af8e7bdea431100f8ad80dbb17200a01638b01ad8c0850190fb0e6b8a6efcde8

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RemzzysCrosshair (2).exe
Size 39.0MB
Sample260714-ab3yzscy9y
SHA256 af8e7bdea431100f8ad80dbb17200a01638b01ad8c0850190fb0e6b8a6efcde8
MD5 d41c58cfef405ffba39d191d696a8f2d
SHA1 e32f3fd255812de6e88024437be9155110567fa9
SHA512 3299a1080361c17d547213b2d18523af5fa7f625b025fbdb850c82ca799f6b653af5eac9d64cb140b3e6adf2cfec5b00e1d51039b6f4c9c966e4df5c35fdfdb6
SSDEEP 786432:B2PJ+9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmJorZ0:cx+l+RBwXzTUX0w8mxmJoF0
TLSH
T185971256E2FD00E8E57BC0B8C6575617E7B1344517309BEB62A48A692F33BE0AE7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	Crosshair0.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1912	icacls.exe
4820	icacls.exe
3084	icacls.exe
4656	icacls.exe
2808	icacls.exe
5732	icacls.exe

Adds Run key to start application 2 TTPs 41 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\RuntimeBroker.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\CertSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Common\\NetSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\StoreBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\StoreBroker.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiCache = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WmiCache.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\HistSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\HistSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinStore = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\WinStore.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrokerSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\BrokerSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SearchSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ThemeSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CredSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Credentials\\CredSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveHost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiagSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\DiagSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\AppBroker.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptSvc = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\CryptSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpotCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\SpotCache.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinInit = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinInit.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\TokenBroker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TokenBroker.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrokerHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\BrokerHost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppCache = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\AppCache.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\AppHost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\DiscordSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchIndex = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SearchIndex.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\StoreSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Vault\\StoreSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptSvc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\CryptSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\clrjit32 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\clrjit32.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\TokenSvc = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\TokenSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Common\\HostSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WmiHost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsvc32 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winsvc32.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiApSrv = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmiApSrv.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ElevSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\ElevSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\PSHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSHost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\FontCache.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\clrhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\clrhost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Network\\svchost.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcrt32 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvcrt32.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AutoDestBroker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutoDestBroker.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CrashSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\CrashSvc.exe\""	RemzzysCrosshair (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemCache = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RemzzysCrosshair (2).exe\""	RemzzysCrosshair (2).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3472	schtasks.exe
5200	schtasks.exe
3088	schtasks.exe
6672	schtasks.exe
3488	schtasks.exe
5848	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	Crosshair0.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	RemzzysCrosshair (2).exe
Token: SeDebugPrivilege	5132	RemzzysCrosshair (2).exe
Token: SeDebugPrivilege	5132	RemzzysCrosshair (2).exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1920	956	RemzzysCrosshair (2).exe	88
PID 956 wrote to memory of 3488	956	RemzzysCrosshair (2).exe	89
PID 956 wrote to memory of 2528	956	RemzzysCrosshair (2).exe	91
PID 956 wrote to memory of 5444	956	RemzzysCrosshair (2).exe	92
PID 956 wrote to memory of 1912	956	RemzzysCrosshair (2).exe	94
PID 956 wrote to memory of 4984	956	RemzzysCrosshair (2).exe	96
PID 956 wrote to memory of 4820	956	RemzzysCrosshair (2).exe	101
PID 956 wrote to memory of 3012	956	RemzzysCrosshair (2).exe	104
PID 5132 wrote to memory of 2608	5132	RemzzysCrosshair (2).exe	106
PID 956 wrote to memory of 3084	956	RemzzysCrosshair (2).exe	108
PID 5132 wrote to memory of 4656	5132	RemzzysCrosshair (2).exe	111
PID 956 wrote to memory of 4004	956	RemzzysCrosshair (2).exe	113
PID 956 wrote to memory of 2808	956	RemzzysCrosshair (2).exe	115
PID 956 wrote to memory of 1976	956	RemzzysCrosshair (2).exe	117
PID 956 wrote to memory of 5732	956	RemzzysCrosshair (2).exe	119
PID 956 wrote to memory of 5848	956	RemzzysCrosshair (2).exe	121
PID 956 wrote to memory of 1168	956	RemzzysCrosshair (2).exe	123
PID 956 wrote to memory of 3472	956	RemzzysCrosshair (2).exe	124
PID 956 wrote to memory of 3980	956	RemzzysCrosshair (2).exe	126
PID 956 wrote to memory of 5200	956	RemzzysCrosshair (2).exe	127
PID 956 wrote to memory of 4532	956	RemzzysCrosshair (2).exe	169
PID 956 wrote to memory of 3088	956	RemzzysCrosshair (2).exe	170
PID 956 wrote to memory of 6644	956	RemzzysCrosshair (2).exe	172
PID 956 wrote to memory of 6672	956	RemzzysCrosshair (2).exe	173
PID 956 wrote to memory of 6876	956	RemzzysCrosshair (2).exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1976	attrib.exe
5444	attrib.exe
4984	attrib.exe
3012	attrib.exe
2608	attrib.exe
4004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe
"C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Crosshair0.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Crosshair0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1920
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "WindowsSystemCacheWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCacheWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3488
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCacheWD.vbs"
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache.exe"
  2⤵
  - Views/modifies file attributes
  PID:5444
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache.exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:1912
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SearchIndex.exe"
  2⤵
  - Views/modifies file attributes
  PID:4984
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SearchIndex.exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:4820
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WmiHost.exe"
  2⤵
  - Views/modifies file attributes
  PID:3012
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WmiHost.exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:3084
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\FontCache.exe"
  2⤵
  - Views/modifies file attributes
  PID:4004
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\FontCache.exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:2808
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe"
  2⤵
  - Views/modifies file attributes
  PID:1976
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:5732
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "WindowsSystemCacheWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSystemCacheWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5848
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSystemCacheWD.vbs"
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "WmiCacheServiceWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WmiCacheServiceWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3472
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WmiCacheServiceWD.vbs"
  2⤵
  PID:3980
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "RuntimeBrokerSvcWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerSvcWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5200
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerSvcWD.vbs"
  2⤵
  PID:4532
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "TokenBrokerHostWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TokenBrokerHostWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3088
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TokenBrokerHostWD.vbs"
  2⤵
  PID:6644
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SearchIndexSvcWD" /TR "wscript.exe //B \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SearchIndexSvcWD.vbs\"" /SC ONLOGON /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6672
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SearchIndexSvcWD.vbs"
  2⤵
  PID:6876

