179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Size 1.2MB
Sample260415-lt91ssbs7q
SHA256 179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1
MD5 471bcb6c43fa97ede55e4a5d1c38f4f3
SHA1 e7e3f71efd74c7b3017184f1ca134d44742a6d7d
SHA512 e185c600288ee9db63eac0f46eabffed0650e3825046a3e65d28429d302023a41bf29dc5d6f5895180ebc5da30a0d4c5689c3b01563d11231ce41539b0e36b90
SSDEEP 24576:9GeCIqoPLPC/fRBJjvXw1Fc9ZS/ri0fXHQ9PjQl8NIfydnr:8eXqoP2XFTX/8wijfydr
TLSH
T152459E52FB82F0F1EAC602B251FF6BF65C283B19872994D7A1D01D995D201D33B3EA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2396	wevtutil.exe
2104	wevtutil.exe
3948	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3660	4948	WerFault.exe	90
1452	1420	WerFault.exe	119
1848	4916	WerFault.exe	88
2232	4744	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4800	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
4800	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
4800	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
4800	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
736	powershell.exe
736	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeTcbPrivilege	556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeTakeOwnershipPrivilege	556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeBackupPrivilege	556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeRestorePrivilege	556	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeIncreaseQuotaPrivilege	3900	wmic.exe
Token: SeSecurityPrivilege	3900	wmic.exe
Token: SeTakeOwnershipPrivilege	3900	wmic.exe
Token: SeLoadDriverPrivilege	3900	wmic.exe
Token: SeSystemProfilePrivilege	3900	wmic.exe
Token: SeSystemtimePrivilege	3900	wmic.exe
Token: SeProfSingleProcessPrivilege	3900	wmic.exe
Token: SeIncBasePriorityPrivilege	3900	wmic.exe
Token: SeCreatePagefilePrivilege	3900	wmic.exe
Token: SeBackupPrivilege	3900	wmic.exe
Token: SeRestorePrivilege	3900	wmic.exe
Token: SeShutdownPrivilege	3900	wmic.exe
Token: SeDebugPrivilege	3900	wmic.exe
Token: SeSystemEnvironmentPrivilege	3900	wmic.exe
Token: SeRemoteShutdownPrivilege	3900	wmic.exe
Token: SeUndockPrivilege	3900	wmic.exe
Token: SeManageVolumePrivilege	3900	wmic.exe
Token: 33	3900	wmic.exe
Token: 34	3900	wmic.exe
Token: 35	3900	wmic.exe
Token: 36	3900	wmic.exe
Token: SeSecurityPrivilege	2396	wevtutil.exe
Token: SeBackupPrivilege	2396	wevtutil.exe
Token: SeSecurityPrivilege	3948	wevtutil.exe
Token: SeBackupPrivilege	3948	wevtutil.exe
Token: SeSecurityPrivilege	2104	wevtutil.exe
Token: SeBackupPrivilege	2104	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	3900	wmic.exe
Token: SeSecurityPrivilege	3900	wmic.exe
Token: SeTakeOwnershipPrivilege	3900	wmic.exe
Token: SeLoadDriverPrivilege	3900	wmic.exe
Token: SeSystemProfilePrivilege	3900	wmic.exe
Token: SeSystemtimePrivilege	3900	wmic.exe
Token: SeProfSingleProcessPrivilege	3900	wmic.exe
Token: SeIncBasePriorityPrivilege	3900	wmic.exe
Token: SeCreatePagefilePrivilege	3900	wmic.exe
Token: SeBackupPrivilege	3900	wmic.exe
Token: SeRestorePrivilege	3900	wmic.exe
Token: SeShutdownPrivilege	3900	wmic.exe
Token: SeDebugPrivilege	3900	wmic.exe
Token: SeSystemEnvironmentPrivilege	3900	wmic.exe
Token: SeRemoteShutdownPrivilege	3900	wmic.exe
Token: SeUndockPrivilege	3900	wmic.exe
Token: SeManageVolumePrivilege	3900	wmic.exe
Token: 33	3900	wmic.exe
Token: 34	3900	wmic.exe
Token: 35	3900	wmic.exe
Token: 36	3900	wmic.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeBackupPrivilege	1900	vssvc.exe
Token: SeRestorePrivilege	1900	vssvc.exe
Token: SeAuditPrivilege	1900	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4800	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	85
PID 4592 wrote to memory of 3776	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	86
PID 4592 wrote to memory of 2628	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	87
PID 4592 wrote to memory of 4916	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	88
PID 4592 wrote to memory of 2380	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	89
PID 4592 wrote to memory of 4948	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	90
PID 4592 wrote to memory of 2576	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	91
PID 4592 wrote to memory of 556	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	92
PID 4592 wrote to memory of 4892	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	93
PID 4592 wrote to memory of 3864	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	94
PID 4592 wrote to memory of 2064	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	95
PID 4592 wrote to memory of 5060	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	96
PID 4592 wrote to memory of 4744	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	97
PID 4592 wrote to memory of 4128	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	98
PID 4592 wrote to memory of 4544	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	99
PID 4592 wrote to memory of 1492	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	100
PID 4592 wrote to memory of 2784	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	101
PID 4592 wrote to memory of 2548	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	102
PID 4592 wrote to memory of 2400	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	103
PID 4592 wrote to memory of 4952	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	104
PID 4592 wrote to memory of 4836	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	105
PID 4592 wrote to memory of 4452	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 4592 wrote to memory of 4260	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	107
PID 4592 wrote to memory of 4460	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	108
PID 4592 wrote to memory of 3296	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	109
PID 4592 wrote to memory of 624	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	110
PID 4592 wrote to memory of 2888	4592	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	111
PID 4744 wrote to memory of 3900	4744	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	112
PID 4744 wrote to memory of 3948	4744	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	113
PID 4744 wrote to memory of 2104	4744	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	114
PID 4744 wrote to memory of 2396	4744	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	115
PID 4260 wrote to memory of 2428	4260	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	118
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 4460 wrote to memory of 1420	4460	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	119
PID 2576 wrote to memory of 1436	2576	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	134
PID 3296 wrote to memory of 736	3296	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
"C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AntiAnalysis
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AMSIETW
  2⤵
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_SandboxEvasion
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EDRUnhooker
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 404
    3⤵
    - Program crash
    PID:1848
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_BYOVD
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_HardwarePersistence
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 396
    3⤵
    - Program crash
    PID:3660
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_UACBypass
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\fodhelper.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1436
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_TokenVault
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_ChromeDrainer
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_FirefoxDrainer
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EdgeDrainer
  2⤵
  PID:2064
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_WalletDrainer
  2⤵
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Ransomware
  2⤵
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 624
    3⤵
    - Program crash
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_ACPITooMany
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Win32k
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_USBHub
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_TPM
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_NTFS
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_DirectX
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EternalBlue
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_KernelCallback
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_HeapElevation
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_SpoofParent
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:2428
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AdvancedHollowing
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 12
      4⤵
      Program crash
      PID:1452
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_LOLBAS
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ¨|
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:736
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Callback
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Stager
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1420 -ip 1420
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4948 -ip 4948
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4916 -ip 4916
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4744 -ip 4744
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4544 -ip 4544
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4452 -ip 4452
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4544 -ip 4544
1⤵
PID:4752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_hnx31vci.jak.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hnx31vci.jak.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/624-0-0x0000000002190000-0x0000000002347000-memory.dmp

Download

memory/624-37-0x00000000008E0000-0x0000000000943000-memory.dmp

Download

memory/736-30-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Download

memory/736-19-0x0000000005470000-0x0000000005492000-memory.dmp

Download

memory/736-34-0x0000000005450000-0x000000000545B000-memory.dmp

Download

memory/736-35-0x0000000005A50000-0x0000000005AB3000-memory.dmp

Download

memory/736-31-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Download

memory/736-29-0x00000000055F0000-0x0000000005944000-memory.dmp

Download

memory/736-21-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/736-20-0x0000000005510000-0x0000000005576000-memory.dmp

Download

memory/736-16-0x0000000004670000-0x00000000046A6000-memory.dmp

Download

memory/736-17-0x0000000004CE0000-0x0000000005308000-memory.dmp

Download

memory/1420-1-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/1900-40-0x000001CB5FF70000-0x000001CB60019000-memory.dmp

Download

memory/2400-10-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-12-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-2-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-9-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-4-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-3-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-11-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-15-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-13-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2400-14-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2888-38-0x00000000021D0000-0x0000000002233000-memory.dmp

Download

memory/2888-98-0x00000000021D0000-0x0000000002233000-memory.dmp

Download

memory/4592-18-0x0000000000B40000-0x0000000000BA3000-memory.dmp

Download

memory/4836-5-0x0000000002400000-0x00000000025B7000-memory.dmp

Download

memory/4836-36-0x0000000000A10000-0x0000000000A73000-memory.dmp

Download