3c0d1a07b6e4164588a5cda78a77e574663e810736802ad4caaa0ae6244ec51f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Size 15.1MB
Sample261030-e3lk8swt8p
SHA256 3c0d1a07b6e4164588a5cda78a77e574663e810736802ad4caaa0ae6244ec51f
MD5 b6045afbf4b6ff62d0428bf92f872d41
SHA1 861a91f8bd5fd7190d13a833241eb5271481ff25
SHA512 54c84080344468c873c3086af5e03726e3b833f29ea0508ccadbccf4e76ad4102356e083c34b7c29d503b7431c72bdb3c101e457d2eb1adf20772a07a46e631d
SSDEEP 393216:x2hmUhp2U7rKN53cv7f+z4ShyxegIJFfoBti:xYcvRS7+zryxeg4Ffgs
TLSH
T1D3F6230576A624BDC05AC4B0835285539E6134CB1FB5BAEF0DE4E22D3FBA9F41F39624
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3760 created 3308	3760	elevation_service.exe	56

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1464	attrib.exe
4932	attrib.exe

Executes dropped EXE 6 IoCs

pid	Process
1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
5076	Trapshydration1653.exe
4592	Trapshydration1653.exe
116	Trapshydration1653.exe
1680	Trapshydration1653.exe
3672	Trapshydration1653.exe

Loads dropped DLL 5 IoCs

pid	Process
5076	Trapshydration1653.exe
4592	Trapshydration1653.exe
116	Trapshydration1653.exe
1680	Trapshydration1653.exe
3672	Trapshydration1653.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1676	icacls.exe
3896	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
524	cmd.exe
1200	cmd.exe
1104	cmd.exe
2884	cmd.exe
3624	cmd.exe
4236	cmd.exe
4652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3540-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral1/memory/3540-60-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	229	Go-http-client/1.1
HTTP User-Agent header	112	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4592	taskkill.exe
1040	taskkill.exe
4344	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
5076	Trapshydration1653.exe
5076	Trapshydration1653.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
4612	waitfor.exe
4612	waitfor.exe
3760	elevation_service.exe
3760	elevation_service.exe
4612	waitfor.exe
4612	waitfor.exe
116	Trapshydration1653.exe
116	Trapshydration1653.exe
1680	Trapshydration1653.exe
1680	Trapshydration1653.exe
4612	waitfor.exe
4612	waitfor.exe
3672	Trapshydration1653.exe
3672	Trapshydration1653.exe

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5076	Trapshydration1653.exe
3760	elevation_service.exe
3760	elevation_service.exe
3760	elevation_service.exe
116	Trapshydration1653.exe
1680	Trapshydration1653.exe
3672	Trapshydration1653.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	5076	Trapshydration1653.exe
Token: SeShutdownPrivilege	3760	elevation_service.exe
Token: SeShutdownPrivilege	4612	waitfor.exe
Token: SeDebugPrivilege	4612	waitfor.exe
Token: SeDebugPrivilege	4612	waitfor.exe
Token: SeBackupPrivilege	4220	vssvc.exe
Token: SeRestorePrivilege	4220	vssvc.exe
Token: SeAuditPrivilege	4220	vssvc.exe
Token: SeDebugPrivilege	4592	Trapshydration1653.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	116	Trapshydration1653.exe
Token: SeDebugPrivilege	1680	Trapshydration1653.exe
Token: SeDebugPrivilege	3672	Trapshydration1653.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	waitfor.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1784	3540	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe	84
PID 1784 wrote to memory of 4592	1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	85
PID 1784 wrote to memory of 1040	1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	88
PID 1784 wrote to memory of 4344	1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	90
PID 1784 wrote to memory of 5076	1784	_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp	94
PID 3760 wrote to memory of 1104	3760	elevation_service.exe	99
PID 1104 wrote to memory of 4612	1104	cmd.exe	101
PID 3760 wrote to memory of 2884	3760	elevation_service.exe	102
PID 2884 wrote to memory of 1676	2884	cmd.exe	104
PID 3760 wrote to memory of 3624	3760	elevation_service.exe	105
PID 3624 wrote to memory of 3896	3624	cmd.exe	109
PID 4612 wrote to memory of 3784	4612	waitfor.exe	110
PID 3760 wrote to memory of 4932	3760	elevation_service.exe	111
PID 3760 wrote to memory of 1464	3760	elevation_service.exe	113
PID 3760 wrote to memory of 1664	3760	elevation_service.exe	115
PID 4612 wrote to memory of 1372	4612	waitfor.exe	119
PID 4236 wrote to memory of 4592	4236	cmd.exe	124
PID 4612 wrote to memory of 4652	4612	waitfor.exe	126
PID 4652 wrote to memory of 1848	4652	cmd.exe	127
PID 4652 wrote to memory of 2204	4652	cmd.exe	128
PID 4392 wrote to memory of 116	4392	cmd.exe	131
PID 524 wrote to memory of 1680	524	cmd.exe	134
PID 1200 wrote to memory of 3672	1200	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1464	attrib.exe
4932	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3308
- C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe
  "C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\is-CQ7DT.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CQ7DT.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp" /SL5="$13003C,15432248,119296,C:\Users\Admin\AppData\Local\Temp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1040
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Trapshydration1653.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Drivers\WitchFabrics\Trapshydration1653.exe
      "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:5076
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:3784
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:1372
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1848
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:1676
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:3896
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4932
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1464
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DFaZNtXYYEBlySZixdTVYjKK /tr "cmd /c cd /d \"C:\Drivers\WitchFabrics\" && start \"\" \"C:\Drivers\WitchFabrics\Trapshydration1653.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1664