C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe
"C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +R +S "C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe"
  2⤵
  - Views/modifies file attributes
  PID:2608
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Users\Admin\AppData\Local\Temp\RemzzysCrosshair (2).exe" /deny *S-1-1-0:(D,DC) /deny *S-1-5-32-544:(D,DC)
  2⤵
  - Modifies file permissions
  PID:4656

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crosshair0.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Crosshair0.exe
Size 2.2MB
SHA256 2f4a3c2114fb026fc82b44992ac0898188585f54c7df7da5a0a88e8f3a32597c
MD5 105fd7f32e64e59a8646bcf2b3806633
SHA1 cb8453459762dd609337d1e67eded3519b5b77fd
SHA512 509e3d9970658ed98d71b00854a031ff7791d773f09cae575d4afa96f60eb92613443ca84d275e942fbf9ebdea2af34b437c2c11397645457291beb15cc75a15
SSDEEP 49152:eIPiPBnivkL8YcJYd9NzH3MAXOc40UdjAWN3HZCwsGLwkEEAcO:HQwbJgPXOc40ePH/sqRbO
TLSH
T1BBB512C1F3E987E9D02AA1389586EB0BF9357C140B1146CB73D0586A6FE23E15EF7252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemCacheWD.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCacheWD.vbs
Size 499B
SHA256 8190df9384c302a7346f0038a6965744b95ea2a782b6117082d0f8925438672c
MD5 3f3caa902867af7235eceeed745e5121
SHA1 d9b5ef34370bb167a7e076f8c6729ac620689b62
SHA512 a1c8d209049ee92374213375dccbd06b2a434e6b580ec5036c6d14b745606287e68b26df1d5ba6f45ae1a27bbbd416c4835b21b84db2ae519c0ae2ac6b139bee
TLSH
T1FDF02739FC2AD26060F645162A7794257AE12D23F76A5D0DBE0DC4D8AF003F89035AAF
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsSystemCacheWD.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSystemCacheWD.vbs
Size 530B
SHA256 4b675cf20b81da16f9305121aa47aa997ee5bcdadae57b96bab7f24f85fffa92
MD5 b6729630fa5588fea30071a04c31bde9
SHA1 3c87c75d233420a4d25757968601681a4c7c6c30
SHA512 0df5fe1721312995a8cb9ae8d6333f8a91a7b9bde76fbe5c0986b2a9013651ec10664723de6a549ac0183e339ef5c0502a212ddd80f84fe7e81d8adf1532531a
TLSH
T1C2F05939FC2AD1B060FA41172A7BC42579E12D23E7265C09BE0CC5D8AF003F8907169F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-9-0x0000026F80000000-0x0000026F800D0000-memory.dmp

Download

memory/956-13-0x0000026F95780000-0x0000026F957D0000-memory.dmp

Download

memory/956-26-0x0000026F80470000-0x0000026F80490000-memory.dmp

Download

memory/956-5-0x0000026F91800000-0x0000026F91820000-memory.dmp

Download

memory/956-21-0x0000026F80100000-0x0000026F80130000-memory.dmp

Download

memory/956-36-0x0000026F806D0000-0x0000026F80710000-memory.dmp

Download

memory/956-45-0x0000026F80760000-0x0000026F80790000-memory.dmp

Download

memory/956-41-0x0000026F80890000-0x0000026F80990000-memory.dmp

Download

memory/956-49-0x0000026F82740000-0x0000026F82760000-memory.dmp

Download

memory/956-17-0x0000026F957D0000-0x0000026F957F0000-memory.dmp

Download

memory/956-2-0x0000026F94460000-0x0000026F950F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads