ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
Size 1.9MB
Sample260715-fxfcpsct6k
SHA256 ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762
MD5 94effb7d923cfab3cff6856d4e199dcb
SHA1 93fb0fdec312d5f1476b8a680d196bdcedc002ec
SHA512 fee708f1724907076e98a6db7d5174c65b9e60471eea0b0214e919277f5c236007afbe2a18e72b4327490cf364eec269092af3d192cff388084ec1fa80afd012
SSDEEP 49152:exXXm66O7Mr92ZT2X8OEaZKSEohy/SsDlMCsdbFqZ3:exHX7Mrc52XxEaZHEoMVDqvqt
TLSH
T1D095CF13B2CB653FF07E8A364977E212593BBA6165124C679BF8086CCF260D41E3F646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
3780	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
5100	MicrosoftPhotos.exe

Loads dropped DLL 2 IoCs

pid	Process
3780	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
2212	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	MicrosoftPhotos.exe
File opened (read-only)	\??\S:	MicrosoftPhotos.exe
File opened (read-only)	\??\X:	MicrosoftPhotos.exe
File opened (read-only)	\??\Y:	MicrosoftPhotos.exe
File opened (read-only)	\??\Z:	MicrosoftPhotos.exe
File opened (read-only)	\??\E:	MicrosoftPhotos.exe
File opened (read-only)	\??\K:	MicrosoftPhotos.exe
File opened (read-only)	\??\R:	MicrosoftPhotos.exe
File opened (read-only)	\??\H:	MicrosoftPhotos.exe
File opened (read-only)	\??\L:	MicrosoftPhotos.exe
File opened (read-only)	\??\N:	MicrosoftPhotos.exe
File opened (read-only)	\??\O:	MicrosoftPhotos.exe
File opened (read-only)	\??\T:	MicrosoftPhotos.exe
File opened (read-only)	\??\G:	MicrosoftPhotos.exe
File opened (read-only)	\??\I:	MicrosoftPhotos.exe
File opened (read-only)	\??\J:	MicrosoftPhotos.exe
File opened (read-only)	\??\P:	MicrosoftPhotos.exe
File opened (read-only)	\??\Q:	MicrosoftPhotos.exe
File opened (read-only)	\??\U:	MicrosoftPhotos.exe
File opened (read-only)	\??\V:	MicrosoftPhotos.exe
File opened (read-only)	\??\W:	MicrosoftPhotos.exe
File opened (read-only)	\??\B:	MicrosoftPhotos.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api64.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\u.bat	MicrosoftPhotos.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
3176	tasklist.exe
1804	tasklist.exe
1048	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3928	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4792-0-0x00000000009B0000-0x0000000000A88000-memory.dmp	innosetup
behavioral1/memory/4792-21-0x00000000009B0000-0x0000000000A88000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftPhotos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MicrosoftPhotos.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3752	timeout.exe
876	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3212	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3780	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
3780	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
5100	MicrosoftPhotos.exe
4788	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	1048	tasklist.exe
Token: SeDebugPrivilege	3176	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3780	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3780	4792	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe	84
PID 4408 wrote to memory of 2212	4408	rundll32.exe	87
PID 5100 wrote to memory of 4044	5100	MicrosoftPhotos.exe	89
PID 5100 wrote to memory of 2856	5100	MicrosoftPhotos.exe	103
PID 2856 wrote to memory of 784	2856	cmd.exe	105
PID 784 wrote to memory of 4284	784	net.exe	106
PID 2856 wrote to memory of 1780	2856	cmd.exe	107
PID 1780 wrote to memory of 3928	1780	cmd.exe	108
PID 1780 wrote to memory of 1592	1780	cmd.exe	110
PID 2856 wrote to memory of 4500	2856	cmd.exe	111
PID 2856 wrote to memory of 4788	2856	cmd.exe	113
PID 2856 wrote to memory of 3212	2856	cmd.exe	115
PID 2856 wrote to memory of 3892	2856	cmd.exe	116
PID 2856 wrote to memory of 4604	2856	cmd.exe	117
PID 2856 wrote to memory of 4740	2856	cmd.exe	118
PID 2856 wrote to memory of 3780	2856	cmd.exe	119
PID 2856 wrote to memory of 4380	2856	cmd.exe	120
PID 2856 wrote to memory of 648	2856	cmd.exe	122
PID 2856 wrote to memory of 1048	2856	cmd.exe	123
PID 2856 wrote to memory of 1612	2856	cmd.exe	124
PID 2856 wrote to memory of 1648	2856	cmd.exe	125
PID 2856 wrote to memory of 3752	2856	cmd.exe	126
PID 2856 wrote to memory of 3176	2856	cmd.exe	127
PID 2856 wrote to memory of 5016	2856	cmd.exe	128
PID 2856 wrote to memory of 4292	2856	cmd.exe	129
PID 2856 wrote to memory of 876	2856	cmd.exe	130
PID 2856 wrote to memory of 1804	2856	cmd.exe	131
PID 2856 wrote to memory of 1008	2856	cmd.exe	132
PID 2856 wrote to memory of 3084	2856	cmd.exe	133
PID 2856 wrote to memory of 5088	2856	cmd.exe	134
PID 2856 wrote to memory of 1720	2856	cmd.exe	135
PID 2856 wrote to memory of 3056	2856	cmd.exe	136
PID 2856 wrote to memory of 3948	2856	cmd.exe	137
PID 2856 wrote to memory of 512	2856	cmd.exe	138
PID 512 wrote to memory of 1136	512	wscript.exe	139
PID 512 wrote to memory of 4936	512	wscript.exe	141

C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
"C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\is-UKKVT.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UKKVT.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp" /SL5="$D0144,1003135,821760,C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\ProgramData\MicrosoftDevKit\619ad87d.dll,GXHzj9df
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\ProgramData\MicrosoftDevKit\619ad87d.dll,GXHzj9df
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2212

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn MicrosoftToolKit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c u.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc qc "MicrosoftPhotos" 2>nul | findstr /i "BINARY_PATH_NAME"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\sc.exe
      sc qc "MicrosoftPhotos"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "BINARY_PATH_NAME"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /query /tn "\MicrosoftDevKit" /xml
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$d=[xml](Get-Content 'C:\Users\Admin\AppData\Local\Temp\cf_task.xml'); $e=$d.Task.Actions.Exec; if($e){ $c=$e.Command; $a=$e.Arguments; if($c -and $a){ Write-Output ($c + ' ' + $a) } elseif($c){ Write-Output $c } elseif($a){ Write-Output $a } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundll32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "\MicrosoftToolKit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "\MicrosoftToolKit" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "MicrosoftToolKit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftToolKit" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "\MicrosoftDevKit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "MicrosoftDevKit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3752
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:876
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1008
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "\MicrosoftDevKit" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftDevKit" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "C:\ProgramData\MicrosoftDevKit\" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /b /c:"C:\Windows\"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Users\Admin\AppData\Local\Temp\del_10895.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\System32\u.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\del_10895.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:4652

C:\Windows\system32\taskhostw.exe
taskhostw.exe C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

619ad87d.dll

Path C:\ProgramData\MicrosoftDevKit\619ad87d.dll
Size 145KB
SHA256 21310bb28fc51ce12622c09f40d75fe28323da25c602710d261c80de9c507796
MD5 0a76b75502e626448e8b7de16e8abdb0
SHA1 b7a910b5b50a6c5ff759bd3f47dc9d59d9a1327f
SHA512 faf1bf70bd3741bf99ea5f714e1d6d62e65704a1ad214a56831615b8df027292174c698da7ab5ec863bf9538fbc0e476306a8a719be1424b7d57210a3a018e74
SSDEEP 3072:1UkDK10tNYU09IF1D6Ag6WxF6FXFHWDg2CIjyRf9QGwcnP6V:VDTtN7FtPWfxDg2VeNdPI
TLSH
T105E39D4178C1C072C97E19340AB9CF724B3D78505F789ECB67D85EBA9E306C09A35E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftPhotos.exe

Path C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
Size 96KB
SHA256 caacc3984c6379ab96506b418390384638dd42f5fb7a8d575ca2540977b6525a
MD5 d69f69b6703e9427d7db2bddc3ca4cb5
SHA1 c3fec05c09653288e883e2bb90d09749f93b53bb
SHA512 db668331f9b0d963c63491645037c5dd40d5e2157a7e1af9acc346ea581cdbc44e529c441296d2d9360d707e0e3623d3f84e228022f0724a5755361ee7cc614b
SSDEEP 1536:M75aCuMt8+MzrtPfSY7CIAuXSruoJZZ8NN9WZP3RFP8Mne/Kzt7ZSYJBDYbmg:SSzrYCCcSrfjZ4AnP8MnZzBnB2
TLSH
T175A3022BFA66CFBBF31698368A51D17D8A3063097B7670D7539982783D1B8F84633406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4e5bmipn.2pm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4e5bmipn.2pm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cf_task.xml

Path C:\Users\Admin\AppData\Local\Temp\cf_task.xml
Size 1KB
SHA256 611bf7be01f963118c6c35aa742c8f805dfefeb3cf5728e874a56e8914c1d591
MD5 985175aae3837611b2e4750fd28eca39
SHA1 3a73eb9d96f7ccc9289db08375122d9d350f7e8b
SHA512 d39b4d0fbfe89e0e535076f16f12f87f12f031c0fa73b792bf1a68eec3a5af7bbe0ca4ea0a44e3509f59ac8b79f765eded472c1af4973643dcd64dd7a1ace7c4
TLSH
T110211F49C843EA0B95772A1D37520601EF77A3CB8555746CF4CC4A382FBA9CF518316B
MD5 SHA1 SHA512 TLSH

Submit Download

del_10895.vbs

Path C:\Users\Admin\AppData\Local\Temp\del_10895.vbs
Size 234B
SHA256 305fc840aaeb51e1b2418c4522485425871ddf07a65848b0814ca6d7245e19cd
MD5 11aa5092344064bd24fb58072463b68f
SHA1 53a498fe760e4e2a2f2829209dcbc475123ec22e
SHA512 a7657346846c292395571448b8914c32aeb736bbd9ce1f3000a6c029dc178bf8f354909d4835d3149e56bec0b947f5cfcdc2d65c28c558ac5b65a4808242815d
TLSH
T1E2D0A719ED4EC574502981B24AB5C22D8AD8F4059936BE669684811CE10B0E56A627EA
MD5 SHA1 SHA512 TLSH

Submit Download

635a4fb0.dll

Path C:\Users\Admin\AppData\Local\Temp\is-1NCEL.tmp\635a4fb0.dll
Size 104KB
SHA256 872d4660ccb6873c624b35e0bedeb08a7947a884db695150284e9fdb441d5840
MD5 1f3e02683c29da8cd017c1f21777bf5d
SHA1 0a9b50ce9bc38eacd7360d1fdce9cc3d4bf4e54c
SHA512 ccbf06e53a58056e056b93ebf4ac5e8adda75bbac1ed6f01248fe2aea2c8434798ae9f5ca6764000c33a39ce4ef9b1cb188e43f88d54806c90ac5a6dc2f419aa
SSDEEP 3072:rDVEIZ1h0QcfY20XVTb4sCJFFH7O8Z6t//T4JI5sA:rDVHZj0QcgblzAFhym6sA
TLSH
T18BA37B41B580C073D5EE163E89788B799B3FA810DF619DDB33545ABE0E342D19E31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-UKKVT.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
Size 3.3MB
SHA256 174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013
MD5 6b43973e1b89f2be3703919ccb9913dc
SHA1 c8eb439107a299e57e150f09c76dda98a0f29381
SHA512 97faffd1588384e8fcafbba0251167de8efa1e25e818aef0e28d8e8395fe21a55a76bdf8a23d5510cd0f02d2ed7516164b963d6432dbaea9442f0dfaa49d1c91
SSDEEP 49152:cDwGHAkqMu7Ht6SCiGognuzsDaarpQAB1KkX/q52guQk3332C:cMGdPvuzEVTBoPdur3339
TLSH
T143F55C23F24D693ED05B3E3D673792A4987B76602D128C57A7EC3A4C4F391812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 5518329bcdbd4e45a31443d2735c72162abe51740a32880bd9d99c7a9d4ba321
MD5 4afdf382b6a9008a241391f06c8e78ee
SHA1 de91f6ea4119039f08eee404191365e06eb52d82
SHA512 69b39743010347a7ee0882d35ef016db066b805e73d2dcea6ac72f6a9765809e60f914f6f0348c55b7e27d5e4ccc78b2cb055482a24703a843b4371ca83626b8
TLSH
T176A002614559AC256189A28428226440A559464260056AD8305D6C041796B5543D5880
MD5 SHA1 SHA512 TLSH

Submit Download

u.bat

Path C:\Windows\SysWOW64\u.bat
Size 5KB
SHA256 db136e719b0e0f8542265802d648eab897868daa4a0f7bad806c23b28325feac
MD5 ce85775fe604eb68442d6bd9aa77f84a
SHA1 f4741be84b76eba60d05abc73c57717b90bae576
SHA512 24e00ad9a421befe3814ac4b406f5ae70bc9d4c79b104bd9142e34cdfdbaf8ad222349d10db9399d0d4ac2f95d30260b1014fd4829537b2d1a8ea24a3b52e11e
SSDEEP 96:xGhu22BqgRwVnHUvqpuKHYJyfE9nfzWmH3VUflTRYI6npgnp+TWiOrxNeVbhVenh:xe24gRwyvqpuKHYCE9fKmX2tdYPp0pUY
TLSH
T1C3B1DF1F2C05981213B1C7F0A6DB240BE7EE81B70F25E9D9318194B43B6E21652EE3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3780-5-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/3780-19-0x0000000000DF0000-0x0000000001154000-memory.dmp

Download

memory/4788-52-0x0000000006990000-0x00000000069AA000-memory.dmp

Download

memory/4788-51-0x0000000007440000-0x00000000074D6000-memory.dmp

Download

memory/4788-38-0x00000000054D0000-0x00000000054F2000-memory.dmp

Download

memory/4788-39-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/4788-40-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/4788-36-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Download

memory/4788-48-0x0000000006050000-0x00000000063A4000-memory.dmp

Download

memory/4788-49-0x0000000006490000-0x00000000064AE000-memory.dmp

Download

memory/4788-50-0x00000000064B0000-0x00000000064FC000-memory.dmp

Download

memory/4788-37-0x0000000005670000-0x0000000005C98000-memory.dmp

Download

memory/4788-56-0x0000000008710000-0x0000000008D8A000-memory.dmp

Download

memory/4788-53-0x00000000069F0000-0x0000000006A12000-memory.dmp

Download

memory/4788-54-0x0000000007AE0000-0x0000000008084000-memory.dmp

Download

memory/4792-0-0x00000000009B0000-0x0000000000A88000-memory.dmp

Download

memory/4792-21-0x00000000009B0000-0x0000000000A88000-memory.dmp

Download

memory/5100-23-0x0000000010000000-0x0000000010158000-memory.dmp

Download

memory/5100-20-0x0000000002330000-0x0000000002352000-memory.dmp

Download