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:4064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4592

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:116

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:524
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1680

C:\Windows\system32\schtasks.exe
schtasks /query /tn DFaZNtXYYEBlySZixdTVYjKK
1⤵
PID:4840

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\WitchFabrics" && start "" "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Drivers\WitchFabrics\Trapshydration1653.exe
  "C:\Drivers\WitchFabrics\Trapshydration1653.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AndersonRoles-5278.D9s

Path C:\Drivers\WitchFabrics\AndersonRoles-5278.D9s
Size 4.4MB
SHA256 c22a0b6e6bb6a5b27590d84e85025c7767496df85ea0b5d898cc77e3bb9c32b5
MD5 de700f5d45328690629efdee2760fa14
SHA1 7c663ecec8d1e0b8f7d3be7bfb2e69f5b54e1c1f
SHA512 e69b067773038436518f8d33524afb0f862c845f19f336d829821758c71d8b8b598b59b46957bd6d8cab6adf8f58a0a3f968ab3d448e82f9faae99744132dbbb
SSDEEP 49152:GqzuxHcpEym5CRrCp1n5KlcJcQy2HmrRN9/ZmIHiPi:Osl1Rr25KlcJc4HmrRNTmICPi
TLSH
T1E226BF312151AA15E06F4316E1F84E0CC6BD6A4993BB8E9C9F13BAF67E46701FE3815C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trapshydration1653.exe

