dcrat | 5269e48c323090f07365fbcfb4430419b7f0f41ab5d34021aac32921997deed3

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kdmapper.7z
Size

3.5MB
MD5

126845468658d736498b172bda22510a
SHA1

9281027cc8af123f08a58daa5f890c02f9afca02
SHA256

5269e48c323090f07365fbcfb4430419b7f0f41ab5d34021aac32921997deed3
SHA512

e2e4b158bad87d87f4a0c53d266b28a10a27a3f93091c5c6319b7f5e33c9ab458991295f2e5347cde7e316dc4f9f52f00b0690fe71f1f6b0e67c190732bbdc82
SSDEEP

98304:xDe9XhNbK/nDwAnVNC0kgjuc0dipgDcKe/noSc0WIMUz8:x8NO/MWNCsScxpggKe/nkJV

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\60739cf6f660743813\\WmiPrvSE.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\60739cf6f660743813\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Media Player\\backgroundTaskHost.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\", \"C:\\60739cf6f660743813\\sysmon.exe\", \"C:\\60739cf6f660743813\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Media Player\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\main\\msdriverruntime.exe\""	msdriverruntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5924	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5524	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6040	4892	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4892	schtasks.exe	93

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x00070000000242a7-91.dat	family_dcrat_v2
behavioral2/memory/2380-94-0x0000000000C20000-0x0000000000CEA000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5600	powershell.exe
5384	powershell.exe
3284	powershell.exe
4244	powershell.exe
1400	powershell.exe
4964	powershell.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	msdriverruntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	main_2024-08-02_17-05-17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	kdmapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	kdmapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	kdmapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	kdmapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe

Executes dropped EXE 30 IoCs

pid	Process
4820	kdmapper.exe
1176	main_2024-08-02_17-05-17.exe
3324	kdmapper.exe
5364	7z.exe
5672	7z.exe
1504	7z.exe
1432	7z.exe
1632	7z.exe
2508	7z.exe
1556	7z.exe
2380	msdriverruntime.exe
2200	backgroundTaskHost.exe
3188	kdmapper.exe
3800	kdmapper.exe
4472	backgroundTaskHost.exe
1800	kdmapper.exe
3812	kdmapper.exe
5440	backgroundTaskHost.exe
4820	backgroundTaskHost.exe
5956	backgroundTaskHost.exe
6088	kdmapper.exe
5100	kdmapper.exe
536	backgroundTaskHost.exe
4780	backgroundTaskHost.exe
2788	backgroundTaskHost.exe
3992	backgroundTaskHost.exe
4380	backgroundTaskHost.exe
228	backgroundTaskHost.exe
2420	backgroundTaskHost.exe
396	backgroundTaskHost.exe

Loads dropped DLL 7 IoCs

pid	Process
5364	7z.exe
5672	7z.exe
1504	7z.exe
1432	7z.exe
1632	7z.exe
2508	7z.exe
1556	7z.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\60739cf6f660743813\\sysmon.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\60739cf6f660743813\\WmiPrvSE.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\60739cf6f660743813\\WmiPrvSE.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\backgroundTaskHost.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdriverruntime = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\main\\msdriverruntime.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\60739cf6f660743813\\sysmon.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\backgroundTaskHost.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdriverruntime = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\main\\msdriverruntime.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	msdriverruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Users\\All Users\\SoftwareDistribution\\TrustedInstaller.exe\""	msdriverruntime.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ipinfo.io
37	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC707DF8481C5147D69929A3BB9E41570.TMP	csc.exe
File created	\??\c:\Windows\System32\btjsu_.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\eddb19405b7ce1	msdriverruntime.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC42D6C5BA5EE94875A854B82718E1A0.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files\Windows Media Player\backgroundTaskHost.exe	msdriverruntime.exe
File opened for modification	C:\Program Files\Windows Media Player\backgroundTaskHost.exe	msdriverruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kdmapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main_2024-08-02_17-05-17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kdmapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kdmapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kdmapper.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1744	PING.EXE
4396	PING.EXE
1796	PING.EXE
2424	PING.EXE
1956	PING.EXE
1644	PING.EXE
5256	PING.EXE
4620	PING.EXE
1164	PING.EXE
5928	PING.EXE
3656	PING.EXE

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	msdriverruntime.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	backgroundTaskHost.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
1744	PING.EXE
1644	PING.EXE
4396	PING.EXE
1796	PING.EXE
5928	PING.EXE
2424	PING.EXE
5256	PING.EXE
4620	PING.EXE
1164	PING.EXE
3656	PING.EXE
1956	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1668	schtasks.exe
1744	schtasks.exe
4048	schtasks.exe
3936	schtasks.exe
3136	schtasks.exe
1784	schtasks.exe
5924	schtasks.exe
2200	schtasks.exe
4592	schtasks.exe
4628	schtasks.exe
1052	schtasks.exe
6040	schtasks.exe
1868	schtasks.exe
5524	schtasks.exe
5908	schtasks.exe
1928	schtasks.exe
2576	schtasks.exe
5928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe
2380	msdriverruntime.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4244	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4244	7zFM.exe
Token: 35	4244	7zFM.exe
Token: SeSecurityPrivilege	4244	7zFM.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe
Token: 36	2896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe
Token: 36	2896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1436	WMIC.exe
Token: SeSecurityPrivilege	1436	WMIC.exe
Token: SeTakeOwnershipPrivilege	1436	WMIC.exe
Token: SeLoadDriverPrivilege	1436	WMIC.exe
Token: SeSystemProfilePrivilege	1436	WMIC.exe
Token: SeSystemtimePrivilege	1436	WMIC.exe
Token: SeProfSingleProcessPrivilege	1436	WMIC.exe
Token: SeIncBasePriorityPrivilege	1436	WMIC.exe
Token: SeCreatePagefilePrivilege	1436	WMIC.exe
Token: SeBackupPrivilege	1436	WMIC.exe
Token: SeRestorePrivilege	1436	WMIC.exe
Token: SeShutdownPrivilege	1436	WMIC.exe
Token: SeDebugPrivilege	1436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1436	WMIC.exe
Token: SeRemoteShutdownPrivilege	1436	WMIC.exe
Token: SeUndockPrivilege	1436	WMIC.exe
Token: SeManageVolumePrivilege	1436	WMIC.exe
Token: 33	1436	WMIC.exe
Token: 34	1436	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4244	7zFM.exe
4244	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4900	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4820	2412	cmd.exe	102
PID 2412 wrote to memory of 4820	2412	cmd.exe	102
PID 2412 wrote to memory of 4820	2412	cmd.exe	102
PID 4820 wrote to memory of 1176	4820	kdmapper.exe	103
PID 4820 wrote to memory of 1176	4820	kdmapper.exe	103
PID 4820 wrote to memory of 1176	4820	kdmapper.exe	103
PID 4820 wrote to memory of 3324	4820	kdmapper.exe	104
PID 4820 wrote to memory of 3324	4820	kdmapper.exe	104
PID 2412 wrote to memory of 2896	2412	cmd.exe	106
PID 2412 wrote to memory of 2896	2412	cmd.exe	106
PID 2412 wrote to memory of 1436	2412	cmd.exe	107
PID 2412 wrote to memory of 1436	2412	cmd.exe	107
PID 2412 wrote to memory of 3316	2412	cmd.exe	108
PID 2412 wrote to memory of 3316	2412	cmd.exe	108
PID 2412 wrote to memory of 4272	2412	cmd.exe	109
PID 2412 wrote to memory of 4272	2412	cmd.exe	109
PID 2412 wrote to memory of 1480	2412	cmd.exe	111
PID 2412 wrote to memory of 1480	2412	cmd.exe	111
PID 1176 wrote to memory of 6080	1176	main_2024-08-02_17-05-17.exe	112
PID 1176 wrote to memory of 6080	1176	main_2024-08-02_17-05-17.exe	112
PID 2412 wrote to memory of 4948	2412	cmd.exe	114
PID 2412 wrote to memory of 4948	2412	cmd.exe	114
PID 6080 wrote to memory of 4420	6080	cmd.exe	115
PID 6080 wrote to memory of 4420	6080	cmd.exe	115
PID 6080 wrote to memory of 5364	6080	cmd.exe	116
PID 6080 wrote to memory of 5364	6080	cmd.exe	116
PID 6080 wrote to memory of 5672	6080	cmd.exe	117
PID 6080 wrote to memory of 5672	6080	cmd.exe	117
PID 6080 wrote to memory of 1504	6080	cmd.exe	118
PID 6080 wrote to memory of 1504	6080	cmd.exe	118
PID 6080 wrote to memory of 1432	6080	cmd.exe	119
PID 6080 wrote to memory of 1432	6080	cmd.exe	119
PID 6080 wrote to memory of 1632	6080	cmd.exe	120
PID 6080 wrote to memory of 1632	6080	cmd.exe	120
PID 6080 wrote to memory of 2508	6080	cmd.exe	121
PID 6080 wrote to memory of 2508	6080	cmd.exe	121
PID 6080 wrote to memory of 1556	6080	cmd.exe	122
PID 6080 wrote to memory of 1556	6080	cmd.exe	122
PID 6080 wrote to memory of 5324	6080	cmd.exe	123
PID 6080 wrote to memory of 5324	6080	cmd.exe	123
PID 6080 wrote to memory of 2380	6080	cmd.exe	124
PID 6080 wrote to memory of 2380	6080	cmd.exe	124
PID 2380 wrote to memory of 908	2380	msdriverruntime.exe	128
PID 2380 wrote to memory of 908	2380	msdriverruntime.exe	128
PID 908 wrote to memory of 5204	908	csc.exe	130
PID 908 wrote to memory of 5204	908	csc.exe	130
PID 2380 wrote to memory of 5904	2380	msdriverruntime.exe	131
PID 2380 wrote to memory of 5904	2380	msdriverruntime.exe	131
PID 5904 wrote to memory of 4200	5904	csc.exe	133
PID 5904 wrote to memory of 4200	5904	csc.exe	133
PID 2380 wrote to memory of 5600	2380	msdriverruntime.exe	149
PID 2380 wrote to memory of 5600	2380	msdriverruntime.exe	149
PID 2380 wrote to memory of 5384	2380	msdriverruntime.exe	150
PID 2380 wrote to memory of 5384	2380	msdriverruntime.exe	150
PID 2380 wrote to memory of 3284	2380	msdriverruntime.exe	151
PID 2380 wrote to memory of 3284	2380	msdriverruntime.exe	151
PID 2380 wrote to memory of 4244	2380	msdriverruntime.exe	152
PID 2380 wrote to memory of 4244	2380	msdriverruntime.exe	152
PID 2380 wrote to memory of 1400	2380	msdriverruntime.exe	153
PID 2380 wrote to memory of 1400	2380	msdriverruntime.exe	153
PID 2380 wrote to memory of 4964	2380	msdriverruntime.exe	154
PID 2380 wrote to memory of 4964	2380	msdriverruntime.exe	154
PID 2380 wrote to memory of 1460	2380	msdriverruntime.exe	160
PID 2380 wrote to memory of 1460	2380	msdriverruntime.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5324	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\kdmapper.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\kdmapper\spoof.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\Desktop\kdmapper\kdmapper.exe
  kdmapper.exe s.sys
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\main_2024-08-02_17-05-17.exe
    "C:\Users\Admin\AppData\Local\Temp\main_2024-08-02_17-05-17.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6080
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p25203326322559820124957532645 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1556
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "msdriverruntime.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\main\msdriverruntime.exe
        
        "msdriverruntime.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2380
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ibblchr\0ibblchr.cmdline"
        6⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB92E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC42D6C5BA5EE94875A854B82718E1A0.TMP"
        7⤵
        
        PID:5204
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffbrro4h\ffbrro4h.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5904
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB97C.tmp" "c:\Windows\System32\CSC707DF8481C5147D69929A3BB9E41570.TMP"
        7⤵
        
        PID:4200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\TrustedInstaller.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\sysmon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4244
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1400
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main\msdriverruntime.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4964
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\24iWwzEvA6.bat"
        6⤵
        
        PID:1460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4360
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2ucUGghGnf.bat"
        8⤵
        
        PID:1288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1744
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:4472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\opqphCX6ar.bat"
        10⤵
        
        PID:2392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1644
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:5440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I19jVKSgi3.bat"
        12⤵
        
        PID:4192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3788
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:4820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AcAxalUZZX.bat"
        14⤵
        
        PID:3124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1816
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4396
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:5956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AcAxalUZZX.bat"
        16⤵
        
        PID:1600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5256
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZXPLL9zJFP.bat"
        18⤵
        
        PID:1172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4620
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lQjAOk5IUW.bat"
        20⤵
        
        PID:4576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1164
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JRGN3N9ZXF.bat"
        22⤵
        
        PID:5912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1796
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:3992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kg5VX99QjA.bat"
        24⤵
        
        PID:4388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5928
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat"
        26⤵
        
        PID:4088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3656
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat"
        28⤵
        
        PID:6028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:5420
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2424
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:2420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fZD0t5NKB6.bat"
        30⤵
        
        PID:4432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:2388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:2696
        
        C:\Program Files\Windows Media Player\backgroundTaskHost.exe
        
        "C:\Program Files\Windows Media Player\backgroundTaskHost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A1L3CyIkVD.bat"
        32⤵
        
        PID:2468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4172
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1956
- - C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
    "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"
    3⤵
    - Executes dropped EXE
    PID:3324
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:3316
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:4272
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:1480
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:4948
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:5356
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:5580
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1352
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:1468
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:3300
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:1596
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:3800
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:3980
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:4388
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:4200
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:5308
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:5904
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:3180
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1600
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:5608
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:6132
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:1852
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:4756
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:1796
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1580
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1372
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:4728
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:3728
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:1656
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:1336
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2356
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1912
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:3252
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:5720
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SoftwareDistribution\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\60739cf6f660743813\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\60739cf6f660743813\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\60739cf6f660743813\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\60739cf6f660743813\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\60739cf6f660743813\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\60739cf6f660743813\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdriverruntimem" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\main\msdriverruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdriverruntime" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\main\msdriverruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msdriverruntimem" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\main\msdriverruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Users\Admin\Desktop\kdmapper\kdmapper.exe
"C:\Users\Admin\Desktop\kdmapper\kdmapper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3188
- C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"
  2⤵
  - Executes dropped EXE
  PID:3800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\kdmapper\spoof.bat"
1⤵
PID:3296
- C:\Users\Admin\Desktop\kdmapper\kdmapper.exe
  kdmapper.exe s.sys
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
    "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"
    3⤵
    - Executes dropped EXE
    PID:3812
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:4412
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1840
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:4692
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:1652
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:2468
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:3968
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:6120
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:3976
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1956
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:2936
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:1592
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:5740
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:408
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:5252
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2896
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:3260
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:3316
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:3944
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:4336
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:4584
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2652
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\kdmapper\_Serial_check.bat" "
1⤵
PID:1432
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:1352
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:908
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:3300
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:1780
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:3128
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:4092
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:3156
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:4064
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1004
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:1708
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:3292
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:3716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\kdmapper\spoof.bat" "
1⤵
PID:3176
- C:\Users\Admin\Desktop\kdmapper\kdmapper.exe
  kdmapper.exe s.sys
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6088
- - C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
    "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe"
    3⤵
    - Executes dropped EXE
    PID:5100
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:3728
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:4408
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:4564
- C:\Windows\system32\getmac.exe
  getmac /NH
  2⤵
  PID:5764
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get ProcessorId,name
  2⤵
  PID:6100
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid,name,version
  2⤵
  PID:5160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log

Filesize
1KB

MD5
6a3aed418cf5a7c9aa5b86d639268376

SHA1
35f8a197c9336320dfcc221e4fca90b59593cea3

SHA256
85eceb3e29340da0671ce59e5b4fffed73f2f3917b617c0422d526b5ca842ca2

SHA512
855b2e1c90eed4216f896aba0745ba21526f2810b81145360ec2fecf815370f5a16e47d6d631d49405308ee9dee204df554cb85091ad7d0e7a6eeb73c72fcbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b594c0a5591fab95a43185dd9944a231

SHA1
3d725e779790f3525ba12b0666f0a3a235644fed

SHA256
8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a

SHA512
452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e7d0883e28000a6270cf6b3b3f7b6c5a

SHA1
74d916eb15baa5ce4a168cd80d3d2c45d503daa2

SHA256
63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a

SHA512
4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0d95621f05cfdf1332d6f39c2f62c8fd

SHA1
b7b0762a256c6763314a7453c754a0225e39aae0

SHA256
2ae6e3f473d1bb5d3fb350e7f4361420068d8fc4ca9bb770d8d97c946217e553

SHA512
81c5e7f8b96d46ca7db6385e68ed95af85d4751d79b67b88f63bb516d3529f116cac0bf18841bc89da8c6e2fced76ef1cc892bc806461fa2eb8f4303647dabae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
029fbf628b046653ab7ff10b31deeeb2

SHA1
93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c

SHA256
85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26

SHA512
d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c

Download Submit
C:\Users\Admin\AppData\Local\Temp\24iWwzEvA6.bat

Filesize
236B

MD5
269d49b10288462a33fce942c1e11563

SHA1
6349acda0e601df81b80d130376dee936678f933

SHA256
18da34a7761b9096250ec8d57a776a64933a7bce014a727327fc74e5d40f3b9d

SHA512
2a20960c5d2efe6d01498190cff37fa1e9214137578efc6a16ec0980a5ef5260d4ee8666f81f33151157540a31614270b5ed4548f51d1844202c2e20b618037d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ucUGghGnf.bat

Filesize
188B

MD5
3dd724ce71829e6c98b9938b09fb9795

SHA1
42cb3a8789e78ddcc5aafc38600c42ab04d2ecd0

SHA256
217cce1bea8b9329217f4e0ce9e9d407d26a8b0fc40680cdd5374282730f97a4

SHA512
ea0903898686c08f028f73e5ca043545f09e2e9b707c7fc307c314599e6e42fe1fbc39cc2e7bf92fa66efd259b220cfc74970a396356d235fbbe7f689b7d3d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\AcAxalUZZX.bat

Filesize
188B

MD5
e187d1df1e1392c4ec2dced8023cf235

SHA1
90c40d033585dc5760305582b3b3c2fe27fdee90

SHA256
0903f5cf6534a7116a5576c608cce3f8ec0117fb3ad2ba9efb8a0c826c6902e5

SHA512
206f688e7b1512f0f1266ecda3b1496b9fbc33fddf09d758e4cdd89644df7665ea84837359cd4db2769ec047a1970079c51f59495bdfa99a568a17732adc8712

Download Submit
C:\Users\Admin\AppData\Local\Temp\I19jVKSgi3.bat

Filesize
236B

MD5
9ff666a01333e7b3ea8fcafd161ee561

SHA1
2c1edaa4a78a7af8aea1d00ce8d9d4eb8a907c40

SHA256
f8d4c62550a5f08debb69f8c8b829176d7a72109cb84b2b1b6beab92c2108d1b

SHA512
5df03a6d9918c52605fc6cc9f2d249f115dafa11ef41aa94aa2c4c76b8829bf2c202a68ad7cb0bca1e1c542b92779cd94c0df48ce280e1334295fa6c9beba9fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB92E.tmp

Filesize
1KB

MD5
ce1cf5efcb2eabb1edb92957af8b4ff3

SHA1
3224d41464208250829f5a0875e97966a89f7526

SHA256
f5536eb1e4ad65d33b9ac5daa8101f0def677e8789c67302a1a47411b1ec272d

SHA512
436a918d628f13930059d16cc5787bbe9b8ce7ea3323590b709bd8283c92dcb9bef300555c3029f890fd5988420b02f632a06eddcecdb8ddd648f1802f858343

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB97C.tmp

Filesize
1KB

MD5
b01bc6de7b0fad2f1ad5dc85c5679f14

SHA1
b4de59c6400928a314b6e827af8b043557c153ba

SHA256
fb0850c10051a5044c672191c321c9e15c9f5d2c5c91e7d739fc2785f1904520

SHA512
c7323a7cdee6ece4fd9a92338641f878731f6e148142aa3e1a09f31ffbfce2eb0c6b0b1ba3fd0140427f6b59efd8bc59ffe96df9bcdf9cfe6666235664c3b4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4c21muuy.tnk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kdmapper.exe

Filesize
133KB

MD5
b9d7e5d2d0e9f0cb618c4db10c12c6bb

SHA1
926a6f9ba1dad9160cc96a2f74465d607b4b4dd6

SHA256
02cf87c1163b53153449ece45ea5ff2f98a7963e7981f75b55f3e0f36ffec08f

SHA512
eb0bf226400d8dd327f7692588d234380af68f732de05c976caba7a80870bc1e93ceb5893989f1e06f171c40ac153af3ece45665f0843cb9789c82d9add49e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

Filesize
2.2MB

MD5
69335538328d6708de7b6ccd85d628ea

SHA1
451200a635a90a951e03147314568f3691a94a5a

SHA256
9c0acb89d78613739aa990affc48eb5b910099e33ee45dce37757a476af069cc

SHA512
8260ad5feef48fcd3d8e40e21b1cb1bb8709c0da9b474c8f2e21bd29874225345ca0a64acc87fc3021e83cdfd2e2f8f9f85d306bbb0e003ffb9e8e6ed4585903

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
311KB

MD5
877fbc2d3c154407e2398f56908a4480

SHA1
98eb6b1a7fad8a145dafb5d70b061a71b70cf55c

SHA256
2aa7f166f0d2dc490488eb613c455952f38573aeb441d4b95dc6d006eb099cfe

SHA512
de3b0d55878df26c2f3a966c02c4c29e91a95d4f13b47d865634e1a5b6a0fb785f0a03cde517f08723445c75493879032d8771009c438897c8ee3f54f742f18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
310KB

MD5
ab40dd752af0974d933b28ba20d211b3

SHA1
34653fc28941e40ee3acdf1f1f659990d9a7d24b

SHA256
94ee280bcfe8deec458e010bc83b4dd65a90f913acecfd671362941051f1afe3

SHA512
0b2b7a3a55ce3f65be905a8bc791da7087ff72ed19cc48f9ad72509adba717d2e869debdeb9b51e57b53650df0d846cf8d2fca92321d6c8e8ae437fe812cfee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
310KB

MD5
43a3fa14cb0d20a86010d8229c0e97c3

SHA1
cb3aa60bf7b7cf718087e0861e02c3e0caaf1f22

SHA256
9a8a5f02ca5254b526d93faea5bd097a72b3c41d46e10296d13b95fc327dcaef

SHA512
3ae65a4fbdf2f528626253ed8524484e781b54b4aed0a7fcf3fe36d22b6933b10fcd9494883798069492a59fded40c7ed349f68fcbcbc7865668775270810ce7

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
310KB

MD5
56ea0cd7b52ab028597943f082b5043f

SHA1
0732d4f67965bbb7d3e174dcc0a9f7fa03430e94

SHA256
93acb211e4475b8fbfe3356720b67ae2dd6420d40ef6a224ce61c4b24ca1661c

SHA512
7c1a0637c4ca886f50617998b16f3be38134482671cce5163ad354afe07a54d460c289ff7094ef806058f3fbaa1288d2b1eb2b0e4332b8027acf907aa756af56

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
311KB

MD5
eb0f6c7534ca2c51db8fbb8a0d5ecbd8

SHA1
788944d442b3139bfe004204415f7a0173da476a

SHA256
2b3619764794ddc69c5886c0105f93d8ebdd071507ae6b47a4ea52afd16faf56

SHA512
b8c508a9f15d5f67df5d45cbad96d75e2262b14e64e1960982dd139d67aa445a539b4152969b54d0729198639ac840a74bfcfed03d5054a3d6a3395532e991ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

Filesize
1.9MB

MD5
e31a485452aef6961ea1d27e4fcc182c

SHA1
ac85c835531cdd243507c7139a872f3141c94469

SHA256
4d1b10aada6d29f3d06e956db6cf29404c948fb11492f8062421f48aed53ca1d

SHA512
f7dd6c7ac8eb78197866582e41f5ff0f49d6d5fb9e23ac51b08413e7bd7147259cdbbf6fbc414ca0a6b80c692b41d89884397ee63f420f563a5555e98b50c547

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\msdriverruntime.exe

Filesize
783KB

MD5
cc5b4ee77315ecd151675f2ac0dee966

SHA1
005a5075ea2d8f7056bcc36f10c0cb1a1c94a648

SHA256
cbe83d350376a7b56d63e3712d062652365ae69a63f8cd32d4d89921a9c75dd5

SHA512
b8b6b6159c30dfe4ac87994225896de86378767a880c5168c0e978843d928b9823995dfc5389162ba7206f543fbfd8cc802272c32af3eea8dafdcd2d2ba52feb

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
1.9MB

MD5
357df3ab8fadc58198dd36c3986a3860

SHA1
f103b37344d930cf0dcd3f08ab7939a0c106acf0

SHA256
9df20a9e993e67d5c976abe8528aa0caa239fb4f11499e0291e1aee60e69fc9f

SHA512
7b7a258bdbbcced66c732df079549ac3e72529a77f88a02b7c86ee828a03707ed5289e09a1626c1337b5bab96d7dc441a8b410b005ccd52efc5320cfbf295f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
505B

MD5
66513e8a6a4b8dac0051c184718bae44

SHA1
cb2faacd4419a885e17d97edb866f480a3596f0d

SHA256
aa8a2aa8ee801d0a0e63253fc7b6da710c5e27f03629350c7caf6a5ebcf9a05d

SHA512
e341b61edbfa63e8a07da5e300a5742dd3617752e063fd6d986713e8cedac3ba56f97aef2069f57407dabba3f700eb59dcc942757479e73cdc3311216b6faead

Download Submit
C:\Users\Admin\AppData\Local\Temp\main_2024-08-02_17-05-17.exe

Filesize
2.8MB

MD5
b981912180fd214e229a48786b29f084

SHA1
457fcfa0fef95d072e7dde5e6aa566722b3b0d38

SHA256
194967828837f0f35ef2250ab0da5f89b9d6279e860ae20d47c3873069f6bb64

SHA512
4578b6b80dd4eda68957e35bd8c5878b04e63df90b1da748c5f6cfa88c0dd146287fa78e2d7c0bada48e684a4aba70c4cc60af26865c6806f7b38b0ba7620048

Download Submit
C:\Users\Admin\AppData\Local\Temp\opqphCX6ar.bat

Filesize
188B

MD5
267917c423527b4ec14d8f7bb53cb473

SHA1
302eff686621e43d034a73ab609f0b4e0dbdaf67

SHA256
ccc0caf9f5f0776bc3975d72139abcfea5828fdda6ac4ca6816f129926c7f03c

SHA512
c0f07a4c19f1b45edc76a15014528ad7a3b1c39c7831fe9ded3cbb11755530106d09e19c955961742e043d6ece58f538e1374c23c4127a817e83f3db21df42d8

Download Submit
C:\Users\Admin\Desktop\kdmapper\_Serial_check.bat

Filesize
379B

MD5
8e41c1119dcdee8febbd28804d505340

SHA1
5a1b961d46fb6da49a9622932454a7054e6ba4e9

SHA256
40f99c57038349e8affe1377624b31fece393fdbf85a7147ec975d549028431c

SHA512
91210511a83d4654ba4408cd80e443827d299c656593d8324a971801eada594d76a2e0da45cb6f22fceb4ec4944cf214bf2697646d6dc26d629bcd82087294e7

Download Submit
C:\Users\Admin\Desktop\kdmapper\kdmapper.exe

Filesize
4.4MB

MD5
f67ce1c7f9360af571a329573d0b38ed

SHA1
f72c8ecaf324a31b2c3bf7ca15514af09ec3841f

SHA256
ee45a91c9cf4646ec221733677e6ad5e50c32d10659528ffd6df4c25ff52e138

SHA512
f2a55d9070f56d0bcbf6f4db36c3e9655c80e61db55720935369e0d4a1c59f5ec5e0907864b522af24fba17b85ebe60251b22d32a4b9afc1448bf7e3f0456fbd

Download Submit
C:\Users\Admin\Desktop\kdmapper\spoof.bat

Filesize
403B

MD5
38b51184c9cd21a76ae49435485051c1

SHA1
2a35f39dc6620b84b88132100715d5e7e3c19fb5

SHA256
16e7770ef24530977e9717229940770fd3f8b9934ab09ccd6bbc1f61100caa4e

SHA512
138390fd4568a0097ab004b4851bb5cf391d00f94f162af75937ca6ea68e93f21e178f6190d5d2dfa9a6bf6f15480c8361545db8295cdf9714fb5e8a0c97b2fb

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC42D6C5BA5EE94875A854B82718E1A0.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0ibblchr\0ibblchr.0.cs

Filesize
396B

MD5
2df2cd95efef00c0efe0d6e51a79bdb5

SHA1
3d7ff45f03501f6b9960697d9b07f6a64fb9ea89

SHA256
9914e252420de804d642962921de13aff2fa5ca6b5fa91b2bcd7cb8949f87426

SHA512
b628b30ad449bcc3e4467f6cffc3fcb1e5d2881c59f496ef7e293fd01ca80a8e256c10713a86c396c57e847b9dca32684b86a56236581dac252770a4e20f41b1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0ibblchr\0ibblchr.cmdline

Filesize
265B

MD5
27d9f120c23536aa580272bb88f1effe

SHA1
408fa22d35f95581059250ce54a3c11093cb7a69

SHA256
39e6b06a8d7fe2f13d536698ed11fb116032a3ee18dfe67f0bca927477c7ed96

SHA512
ece9c85ba5384f80412e2719b1a7d979fb3f5cfba979fe2d185398f49a6ae04737a6ca8026ed4e6b5a7d80edc7a202dff062f4e91ec5ee0a6ba4e67959e5f3f9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ffbrro4h\ffbrro4h.0.cs

Filesize
366B

MD5
0215205e3b23c887239c198d5a44d98f

SHA1
db4549a47eb4d847a0fa405264922aaadfcb827f

SHA256
811bcc8082da54e52cf12e8162232edd53a45a2cf0f0eb2e5a30fe62d2e2ff89

SHA512
6f71d6d7b4d2609ae245c20f3d7b4a0300aa84fc7ed5c898c09ff9436ee88c1c09431cd1c0b576920443cbd6fc1d6b2b6a81f224dab15d30bc8fa317d301473e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ffbrro4h\ffbrro4h.cmdline

Filesize
235B

MD5
9e6cb36cb5b95ed58a3cd1d207a451e9

SHA1
99f1635e7690a21a6e32cd5a9a4c7a56815f2439

SHA256
f7966fcfecf747d14e53e46395b90e1b9d24f5002dcb4177aab047d019f1ab53

SHA512
43e658b188dc00a0bfb7461b697b495ec17ae1c09670093a605bf343c10892a3331e4f43dd583eb1753cb3fca5f144bf18f61883b44a7749fcf837a3682a5348

Download Submit
\??\c:\Windows\System32\CSC707DF8481C5147D69929A3BB9E41570.TMP

Filesize
1KB

MD5
47fa8be984a761eed9ddc12bad4b4f61

SHA1
47cf543057fea8c63985cc386ececd8fca267242

SHA256
fb38cb0ac68d8daffa4648c3467a9fcb37e7a362be2e9344fadcecbdda53fd86

SHA512
15d8e622b9bab40fce8e7b3d8cc8495ae6198b48f955421d3066576f02461eb28824bba9bb95f3de88af67843f133607eb0cc3c799bf906409f73da2a8953963

Download Submit
memory/2380-99-0x000000001B900000-0x000000001B950000-memory.dmp

Filesize
320KB

Download
memory/2380-94-0x0000000000C20000-0x0000000000CEA000-memory.dmp

Filesize
808KB

Download
memory/2380-96-0x0000000001390000-0x000000000139E000-memory.dmp

Filesize
56KB

Download
memory/2380-98-0x0000000002E90000-0x0000000002EAC000-memory.dmp

Filesize
112KB

Download
memory/2380-101-0x0000000002EB0000-0x0000000002EC8000-memory.dmp

Filesize
96KB

Download
memory/2380-105-0x00000000013B0000-0x00000000013BC000-memory.dmp

Filesize
48KB

Download
memory/2380-103-0x00000000013A0000-0x00000000013A8000-memory.dmp

Filesize
32KB

Download
memory/4244-155-0x000001ADC1E20000-0x000001ADC1E42000-memory.dmp

Filesize
136KB

Download
memory/4820-12-0x0000000000400000-0x0000000000867000-memory.dmp

Filesize
4.4MB

Download