e9c2a27043e87fc05689e
SHA2566d2223ee967236cbc2c35809fce753553cfdb0aac7ba34e7087e19d61eecaa18
SHA5122512a5b67867c7c1cfbc19f7adc7ad56c3a2bf821f0c74341d0e69ee89dc20bbdc9118714d67ada6a846edced58afc6d01b0fe7560f2166e02c9044f85bc00f9
-
Filesize
227KB
MD51a83a244d9e90a4865aac14bc0e27052
SHA1d2b65e7aed7657c9915f90f03d46902087479753
SHA256150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712
SHA512f4b9d26d8a0841f9425abf038f85563ddee65e2404bc508fd23c8023bb565fd7f0ceaeaadde49c4951d3bbbb93f6b64b3cf610464855a2bf2d418477dd4fe03f
-
Filesize
233KB
MD54ef3177a2e94ce3d15ae9490a73a2212
SHA1a34f47568ce7fcea97a002eebeae385efa98790c
SHA25687353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0
SHA512635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502
-
Filesize
198KB
MD5f30e9ff8706f3ec72c82a74ee6328db9
SHA1b526d52d22600b28892f898a717eb25779ef3044
SHA256d22bf8ad4fc9b769ea2944bbdee78277ab29bac7199407baf7c3b489568a9489
SHA512a21220d5f1818c9c5aa55cf8560365888046a090b8892a9d87919b48ac921bd2fdfd6016ace77fa8205fde067c7d45cb01032a47f4325fcac560361d66cc58f6
-
Filesize
1.6MB
MD5e2100d88aca7c0a44ba9bb988ccd3916
SHA1ddaf17adbc769556037bb4fbf4bce7065bf57ef3
SHA25675f846b15fa1b548a0143f35584b25875a03c03a783e9310c8573f3b76957688
SHA5125b7fb077ea9d7d1310db3eb26b6624e3d12fe9f3d55d0a37d57c28197dab7e05449c6611d5b9a02f054d8ad790e12050228c8d7b913bb55e3f2b0da694c67ec5
-
Filesize
608KB
MD5690c1b65a6267d6d0b201ba46089aabc
SHA19eb6859bae82bcf8b9df7cf4fc061cd9155fdc39
SHA256244f3a2fad1afa232909355901f33cca18ea95444c5d142c7aa308170db5294f
SHA512cc540851386a3b98227822b2c952a57caf15db4563f9c246b8be5bca0989aaff70e64191d010738db86598d76dd8ad4e59a50965224db9f623edb64f2f8b3e2a
-
Filesize
110KB
MD50dcc21bdebe05957ca2922be486abe22
SHA18bcbd8a839a58e0050c17221e6a1cc775f07586b
SHA25673304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3
SHA5120752ba22340fd3383132243580cb28a147e67b42bb920af8c0fde491d550556fdfa296e70d94f2ce9798faddd0dad4664e2c2edda8f6604b9ba9e63e8f875e0f
-
Filesize
49KB
MD58cfa6b4acd035a2651291a2a4623b1c7
SHA143571537bf2ce9f8e8089fadcbf876eaf4cf3ae9
SHA2566e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9
SHA512e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685
-
Filesize
568KB
MD54448a3c2ddfdda45009b440faa39a5fe
SHA1b16a26331d6ebe8f4a45b43e8b0251a715139b10
SHA25670e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2
SHA512094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0
-
Filesize
65KB
MD5694efccf0c905305f5c8418499fe335c
SHA11fa42976df8d8b1848ac2d99468da3c17785d285
SHA2567f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b
SHA512294fecfb3abb91a9a61001b26acced7a1cc99abb0a140a8bc352b51794e3750b7579b44543d1afde676c0e75ddc6c80c44eb49b959946654bc5f88e0d2b49fcb
-
Filesize
230KB
MD527095b6e72d783c7ad7114f91b87e640
SHA115ef79e042f4befb60783b1d7931bfd916972096
SHA2560738c33d4cbdef4bd1c216248a0a7a20ee7254e63d526fc113e827938aff2520
SHA5129852bc26220c0ca60921425f7a089c4b5356624be41cf1d0e5b04eb36f47b840e2e1235d115927a6d3d69c6f3e60dfef484c67c59ade9edbf4e407b2c02c02ce
-
Filesize
74KB
MD5c9f5fcf8b057f6f5b0f562fe1181cb18
SHA1a1a4b505e2fc4d92ebacbdc6c783a29f7553bc41
SHA256ad024d92fa10cba15bc1930f6d6792eba33feead5b4b8c4b4881c34409c31e3d
SHA512a3fbbe86632fccdc74c43bc7c0afcb7c33463540f21473099a2176edff870bd47eac98d2dc64f684939a60888db190a4e091cc7d3068ca436da8e62969b17e58
-
Filesize
9KB
MD5b01ee228c4a61a5c06b01160790f9f7c
SHA1e7cc238b6767401f6e3018d3f0acfe6d207450f8
SHA25614e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
SHA512c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
-
Filesize
207KB
MD530f2f3ba2f5053f75fd1af6186db6f7f
SHA1ac9f70dcdf0a4caf57ac8b300b2205090f0850d7
SHA256d350d7c68aa5b939d08fba384d1fbe44b757fcdadecb6534b5239d46bfef1f75
SHA5125c39807596324fd7ba12c326af2e9f9b8666e76980ad1189fc49b71736eae779e461e5da71f9a27e014be8a8bd978dac6e7b3b3ceddbadb85f95682cc46cf7d8
-
Filesize
223KB
MD5306a2acc6e08033fad9b193dcbd4de05
SHA1bccff10f633cac6c0bbda5a54061dd05d8f980de
SHA256512a4972b15235864fc896484128b79d48d0dff076d6356559a0b75cb67067d3
SHA5129d5e2abbd480181156624804d0709b403297261062bb3d3b2bd08f3a3905909109dfbd442268f94f2269ee3b8bf7a3a1f4206c65e2bd291602586f44fd084fbc
-
Filesize
683KB
MD55cdd80274f50bbd149441b4563416341
SHA10436f39868fde8334f7f8398345fa97263a1f38e
SHA2566d842aa210cfd67b6b217b7d5abb88b513e235d3a763ac9eb80733f8bbfd5814
SHA512b6f1e546de2ac25b7fd48763bf19556d1c83f63e68a0886a3dbb9977886693688d35da6f13ee947c661aef67930af1223f898cdf3bf2fe79d989966568c95331
-
Filesize
1.8MB
MD555677d2f4f251b558660652002933369
SHA1804357acd8e75f6a8db9b907a8df882e8588b6bd
SHA256f714fb12a601649f1e0840a75265337c77683ec64a599f0631d2ba512bcee5f5
SHA51212343e2ede7dc8534a4682a007ca67b34c287d4e1f7d3565d31860d72d643ad9923b59953571e95c404a9b2951e6bdd4e6e6584f246852f02f53bd832d0bc119
-
Filesize
193KB
MD562f60979fd6a1b5ac711801d575164bd
SHA108374033a9219287c568774c90e11e74d6862f43
SHA256a165dade3174a456d5af6835359d090cfbde706b941c46177656e06e869409a0
SHA512f855c40c0649d10ede6857f0fee888c724f480bdcbba24c60b5bbb0a86a3ab9fdd1872813ff574993a4d50cdafd7259b29499b4791ec11c6b635157e2b718e8b
-
Filesize
45KB
MD509e2aac9365ada595f8421858745bb27
SHA15a06e5e910c5bff7dcc598207f8c38e998c34a1f
SHA25695497d5ed96e5b3458e1729e6c5015cfab6c5bc44907f2324ac7c6bd014a9ba2
SHA5127294b109b0e0934a1f2f3648b65c55c319027b154f3866e64fbf5480aff352e5424e511d9f68af29bdbccb897ad8e874b55f42be1d745dc56fd5d360c36005e7
-
Filesize
59KB
MD50b18325551f9d0055a9e3aa7921dfc76
SHA13b5076541b73bb6f9b1910dcc339709e360a9a92
SHA256350f39bf3a98520e20f6aed34b4786ee2f6518c979613653b08dcf07f3b5e15e
SHA512b45440ca9863bbb1cf2e1434612b32ed2f4f8d54645a02e4c7dc84297fae2222a40cb18e6e29f0eba5e475846ff02fa60ce35107c63a6f0a07830d89647a285b
-
Filesize
272KB
MD559b1f2c4da85066cc5a73d80cfb9dcd2
SHA1bf005c3de251295d74ec19bf90d03ddcf06b1d88
SHA2569242ae324864a6388d09a076110b3d55cb97056e22b201c4cc8cbcae29f302cf
SHA512951bd4db81e9f0bdbc6a16c9ce3f400f287e9815e097e0a984d407dc8df85fbde150930a18af474f86221a4a8f46413f8c08cf2df0bbd1ad47bb85b0583595fd
-
Filesize
55KB
MD521f63fa6e6db4240fde9121fb4847a7f
SHA1a4c4ac1234960c7c3dbe0bd3133ec5c56deb3dec
SHA2564bab7485b91ec5196a586a75ac7ee7d7cb8d7cdac96f59b8d5a53a1abe09910b
SHA512cbba2dd355b6472284d0a50a2887f5de4b7c5c109eb3ff2f1b79fd6709b66c63ae0bd8146e9b1fcd97cf699144b8340b9a0ee4714aa9b15d248e63d1d4e2b9fb
-
Filesize
210KB
MD54ca15a71a92f90c56b53d9d03da17657
SHA13d610aee0423eea84ad9dc0df7865e1bed982327
SHA256ab532f166e08886166c0ed6426bb6a8998de8273d37ccac5823528a1ba3d8ca1
SHA512e0d9e11b9a0fb84bab21cbe4638ead80319a9b38ed810a59a612ab844331adec32f2499425b0d9269f2eb3714e497ad31c9bdfded1f829533cc77bf2dea6464f
-
Filesize
47KB
MD59dda4db9e90ff039ad5a58785b9d626d
SHA1507730d87b32541886ec1dd77f3459fa7bf1e973
SHA256fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe
SHA5124cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a
-
Filesize
39B
MD56fe443f7af62bf537006c478604a4b75
SHA1d684f203af60129adc01b007d7968b6f873a471b
SHA25610f619357a5d46d9c459f05c7ee1d500cf83b5efef4d36f5ba3522c382b6b479
SHA5123cbdd7f07ddcfcdaa08c4cdc9b344aec38868c54fa4e88fb1baccb404154c18182f7085431b04d210054e67ccb447a7f70ea640a6aa7df4f492023cfce03f9ce
-
Filesize
874KB
MD5a6a1abaf12a28ea8f6553356c3bdcf57
SHA1b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53
SHA256f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76
SHA512e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65
-
Filesize
110KB
MD5742dfe1b39763f8ec1a0b367c8482ea3
SHA1c1e62493d0ea85a3e7b3dc93a39eb5f2493dab01
SHA256bf96d445dba8fe4dfb698cbc77cbf21dee76ae1acdff544f7d3d1257e83b15d2
SHA512635cbc7e3e271973ddc1b987ebcc251f9b4e966041e480a09f22dd1755e057e4ea22e2b0e439addf916e19372170e4113ed70902c1baa6e0f2dadd0cfc27320f
-
Filesize
336KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
616KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
860KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
256KB
-
Filesize
712KB
-
Filesize
56KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
320KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
320KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
880KB
-
Filesize
24KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB