b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b

Analysis

user interaction
yes
max time kernel
19s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Size 406KB
Sample260827-trnc1swzhy
SHA256 b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b
MD5 e9e6e925876eb3bb02f09cfc1965aacc
SHA1 c8905cffc8022087a47343197fe8153089cbd6d7
SHA512 d4fa5be81f2cae769119191f77e6da3f79004f7d62a1822d7ce34a100ba7af04290a5647efaa9400da3d7d87964d19a78e8573c488fb11334d0b0bf954220974
SSDEEP 6144:KiXU4/N1hEcaiQ+GTWH/obazxU95VGYT9T:KikYbWcaivGTjV959T
TLSH
T1ED947D82B7C66DD9D2158A3589EF83293738F5E11A439F1B093472350D23AD0FE97A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion execution persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winresume.efi	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\bootsect.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\ntkrnlmp.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\Boot\winload.efi	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\bootsuppl.dll	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\driver.stl	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\winload.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\winresume.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\bootmgfw.efi	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\Boot\winload.exe	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
File opened for modification	C:\Windows\System32\winload.efi	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4072	cmd.exe
4088	cmd.exe
5328	cmd.exe
5324	cmd.exe
3452	cmd.exe
5912	cmd.exe
5588	cmd.exe
5584	cmd.exe
1384	cmd.exe
4136	cmd.exe
3668	cmd.exe
4528	cmd.exe
3812	cmd.exe
5788	cmd.exe
3748	cmd.exe
4996	cmd.exe
6004	cmd.exe
4916	cmd.exe
3468	cmd.exe
3464	cmd.exe
6052	cmd.exe
2672	cmd.exe
1968	cmd.exe
4132	cmd.exe
1316	cmd.exe
1488	cmd.exe
380	cmd.exe
808	cmd.exe
4064	cmd.exe
5172	cmd.exe
2532	cmd.exe
3500	cmd.exe
5300	cmd.exe
368	cmd.exe
5072	cmd.exe
3408	cmd.exe
1712	cmd.exe
6108	cmd.exe
4392	cmd.exe
5704	cmd.exe
4084	cmd.exe
2524	cmd.exe
1760	cmd.exe
3704	cmd.exe
5048	cmd.exe
4848	cmd.exe
4992	cmd.exe
6140	cmd.exe
5668	cmd.exe
1792	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000000000000000000007df099de0000000000000000000000000000000000000000000000000000000000000000	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
Token: SeSystemtimePrivilege	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4132	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	88
PID 3184 wrote to memory of 368	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	90
PID 3184 wrote to memory of 1384	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	92
PID 3184 wrote to memory of 5704	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	94
PID 3184 wrote to memory of 5048	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	96
PID 3184 wrote to memory of 4848	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	98
PID 3184 wrote to memory of 6004	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	100
PID 3184 wrote to memory of 4136	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	102
PID 3184 wrote to memory of 4992	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	104
PID 3184 wrote to memory of 4072	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	106
PID 3184 wrote to memory of 3704	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	108
PID 3184 wrote to memory of 4088	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	113
PID 3184 wrote to memory of 5328	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	115
PID 3184 wrote to memory of 5324	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	117
PID 3184 wrote to memory of 4916	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	119
PID 3184 wrote to memory of 6140	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	121
PID 3184 wrote to memory of 3452	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	123
PID 3184 wrote to memory of 3468	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	125
PID 3184 wrote to memory of 4084	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	127
PID 3184 wrote to memory of 3668	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	129
PID 3184 wrote to memory of 5912	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	131
PID 3184 wrote to memory of 5668	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	133
PID 3184 wrote to memory of 5072	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	135
PID 3184 wrote to memory of 5588	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	137
PID 3184 wrote to memory of 5584	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	139
PID 3184 wrote to memory of 3408	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	141
PID 3184 wrote to memory of 3500	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	143
PID 3184 wrote to memory of 5300	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	145
PID 3184 wrote to memory of 1316	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	147
PID 3184 wrote to memory of 3464	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	149
PID 3184 wrote to memory of 4528	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	151
PID 3184 wrote to memory of 6052	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	153
PID 3184 wrote to memory of 1712	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	155
PID 3184 wrote to memory of 1488	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	157
PID 3184 wrote to memory of 3812	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	159
PID 3184 wrote to memory of 5788	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	161
PID 3184 wrote to memory of 2672	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	163
PID 3184 wrote to memory of 3748	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	165
PID 3184 wrote to memory of 380	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	167
PID 3184 wrote to memory of 6108	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	169
PID 3184 wrote to memory of 808	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	171
PID 3184 wrote to memory of 4392	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	173
PID 3184 wrote to memory of 2524	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	175
PID 3184 wrote to memory of 4996	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	177
PID 3184 wrote to memory of 4064	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	179
PID 3184 wrote to memory of 1792	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	181
PID 3184 wrote to memory of 1968	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	183
PID 3184 wrote to memory of 5172	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	185
PID 3184 wrote to memory of 2532	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	187
PID 3184 wrote to memory of 1760	3184	b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe	189

C:\Users\Admin\AppData\Local\Temp\b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe
"C:\Users\Admin\AppData\Local\Temp\b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:1384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:6004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c A
  2⤵
  - Executes a command shell one-liner
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:4992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c H
  2⤵
  - Executes a command shell one-liner
  PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:5324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:6140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:1316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:6052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:1712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:3812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:4064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:1968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:2532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  - Executes a command shell one-liner
  PID:1760

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv 4k1degRCLk6Ilzs7zDHrSw.0
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3184-0-0x00007FF653560000-0x00007FF6535BE000-memory.dmp

Download

memory/3184-21-0x00007FFB39100000-0x00007FFB3910C000-memory.dmp

Download

memory/3184-18-0x00007FFB39110000-0x00007FFB39128000-memory.dmp

Download

memory/3184-17-0x00007FFB3B110000-0x00007FFB3B140000-memory.dmp

Download

memory/3184-10-0x00007FFB39BA0000-0x00007FFB39BC2000-memory.dmp

Download

memory/3184-9-0x00007FFB3A4D0000-0x00007FFB3A4FB000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads