5d84655ea6e30ea07b44704f48cf5320c62deabba05ba6f55b40dc1eb8687e17

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 37.0MB
Sample261001-n4mpcs1fpg
SHA256 5d84655ea6e30ea07b44704f48cf5320c62deabba05ba6f55b40dc1eb8687e17
MD5 7634d70aa736529e94187fde85a49f80
SHA1 a269b51044d22c8bdae2254d4868a8f67a78c0d1
SHA512 d810883c9321baa5cbe181919419b320791b6c8033fcc1faa14682df10795aa9b397bf7eb67f5dbda114ffc65348019b886bff43cb977fa3738f2dbef245fd66
SSDEEP 786432:jx3la1iv2i4/tvMBeq5rqItX3cs7FJILMXWHZrGUI+c5MRM/U:VViC4uBjrqiVQQsXc56M/U
TLSH
T1EF8733A063FC59F9C2B67A308C16491BE77BB00507B8CA4E47A898670FA37415E7DB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
2420	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio system.lnk	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3788	ntrights.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3364	icacls.exe
4340	icacls.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2984	powercfg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
856	WScript.exe
3576	WScript.exe
60	WScript.exe
2320	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5024	cmd.exe
4936	cmd.exe
3476	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntrights.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4452	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4452	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1508	schtasks.exe
4312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2420	powershell.exe
2420	powershell.exe
2712	powershell.exe
2712	powershell.exe
3328	tskill.exe
3328	tskill.exe
4976	tskill.exe
4976	tskill.exe
3656	tskill.exe
3656	tskill.exe
1368	tskill.exe
1368	tskill.exe
2508	tskill.exe
2508	tskill.exe
3128	tskill.exe
3128	tskill.exe
1900	tskill.exe
1900	tskill.exe
2164	tskill.exe
2164	tskill.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2984	powercfg.exe
Token: SeCreatePagefilePrivilege	2984	powercfg.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	4004	WMIC.exe
Token: SeSecurityPrivilege	4004	WMIC.exe
Token: SeTakeOwnershipPrivilege	4004	WMIC.exe
Token: SeLoadDriverPrivilege	4004	WMIC.exe
Token: SeSystemProfilePrivilege	4004	WMIC.exe
Token: SeSystemtimePrivilege	4004	WMIC.exe
Token: SeProfSingleProcessPrivilege	4004	WMIC.exe
Token: SeIncBasePriorityPrivilege	4004	WMIC.exe
Token: SeCreatePagefilePrivilege	4004	WMIC.exe
Token: SeBackupPrivilege	4004	WMIC.exe
Token: SeRestorePrivilege	4004	WMIC.exe
Token: SeShutdownPrivilege	4004	WMIC.exe
Token: SeDebugPrivilege	4004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4004	WMIC.exe
Token: SeRemoteShutdownPrivilege	4004	WMIC.exe
Token: SeUndockPrivilege	4004	WMIC.exe
Token: SeManageVolumePrivilege	4004	WMIC.exe
Token: 33	4004	WMIC.exe
Token: 34	4004	WMIC.exe
Token: 35	4004	WMIC.exe
Token: 36	4004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4004	WMIC.exe
Token: SeSecurityPrivilege	4004	WMIC.exe
Token: SeTakeOwnershipPrivilege	4004	WMIC.exe
Token: SeLoadDriverPrivilege	4004	WMIC.exe
Token: SeSystemProfilePrivilege	4004	WMIC.exe
Token: SeSystemtimePrivilege	4004	WMIC.exe
Token: SeProfSingleProcessPrivilege	4004	WMIC.exe
Token: SeIncBasePriorityPrivilege	4004	WMIC.exe
Token: SeCreatePagefilePrivilege	4004	WMIC.exe
Token: SeBackupPrivilege	4004	WMIC.exe
Token: SeRestorePrivilege	4004	WMIC.exe
Token: SeShutdownPrivilege	4004	WMIC.exe
Token: SeDebugPrivilege	4004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4004	WMIC.exe
Token: SeRemoteShutdownPrivilege	4004	WMIC.exe
Token: SeUndockPrivilege	4004	WMIC.exe
Token: SeManageVolumePrivilege	4004	WMIC.exe
Token: 33	4004	WMIC.exe
Token: 34	4004	WMIC.exe
Token: 35	4004	WMIC.exe
Token: 36	4004	WMIC.exe
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 60	4908	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe	86
PID 4908 wrote to memory of 2320	4908	2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe	87
PID 60 wrote to memory of 5024	60	WScript.exe	88
PID 5024 wrote to memory of 3788	5024	cmd.exe	126
PID 5024 wrote to memory of 2984	5024	cmd.exe	91
PID 5024 wrote to memory of 4312	5024	cmd.exe	92
PID 5024 wrote to memory of 2420	5024	cmd.exe	94
PID 3576 wrote to memory of 4936	3576	WScript.exe	101
PID 5024 wrote to memory of 2460	5024	cmd.exe	105
PID 5024 wrote to memory of 2804	5024	cmd.exe	106
PID 5024 wrote to memory of 3364	5024	cmd.exe	107
PID 5024 wrote to memory of 4340	5024	cmd.exe	108
PID 5024 wrote to memory of 3476	5024	cmd.exe	109
PID 3476 wrote to memory of 4004	3476	cmd.exe	110
PID 3476 wrote to memory of 1744	3476	cmd.exe	111
PID 5024 wrote to memory of 2712	5024	cmd.exe	114
PID 5024 wrote to memory of 1508	5024	cmd.exe	115
PID 5024 wrote to memory of 3328	5024	cmd.exe	117
PID 5024 wrote to memory of 4976	5024	cmd.exe	118
PID 5024 wrote to memory of 3656	5024	cmd.exe	119
PID 5024 wrote to memory of 1368	5024	cmd.exe	120
PID 5024 wrote to memory of 2508	5024	cmd.exe	121
PID 5024 wrote to memory of 3128	5024	cmd.exe	122
PID 5024 wrote to memory of 1900	5024	cmd.exe	123
PID 5024 wrote to memory of 2164	5024	cmd.exe	124
PID 5024 wrote to memory of 4452	5024	cmd.exe	125
PID 5024 wrote to memory of 1576	5024	cmd.exe	139
PID 5024 wrote to memory of 1132	5024	cmd.exe	140
PID 5024 wrote to memory of 3464	5024	cmd.exe	141
PID 5024 wrote to memory of 1144	5024	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2460	attrib.exe
2804	attrib.exe
1576	attrib.exe
1132	attrib.exe
3464	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_7634d70aa736529e94187fde85a49f80_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Security\unistall.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k unistall.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Security\ntrights.exe
      ntrights -u Admin +r SeLockMemoryPrivilege
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3788
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "repair network services" /sc onstart /delay 0000:50 /RL HIGHEST /RU system /tr "C:\updat\downtrj.vbs" /NP /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Security,C:\Users\Admin\AppData\Roaming,C:\updat,C:\Netframework.4.7"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\system32\attrib.exe
      attrib +H system.bat
      4⤵
      Views/modifies file attributes
      PID:2460
  - - C:\Windows\system32\attrib.exe
      attrib +H system.vbs
      4⤵
      Views/modifies file attributes
      PID:2804
  - - C:\Windows\system32\icacls.exe
      icacls C:\Security\system.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:3364
  - - C:\Windows\system32\icacls.exe
      icacls C:\Security\system.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic path win32_useraccount where name='Admin' get sid /value | find /i "SID"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_useraccount where name='Admin' get sid /value
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
    - - C:\Windows\system32\find.exe
        
        find /i "SID"
        5⤵
        
        PID:1744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(gc C:\Security\system.xml) -replace '22', 'S-1-5-21-939655444-3071939294-1401108526-1000 ' | Out-File -encoding ASCII C:\Security\system.xml"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2712
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "audio system" /XML "C:\Security\system.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1508
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3328
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4976
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3656
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1368
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2508
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3128
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1900
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2164
  - - C:\Windows\system32\PING.EXE
      ping -n 50 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4452
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Netframework.4.7\audio.exe
      4⤵
      Views/modifies file attributes
      PID:1576
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Netframework.4.7
      4⤵
      Views/modifies file attributes
      PID:1132
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Security
      4⤵
      Views/modifies file attributes
      PID:3464
  - - C:\Windows\system32\cmd.exe
      cmd /c del "C:\Security\unistall.bat"
      4⤵
      PID:1144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Security\audio.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\updat\downtrj.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
PID:856

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Security\system.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k system.bat
  2⤵
  - Executes a command shell one-liner
  PID:4936

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7za.dll

Path C:\Security\7za.dll
Size 263KB
SHA256 bd377ba96ff8d3cbaea98190c8a60f32dc9d64dd44eed9aade05d3a74d935701
MD5 3107caecf7ec7a7ce12d05f9c3ab078f
SHA1 b72ac571efde591906771b45bed5b7dc568d7b08
SHA512 e5f7bceb39975bc77de3d118ab17aed0f2bd5df12dbbcad5a355c34d71dff883a482b377e4b98622ccc3ba48649ba3330d3bb0bac7f9f2e861d9af0c10d1637e
SSDEEP 6144:ZNnwY0ozR5spzvSrnHefQOWdFQJvUhq36F:ZGY0YR5VrnHefgd6JvUe6F
TLSH
T12F449E2177FAC0F5C9872230961DBBBA95FAA3491B10C8C36380DE5A6E375E6D23D50D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Security\7za.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zxa.dll

Path C:\Security\7zxa.dll
Size 155KB
SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
MD5 786d4c74c05832a652be5c0a559be1e6
SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
TLSH
T100F3AE2177BA80F9D24B32359A1D7FBA12BDE3484F1485C76700EE5A2E319D5E23D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Audio system.bat

Path C:\Security\Audio system.bat
Size 757B
SHA256 016a66afda31fcf7adf1a4b83f66e514fd204b14294fe1d8f0d0094a90484da7
MD5 70c0f67a93d3e8fe6a6bb390661920e2
SHA1 c26a1bfc9621f23ea9bbaf4abe690d8016bb3fc4
SHA512 0a6597059794d9fd64782d7691031639cf8bac186ed529747a7948d14298915a617d97e1c4506aab88f262dca31af72c4c8bec7c69810edb9247027a48a689f4
TLSH
T17A01650D9881BC238DFB236571F1120D77B0E640565E83D5310BC7C7D7C7A357112691
MD5 SHA1 SHA512 TLSH

Submit Download

Audio system.vbs

Path C:\Security\Audio system.vbs
Size 144B
SHA256 77db2c4dacd8c4c488187a3c875b14c2ac08e2face54cba96d9b55ae5ff84949
MD5 4d9c46f92d8c7007e77c7005fb3367be
SHA1 25dc4f4fc5df855e756ad74b725fba823fa715e5
SHA512 440dcb95298a8f4946d6d9b03858bd39e894054d5731af8ec8be51e7fd32cb4425a51d6a6c8bba9445d2b6c79e830c800fa78a1faa8d2be4b2135be48d8b72ff
TLSH
T1C6C09B1D9D3CD655D9ADC3E177F05119D79CEB535037EC28165554C543209501321773
MD5 SHA1 SHA512 TLSH

