179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Size 1.2MB
Sample260415-lt91ssbs7q
SHA256 179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1
MD5 471bcb6c43fa97ede55e4a5d1c38f4f3
SHA1 e7e3f71efd74c7b3017184f1ca134d44742a6d7d
SHA512 e185c600288ee9db63eac0f46eabffed0650e3825046a3e65d28429d302023a41bf29dc5d6f5895180ebc5da30a0d4c5689c3b01563d11231ce41539b0e36b90
SSDEEP 24576:9GeCIqoPLPC/fRBJjvXw1Fc9ZS/ri0fXHQ9PjQl8NIfydnr:8eXqoP2XFTX/8wijfydr
TLSH
T152459E52FB82F0F1EAC602B251FF6BF65C283B19872994D7A1D01D995D201D33B3EA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
860	wevtutil.exe
2116	wevtutil.exe
4752	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2948	1828	WerFault.exe	93
5108	4960	WerFault.exe	106
1640	2244	WerFault.exe	84
4148	4304	WerFault.exe	91
3644	1828	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
644	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
644	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
644	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
644	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
3836	powershell.exe
3836	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeTcbPrivilege	1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeTakeOwnershipPrivilege	1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeBackupPrivilege	1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeRestorePrivilege	1280	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
Token: SeSecurityPrivilege	4752	wevtutil.exe
Token: SeBackupPrivilege	4752	wevtutil.exe
Token: SeSecurityPrivilege	2116	wevtutil.exe
Token: SeBackupPrivilege	2116	wevtutil.exe
Token: SeSecurityPrivilege	860	wevtutil.exe
Token: SeBackupPrivilege	860	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	988	wmic.exe
Token: SeSecurityPrivilege	988	wmic.exe
Token: SeTakeOwnershipPrivilege	988	wmic.exe
Token: SeLoadDriverPrivilege	988	wmic.exe
Token: SeSystemProfilePrivilege	988	wmic.exe
Token: SeSystemtimePrivilege	988	wmic.exe
Token: SeProfSingleProcessPrivilege	988	wmic.exe
Token: SeIncBasePriorityPrivilege	988	wmic.exe
Token: SeCreatePagefilePrivilege	988	wmic.exe
Token: SeBackupPrivilege	988	wmic.exe
Token: SeRestorePrivilege	988	wmic.exe
Token: SeShutdownPrivilege	988	wmic.exe
Token: SeDebugPrivilege	988	wmic.exe
Token: SeSystemEnvironmentPrivilege	988	wmic.exe
Token: SeRemoteShutdownPrivilege	988	wmic.exe
Token: SeUndockPrivilege	988	wmic.exe
Token: SeManageVolumePrivilege	988	wmic.exe
Token: 33	988	wmic.exe
Token: 34	988	wmic.exe
Token: 35	988	wmic.exe
Token: 36	988	wmic.exe
Token: SeIncreaseQuotaPrivilege	988	wmic.exe
Token: SeSecurityPrivilege	988	wmic.exe
Token: SeTakeOwnershipPrivilege	988	wmic.exe
Token: SeLoadDriverPrivilege	988	wmic.exe
Token: SeSystemProfilePrivilege	988	wmic.exe
Token: SeSystemtimePrivilege	988	wmic.exe
Token: SeProfSingleProcessPrivilege	988	wmic.exe
Token: SeIncBasePriorityPrivilege	988	wmic.exe
Token: SeCreatePagefilePrivilege	988	wmic.exe
Token: SeBackupPrivilege	988	wmic.exe
Token: SeRestorePrivilege	988	wmic.exe
Token: SeShutdownPrivilege	988	wmic.exe
Token: SeDebugPrivilege	988	wmic.exe
Token: SeSystemEnvironmentPrivilege	988	wmic.exe
Token: SeRemoteShutdownPrivilege	988	wmic.exe
Token: SeUndockPrivilege	988	wmic.exe
Token: SeManageVolumePrivilege	988	wmic.exe
Token: 33	988	wmic.exe
Token: 34	988	wmic.exe
Token: 35	988	wmic.exe
Token: 36	988	wmic.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeBackupPrivilege	3384	vssvc.exe
Token: SeRestorePrivilege	3384	vssvc.exe
Token: SeAuditPrivilege	3384	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 644	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	79
PID 4852 wrote to memory of 2764	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	80
PID 4852 wrote to memory of 2384	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	81
PID 4852 wrote to memory of 1044	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	82
PID 4852 wrote to memory of 3904	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	83
PID 4852 wrote to memory of 2244	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	84
PID 4852 wrote to memory of 1424	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	85
PID 4852 wrote to memory of 1280	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	86
PID 4852 wrote to memory of 760	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	87
PID 4852 wrote to memory of 4892	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	88
PID 4852 wrote to memory of 4700	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	89
PID 4852 wrote to memory of 4380	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	90
PID 4852 wrote to memory of 4304	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	91
PID 4852 wrote to memory of 3656	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	92
PID 4852 wrote to memory of 1828	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	93
PID 4852 wrote to memory of 3872	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	94
PID 4852 wrote to memory of 2500	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	95
PID 4852 wrote to memory of 2012	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	96
PID 4852 wrote to memory of 4356	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	97
PID 4852 wrote to memory of 5084	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	98
PID 4852 wrote to memory of 4604	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	99
PID 4852 wrote to memory of 4836	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	100
PID 4852 wrote to memory of 1164	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	101
PID 4852 wrote to memory of 1948	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	102
PID 4852 wrote to memory of 3148	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	103
PID 1164 wrote to memory of 4800	1164	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	105
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 1948 wrote to memory of 4960	1948	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	106
PID 4304 wrote to memory of 988	4304	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	108
PID 4304 wrote to memory of 4752	4304	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	109
PID 4304 wrote to memory of 2116	4304	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	110
PID 4304 wrote to memory of 860	4304	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	111
PID 4852 wrote to memory of 2888	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	104
PID 4852 wrote to memory of 896	4852	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	112
PID 3148 wrote to memory of 3836	3148	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	123
PID 1424 wrote to memory of 244	1424	179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
"C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AntiAnalysis
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AMSIETW
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_SandboxEvasion
  2⤵
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EDRUnhooker
  2⤵
  PID:1044
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_BYOVD
  2⤵
  PID:3904
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_HardwarePersistence
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 416
    3⤵
    - Program crash
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_UACBypass
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\fodhelper.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_TokenVault
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_ChromeDrainer
  2⤵
  PID:760
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_FirefoxDrainer
  2⤵
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EdgeDrainer
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_WalletDrainer
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Ransomware
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 660
    3⤵
    - Program crash
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_ACPITooMany
  2⤵
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Win32k
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 540
    3⤵
    - Program crash
    PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 540
    3⤵
    - Program crash
    PID:3644
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_USBHub
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_TPM
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_NTFS
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_DirectX
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_EternalBlue
  2⤵
  PID:5084
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_KernelCallback
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_HeapElevation
  2⤵
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_SpoofParent
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:4800
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_AdvancedHollowing
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:4960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 16
      4⤵
      Program crash
      PID:5108
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_LOLBAS
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Callback
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe
  "C:\Users\Admin\AppData\Local\Temp\179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe" EXPLOIT_Stager
  2⤵
  - System Location Discovery: System Language Discovery
  PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1828 -ip 1828
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4960 -ip 4960
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4304 -ip 4304
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4836 -ip 4836
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2244 -ip 2244
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1044 -ip 1044
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1828 -ip 1828
1⤵
PID:3156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_etghqffj.gqk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_etghqffj.gqk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-36-0x00000000007A0000-0x00000000007A7000-memory.dmp

Download

memory/644-35-0x0000000000A20000-0x0000000000AFF000-memory.dmp

Download

memory/760-0-0x00000000009A0000-0x0000000000A7F000-memory.dmp

Download

memory/896-65-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

Download

memory/896-64-0x0000000000970000-0x0000000000A4F000-memory.dmp

Download

memory/988-54-0x0000000001610000-0x00000000016EF000-memory.dmp

Download

memory/1044-33-0x0000000000960000-0x0000000000A3F000-memory.dmp

Download

memory/1164-5-0x0000000000990000-0x0000000000A6F000-memory.dmp

Download

memory/1280-4-0x0000000000980000-0x0000000000A5F000-memory.dmp

Download

memory/1424-31-0x0000000000A00000-0x0000000000ADF000-memory.dmp

Download

memory/1828-53-0x0000000000A10000-0x0000000000AEF000-memory.dmp

Download

memory/1948-9-0x0000000000980000-0x0000000000A5F000-memory.dmp

Download

memory/2012-7-0x0000000000950000-0x0000000000A2F000-memory.dmp

Download

memory/2244-39-0x0000000000990000-0x0000000000A6F000-memory.dmp

Download

memory/2384-45-0x0000000000970000-0x0000000000A4F000-memory.dmp

Download

memory/2500-13-0x00000000009D0000-0x0000000000AAF000-memory.dmp

Download

memory/2764-2-0x0000000000970000-0x0000000000A4F000-memory.dmp

Download

memory/2888-11-0x00000000022C0000-0x0000000002477000-memory.dmp

Download

memory/2888-62-0x0000000000860000-0x000000000086B000-memory.dmp

Download

memory/2888-61-0x00000000009D0000-0x0000000000AAF000-memory.dmp

Download

memory/2888-63-0x0000000003390000-0x0000000003397000-memory.dmp

Download

memory/3148-29-0x0000000000950000-0x0000000000A2F000-memory.dmp

Download

memory/3656-10-0x0000000000A20000-0x0000000000AFF000-memory.dmp

Download

memory/3836-43-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/3836-37-0x0000000004FB0000-0x00000000055DA000-memory.dmp

Download

memory/3836-57-0x0000000006D10000-0x0000000006D56000-memory.dmp

Download

memory/3836-34-0x00000000023A0000-0x00000000023D6000-memory.dmp

Download

memory/3836-44-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/3836-56-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

Download

memory/3836-66-0x0000000000860000-0x000000000093F000-memory.dmp

Download

memory/3836-55-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Download

memory/3836-52-0x00000000056C0000-0x0000000005A17000-memory.dmp

Download

memory/3836-42-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Download

memory/3872-12-0x0000000000960000-0x0000000000A3F000-memory.dmp

Download

memory/3904-1-0x0000000000960000-0x0000000000A3F000-memory.dmp

Download

memory/4304-38-0x0000000000970000-0x0000000000A4F000-memory.dmp

Download

memory/4356-26-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-23-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-28-0x0000000000990000-0x0000000000A6F000-memory.dmp

Download

memory/4356-25-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-22-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-14-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-15-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-21-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-24-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-27-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4356-16-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4380-30-0x00000000009C0000-0x0000000000A9F000-memory.dmp

Download

memory/4604-60-0x0000000003490000-0x0000000003497000-memory.dmp

Download

memory/4604-59-0x0000000000650000-0x000000000065B000-memory.dmp

Download

memory/4604-58-0x00000000009D0000-0x0000000000AAF000-memory.dmp

Download

memory/4604-8-0x0000000002530000-0x00000000026E7000-memory.dmp

Download

memory/4604-81-0x00000000035F0000-0x00000000035F2000-memory.dmp

Download

memory/4700-17-0x0000000000960000-0x0000000000A3F000-memory.dmp

Download

memory/4836-32-0x00000000009F0000-0x0000000000ACF000-memory.dmp

Download

memory/4852-40-0x0000000000BF0000-0x0000000000CCF000-memory.dmp

Download

memory/4852-41-0x0000000000D90000-0x0000000000D97000-memory.dmp

Download

memory/4892-3-0x0000000000950000-0x0000000000A2F000-memory.dmp

Download

memory/5084-6-0x00000000009C0000-0x0000000000A9F000-memory.dmp

Download