8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388

Resubmissions

26/03/2025, 16:57

250326-vgh6zs1ms4 10

26/03/2025, 16:40

250326-t61a5aywhw 10

26/03/2025, 16:26

250326-txrmmazr18 10

Analysis

max time kernel
102s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
Size

1.5MB
MD5

04f4042f2f96b4c74ec2b336905d469c
SHA1

4b917ef74b8b08c44d83c4dfe8f56a40e72cad32
SHA256

8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388
SHA512

62dcab3c5c7cf1c698e7c96c6d0603646c7332140fec969d63389cf739a1b4a8abb5ffce311ab89a04287d250e27c48e5354b498ccbcd76db417034ee389fd7a
SSDEEP

49152:uRCTPz99vLJM4iEngkRCip4VljKnJxUEifndEHqAC1zI/2cCiMh5:uRCDHXt3AiYjKPUEqnde9sk/2nim5

Score

5^/10

discovery upx

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/5492-4-0x0000000000B20000-0x0000000000D1A000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5492-0-0x0000000000B20000-0x0000000000D1A000-memory.dmp	upx
behavioral1/memory/5492-4-0x0000000000B20000-0x0000000000D1A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 4016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	78
PID 5492 wrote to memory of 4016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	78
PID 5492 wrote to memory of 4016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	78
PID 5492 wrote to memory of 4192	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	79
PID 5492 wrote to memory of 4192	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	79
PID 5492 wrote to memory of 4192	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	79
PID 5492 wrote to memory of 4628	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	80
PID 5492 wrote to memory of 4628	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	80
PID 5492 wrote to memory of 4628	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	80
PID 5492 wrote to memory of 5904	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	81
PID 5492 wrote to memory of 5904	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	81
PID 5492 wrote to memory of 5904	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	81
PID 5492 wrote to memory of 5224	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	82
PID 5492 wrote to memory of 5224	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	82
PID 5492 wrote to memory of 5224	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	82
PID 5492 wrote to memory of 5016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	83
PID 5492 wrote to memory of 5016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	83
PID 5492 wrote to memory of 5016	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	83
PID 5492 wrote to memory of 5024	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	84
PID 5492 wrote to memory of 5024	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	84
PID 5492 wrote to memory of 5024	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	84
PID 5492 wrote to memory of 3036	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	85
PID 5492 wrote to memory of 3036	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	85
PID 5492 wrote to memory of 3036	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	85
PID 5492 wrote to memory of 824	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	86
PID 5492 wrote to memory of 824	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	86
PID 5492 wrote to memory of 824	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	86
PID 5492 wrote to memory of 816	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	87
PID 5492 wrote to memory of 816	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	87
PID 5492 wrote to memory of 816	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	87
PID 5492 wrote to memory of 556	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	88
PID 5492 wrote to memory of 556	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	88
PID 5492 wrote to memory of 556	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	88
PID 5492 wrote to memory of 1440	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	89
PID 5492 wrote to memory of 1440	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	89
PID 5492 wrote to memory of 1440	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	89
PID 5492 wrote to memory of 2636	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	90
PID 5492 wrote to memory of 2636	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	90
PID 5492 wrote to memory of 2636	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	90
PID 5492 wrote to memory of 2416	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	91
PID 5492 wrote to memory of 2416	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	91
PID 5492 wrote to memory of 2416	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	91
PID 5492 wrote to memory of 3468	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	92
PID 5492 wrote to memory of 3468	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	92
PID 5492 wrote to memory of 3468	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	92
PID 5492 wrote to memory of 5964	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	93
PID 5492 wrote to memory of 5964	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	93
PID 5492 wrote to memory of 5964	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	93
PID 5492 wrote to memory of 5708	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	94
PID 5492 wrote to memory of 5708	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	94
PID 5492 wrote to memory of 5708	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	94
PID 5492 wrote to memory of 5132	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	95
PID 5492 wrote to memory of 5132	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	95
PID 5492 wrote to memory of 5132	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	95
PID 5492 wrote to memory of 5420	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	96
PID 5492 wrote to memory of 5420	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	96
PID 5492 wrote to memory of 5420	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	96
PID 5492 wrote to memory of 4580	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	97
PID 5492 wrote to memory of 4580	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	97
PID 5492 wrote to memory of 4580	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	97
PID 5492 wrote to memory of 3820	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	98
PID 5492 wrote to memory of 3820	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	98
PID 5492 wrote to memory of 3820	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	98
PID 5492 wrote to memory of 5272	5492	8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe	99

C:\Users\Admin\AppData\Local\Temp\8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe
C:\Users\Admin\AppData\Local\Temp\8af2c5cbbd64bc20fc6b292a0dcfe5efa795b1dd5dadd1c5f68933a7a81ae388.exe bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4016
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4192
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5904
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5224
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5024
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:824
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:816
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:556
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:1440
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2416
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3468
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5964
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5132
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5420
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3820
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5272
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3256
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3976
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3004
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3676
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5692
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3112
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3908
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:548
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5676
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4756
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4028
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5144
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4996
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3352
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5388
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5260
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3860
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4088
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5044
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3080
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3332
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4244
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4352
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4340
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5076
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3680
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2284
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:696
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3568
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5232
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5280
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4588
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4484
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5080
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4920
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:1040
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3812
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4916
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5152
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5580
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3772
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3784
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3228
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5944
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5992
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:4008
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:5384
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3656
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2264
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2268
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:424
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:3728
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5492-0-0x0000000000B20000-0x0000000000D1A000-memory.dmp

Filesize
2.0MB

Download
memory/5492-1-0x0000000004150000-0x0000000004185000-memory.dmp

Filesize
212KB

Download
memory/5492-2-0x0000000004190000-0x00000000041C5000-memory.dmp

Filesize
212KB

Download
memory/5492-4-0x0000000000B20000-0x0000000000D1A000-memory.dmp

Filesize
2.0MB

Download