Submit Download

WinIo64.sys

Path C:\Security\WinIo64.sys
Size 15KB
SHA256 7fa19d4b2b160ca3f2decde3d7c7d867527c96f3511a9dbecc898cfc14614638
MD5 97373d38bdd890a2f1224c7d1586db91
SHA1 013651321c499fa331b0c62b2a981027c5dd112b
SHA512 dd9e1d6092ae9297541ac92330f162b8a18dfabda7a616e3305403366827da2b496a8c5fcc2cca46d24ace2aa9a46e9afd674ea9b6da457d055dd4fdae29231f
SSDEEP 384:IX4Pi8McCo0HOk8JHZV+2s8j+JiRXZfdUb+3nAK:KUC7eHZV+PC+qQi3nAK
TLSH
T10D623B9A4E2F9486DB03DE7D90C98663FC70F5C26BAC15E79126C4256D067E07FBC208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Security\WinRing0x64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audio.vbs

Path C:\Security\audio.vbs
Size 1KB
SHA256 701e815a8a6f2c45e773ecfddbfb74570e6c55a3a6b8945a69206bf6cfd33d5b
MD5 1a4135b2b582f6ec8f5dec0f858420ce
SHA1 ae83505ce5024a650b553ef5fba402526c67704c
SHA512 ff6d384bafedc6acd938cfc1c11d1ee317d61f6968b2886d072b232afc29255e198723247c7819c8459b8fbcd8318d9bf2f5b45e74c3d8b4e5c0104f8451e043
TLSH
T17E219BC9E8289090599316D150F6DC08C3E2AB902823D824776FCE4D776066C0F799AA
MD5 SHA1 SHA512 TLSH

Submit Download

downtrj.bat

Path C:\Security\downtrj.bat
Size 129B
SHA256 9a0b954917610e19011081a0da7c85f959067bd58051888db9189290fa05864a
MD5 7b62c20559056bcc528571404dac4f8a
SHA1 b31ed3b96ef0332f5e8967e2a169a6b44665a79a
SHA512 9840b8a5487902fa1e488b82d2cd7c5333d9056a17b1e19ab54954a00fb88525d21a0955447a66d696338fe9615be677bfd52331a0d742b160c1e487220e65db
TLSH
T1DAB092614983D5A698701DE8B91A5016A95E009D11908CC0A6C40361680A5DC9D87D7C
MD5 SHA1 SHA512 TLSH

Submit Download

downtrj.vbs

Path C:\Security\downtrj.vbs
Size 1KB
SHA256 2bbb9daba9bd31596e3c935f9382d54912f75b5510096962ffe942bfe8b7aa77
MD5 1cf7366cf75d563fc2bcbb5f2743799f
SHA1 e740fdfda7fb7390418048a3babc43c99bacee97
SHA512 169d1a65cac930dc58c220129f18a4435ca31b9e02fa24631b47a1e20151d2e944cd8cae71fc8d7da6a80cddef6db1e97e8ae1bc6f9269daffa5330ad3104546
TLSH
T1FA217F1353FA4104F5F22794AD3609750B37BE66B479C64D06C8191E2BF3B4494A1BA7
MD5 SHA1 SHA512 TLSH

Submit Download

gtservices.exe

Path C:\Security\gtservices.exe
Size 36.1MB
SHA256 d945860b6e61d37baa3acfb8e329a8af957cb694f3680f4ae16afc85d00e9790
MD5 1cfd2ea4e13409e77ba90e480960bb75
SHA1 e5896bb610b0adfd8c0b91fddf802c9b94b35cc1
SHA512 163f208bd193a3439006fc40c2b1f88b5dcda6beddd6019912585b98030b5a8e78a1f4078a36f615cac4d3c7c42f655a9bb1ae0d7827c73749247eaed78ab9b5
SSDEEP 786432:zHf94O156lz3uA06ekXSLPLBc07xDmta+RFxBjJM:zHl156lNeVzigD4X9jJ
TLSH
T17E8733BD10F2D323D00B2DF6350E8A8908AE352F92DADE50635564BCBE632BCF55664D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mouse.bat

Path C:\Security\mouse.bat
Size 15KB
SHA256 e7def58a604a5941fec7006b4b926e761ec2dd06d04386a17a6814193b5db3d4
MD5 b419188db097f8b8ea8ad5f70c6f84d2
SHA1 dc2a3e3be04488a101816f30cd6a6ed3d50a4ef5
SHA512 7114e3245f63d7e915117e95fa08b8c711af2ad05d11c70ee64c625fc3c7f95b0581611ca7320695987a89ece45360fe9cc1e385aad58f63e4cbed5df6117d44
SSDEEP 384:f4NGxujgMItZWx3fxdkpWeF56o96dZmHb4yEx66eA3qR:f41jYtTpnH6o96dZm74yEI5
TLSH
T16A62102C094A922749B3736DBFDA449BFA3B453327E66B5174BD02605F364290360FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrights.exe

Path C:\Security\ntrights.exe
Size 31KB
SHA256 f46baa1b6227226518e42263e9b4808f81c27d060207df160f9ac64deae4f4f5
MD5 416c43aeb17252ee33048bd1f277d2a5
SHA1 085deb77551f9f6201e5aa352b62cad91c3005e5
SHA512 3155de3fb04f1df246d6cecfa1c89f8ae9963c18be1ce717731ff210ab39d537be01231002a54d4346b4116e3505f387c92dfecc18a80ce7eb99c6d33e5f1f2a
SSDEEP 384:V2xoEQ1hlwZ1GADuwSoDFJqawj0zIjiOURFtk+bn7c/bAxi1I2Y8AVq65zHwP9TG:+l6pGXtk+D7c/N1I2Cq65z60sl
TLSH
T1A5E27C11B0E5817FF0D356B456B707255B77B85003B26B8F0B9814ABAB726C0AB3B353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.bat

Path C:\Security\system.bat
Size 972B
SHA256 34ba5f9a6c0a15e3a20686869f79d5398bbcd8dcf5cd6dfe584578b37471bafe
MD5 0821ae42c1cdaa32aa63de00c7df25cc
SHA1 c5472a540b90b04654cb2aab60bdff7266cb859a
SHA512 a5a8124fb0a0cf496985ca1c02eb28a184bf8ecb2b6e900cf4441f3157d6b5bb2de73419c506ce1be6232e689cde4f55bf0d0ef7d1f1b05cd903e8ebbf52a169
TLSH
T1C111885DCD42E9378E770E55274563095FB4C483817F561930F507A6D707968A1728C5
MD5 SHA1 SHA512 TLSH

Submit Download

system.vbs

Path C:\Security\system.vbs
Size 75B
SHA256 f1693021ac9058a21c7c2836f38aa4c3e35c34cacb61ecbe6844ea46d3222a08
MD5 41e008fa98c4431c4cebea068fc38d05
SHA1 a426198b57ba7ef10094d67d348e7f744b3e0a75
SHA512 f8f1c3ec43660805d891f37b7c67608e3a6c156375641e46a3bab3b71aef84a157ec82b334ecddfd22345a6ddc8ee8f3b07bfcf16dd5baa7eec9d26d6a33d06f
TLSH
T1B9A0223A220CC88B0C0320EAA0B280088AB0FF022232AC2208C8CCC8E3208C08B320C3
MD5 SHA1 SHA512 TLSH

Submit Download

system.xml

Path C:\Security\system.xml
Size 1KB
SHA256 d090327d48e5d2d9e7ea2a1ae241c8df68a0e356769abcf019056c394783cfdd
MD5 bc0afaf911a2b931a6412825c28989a4
SHA1 22fed379e8388ec415e9374fea6d2afface4c5ba
SHA512 e5c088ee1de134fd555ba39132b6b05386f6cb4b590fed906c8ab9f9ce57f05e2907dfbde19bd6d62ccc7f89a47323e9f665c79896144fe9d4845e0ac24f07ac
TLSH
T12C310068ACC0B71B76724529A7025B82DF6687E306534138F8CC4BBB2FB5145615397B
MD5 SHA1 SHA512 TLSH

Submit Download

system.xml

Path C:\Security\system.xml
Size 1KB
SHA256 7019b2fe5b7ae366d6a0a67244cb70cf1adf813c1e4ef182cba6926fa7703caf
MD5 184edff31eb40083c5bf0fad0bb82b95
SHA1 70c5335029511ad252ffe0b4ddd951b408fe97cd
SHA512 f7528d6e50659f103dbd33d13885d9eb6246cedce45c048a893a06ac3e3e133284906a225cc35d070f8f48c4bd50896802734a6d276850d53f63b782f226c5dd
TLSH
T1D7311F68ECC0B31B7672453AA7025B82DF2A93E746534038F8CC4BBB2FB6545615397B
MD5 SHA1 SHA512 TLSH

Submit Download

unistall.bat

Path C:\Security\unistall.bat
Size 2KB
SHA256 b493e5c4630261ff199bdf4848648e6a8d45b22a6afa10034d74a603e95d22d6
MD5 7b76e3c707764d45bcdb5abc9d7ca376
SHA1 6e1aafeb548b8ec04ea2655fc5ce6006e59e195b
SHA512 3ff16be48219fac0b2cbf6d6b200e2a106b25967bd4715bdf53e825fb53d7556489409f0ac576d9056f92e2449db353b2aaf3c8e8288fb0c35daf83135ee368a
TLSH
T15B41DF1A0ECF64A68EB01FC426A3461FAF5EAF85D4521D447BD700A9F8429CCE251F7A
MD5 SHA1 SHA512 TLSH

Submit Download

unistall.vbs

Path C:\Security\unistall.vbs
Size 79B
SHA256 ffd8e49aebf15ac2ead62900000d22e7f4289d9a665204553aec17ec1b14fbe0
MD5 d7190306fcb959c473b8639196861980
SHA1 cb4a7f4910eefb8a9b529b2b5ccff93ab4b05aed
SHA512 acb3f43bea77a1ca3cd278ca88a3fdb6b290572c8bf4fe06660c0ddeefd388bb67e7c1b8fe1dcee824ff838dcdbae54e50f86439a7d1af84b325ff7dd3458747
TLSH
T1AEA02435F00CC4734CC713D14031410C44F0FD01113074504D40CCCC73144C04315043
MD5 SHA1 SHA512 TLSH

Submit Download

wget.vbs

Path C:\Security\wget.vbs
Size 2KB
SHA256 abd498d8a265116de034a8cbc7c2fc40a312dfe5b2c4161bd46cbaa93d187ed2
MD5 35e0cf9358aecb9039b0e6849627dcd1
SHA1 a96667d05a46cf85fb26fb07a4943f17359440ac
SHA512 3b07e52ba577792b9497d19c38a0f967f80ab65287559f0a6cf2ba1f37ef60aa98d0609459b7635364131cdd91ace0e5ac236044279118e2e0c5b46c580d8b46
TLSH
T1E351945323F89104B1F77E559AB669754737BFB5A8B9C70E00C40A0D1AE1E508CA5BF3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 df0d9b2a6f0538cdf02e7f2a69db35dbf92a48fb81fcf58c12f1f0ad2ea13fe2
MD5 16e669660431a76b6985bae6a3e0ca0f
SHA1 55aead2478e085cc4fa52035dc6d3e9ceb856485
SHA512 ba3a159eca907f8cd6bce2a66b334250e1c6a3b60f14e2cd1ab8dbd0baf33b7b385d834ed1aa3ccb013711cbaf7607d51e7107f1f1783f46595a99a15d5a7d2a
TLSH
T11F112223F38D8920CC96163A509DAC5172B586CB81AEDF9F7FC0C211A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h0i4fjv3.5oh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h0i4fjv3.5oh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2420-73-0x000001EC77890000-0x000001EC778B2000-memory.dmp

Download