Path C:\Drivers\WitchFabrics\Trapshydration1653.exe
Size 1.1MB
SHA256 9284b0767d36c3e35cc05f50131e7b30688ad20236b7d1534cf40f8dc3adc12d
MD5 16c6b6ac0eb49905a7239b710f1fd980
SHA1 2e3a7c84940479f15f2c032a9e7ec4338be001c5
SHA512 c6fcbb142c494d1dff6abba0704b0e93bdcad68bd3f64aa31e0a1c5072f4f053b865503a4caefe70b6075d259808472a57ab4b00518993a5f47239ac1bb4c597
SSDEEP 24576:H8q9/yCM7Yymw2SzTrLBeDRegM+CyQBC1japLEWP8wncYUkrpieOwGpwY:cA/QNmVyeDRhRiC1japLEWP8wncYUkr+
TLSH
T1A0455B15775A65ECC09AC470838285636EA138CB0F35BEEF45C4A2393F7AAF45F39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 070d9f50ece5e044949ccbb30678f6c22ef6a1d89d87d5daac29adf8da90d437
MD5 41d97099f5c3c1f0b93b66b430d4ffb2
SHA1 1748b990f6e0d3f3acfcaad6b667eba68b43e553
SHA512 631996f79d9ba421a1d42a04ec3a80595d74341599c05224b91f830f538b507dfdf9088ad3fde81b00c5afed9f8faa9e3a3ff2d8d067e55208a6128e99a6f558
SSDEEP 384:2id2QnOptByVjIuGXIaoH9g9nOkfhJGSttxVxTAKU:gjtByVJeIr9grLtxfAx
TLSH
T1FD82D0432065DCE5F7122F843909C875FBDCA18638A88AF91588DE484F87A6DD5F4B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 d393373f89389e4b577cd9ee0fb89d89e79288aeae86212f9475e72a63b2e199
MD5 4b83abe534f54aa9f0f4d10ded8c7939
SHA1 8862dc3387ea3d9df56d7a4c7363418dcebcae29
SHA512 ba7afd2f94041f1cea4e4ccaaccf9aa240ad17ad8a769de8545852e3307777d5a16e11669baaa5dcff0deab355b42f76d8d0a4bbd2edad127ce09790332acf2a
SSDEEP 768:gjtByVJeIr9grLtxfAtRNdE2Mjyy4bpYsNCjKMPL3:g5ByfaxkdEsujKMj3
TLSH
T13DF2F18321517DD9D730BF182E4AC8EEF3ED41A9B82E09BD10C4D9584E9A425CEF8C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 3f8d87129e824462faf249ec92caf0fde78f80430289f146aafec967ee331c3e
MD5 5e7ebbbe5787022176f3984caf398e22
SHA1 02c7613a36ca74ae0dcc4b2197eb1f186b646f64
SHA512 164b6182c5e37a5c30610c6730aa951ccbec9a5b1f480976b9d04bc373d8320556094f573fe8c0ece422f7b57d456652a0358c0b6228cb58a7f2600c02fab827
SSDEEP 768:gjtByVJeIr9grLtxfAtRNdE2Mjyy4bpYsNCjKMPLgEXg66KQOgGD8:g5ByfaxkdEsujKMjbXgpdz
TLSH
T1DB13F1831061BDD9D6A1EF182C86C9DAF3FE40AAB85F097A10C495449E6A05ACFF4D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 42KB
SHA256 2c9d3b61401c756531572c7b16cb4fcb9c097aa9fc27334011ebef46389b8b70
MD5 5a07c1e07aa3d905629f69c84fc193fb
SHA1 d70c4c48ff579b9104d8ae78a0054b717e6ca0e9
SHA512 e57a5733cbf25dd8a6441843c90adcfccad36169653d5bdecc87b0d0c55e430387c317bbfc39ac7509194427331ab1e01c0aeba0b98020adbd65b425a183e12e
SSDEEP 768:gjtByVJeIr9grLtxfAtRNdE2Mjyy4bpYsNCjKMPLgEXg66KQOgGDa:g5ByfaxkdEsujKMjbXgpdV
TLSH
T13D13F2830152BDDAD6A1DF282C85C9DAF3FE40A6B85F08BD51C4D5448E6641ACEF4D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 55KB
SHA256 49ad0fd6a095737ffdec197e1d14b69fea2affb4569a0d6d2be6f9f39d8ce66e
MD5 4d583d5389909de5c583bafcab0929fc
SHA1 28eb234ce008491180217b6088a1b531636416de
SHA512 e93cd2548fecf693cf36f484adecbd9685b591279afb2a0b0110d15684de2e91299b551cf56fb3b4b299c3a13c036c4a8a1af10c9ae68c887c13f8c127d6f508
SSDEEP 1536:g5ByfaxkdEsujKMjbXgpd6yIRBBf5wsCO:gKatXjsuyI9f5JCO
TLSH
T1C34302C310507AD7D683FFA825C5C4CAF3EF10DA795F4C3960C496848DA642ACAE8E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 60KB
SHA256 51133431582ebc3a3f7cfdc4af55b494c9f79e41fe60ea19efa1f76c0cf55cca
MD5 533130b8b7ab67006dd7b5dc94a5dbdd
SHA1 ca77cfd9f94b1d1eb859bd82e735c4239ac5321d
SHA512 c0e918cd56dd459dfb7c9e64604bdc7cfa9eb0a697ddef3014e25c194dbe67b995b64730c6f5b439666d6292b80ac3f20b979f5c7481292f78f0a6bccceeb9ff
SSDEEP 1536:g5ByfaxkdEsujKMjbXgpd6yIRBBf5wsC+Hp4wS:gKatXjsuyI9f5JC+Hp4x
TLSH
T10D5302D30151BADBD683FF982585C88AF3EE00DA795F4D3661C486848DA641BCEE4E1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 71KB
SHA256 c72ed161e4155d3380d7281ee382fa7c0b18b69d789742e6f16f75f87632b89a
MD5 c59be3102c4ea6d9eade76e2021f4786
SHA1 e123c914c2df404906e2ab0614e18cbcba3f87e3
SHA512 a06aa760d281eec50f0cb694cba1292c2a6f44fe99d07005af79645eb1d1be4601243705d266ceeea37980b799e9b5dc0da787a3f0591d06b75c1602e0ffa2ce
SSDEEP 1536:g5ByfaxkdEsujKMjbXgpd6yIRBBf5wsC+Hp4wc8bKi:gKatXjsuyI9f5JC+Hp4H8bKi
TLSH
T1876312431250BDE6D7C2BB9825C4C88AF3EE00EEF95F6836618497948D7641BCAF8D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 96KB
SHA256 2f819a460985051323f3c99955e4da7b6fd0c366e0d65027b6b1898b2308de36
MD5 fb885cd07cf5a372d70425dc73325890
SHA1 02bb9e2d876b59ada91fd852745cb0c4b318b1f6
SHA512 b3a3b0341eb3ecb46d1ce6dbec6685b64b0ed69edbefdc345aec5ebf516aa8732bffdf37fd45378096ea6fb310f42c868714a8ff4a05cd1e246b3a5e06b5e742
SSDEEP 1536:g5ByfaxkdEsujKMjbXgpd6yIRBBf5wsC+Hp4wc8bK+7xAA5v8Fg5fKy+S:gKatXjsuyI9f5JC+Hp4H8bK+t7v8FEfN
TLSH
T170A3024322A1FDEAC6437FDC2684C445F2EE10DE7A1F4C7BA18E5A948D26406C6E9D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 123KB
SHA256 833883272ab96e6ab6a920863cab021d83da4b56bb20c17b9e274162cc0ff093
MD5 cef558086c0a7363ed55d26ecfb1f547
SHA1 020da1639977d2076a3328cf94a1ce9eecfee4fd
SHA512 be3d1ffdb8784d71a46436ff20c5b5e9f118a52a18db114a3136cb6aa67c3ba932346499ffe725cc6851fe8c71eb0563060d584c8db5e4166d61589e199d86f5
SSDEEP 3072:gKatXjsuyI9f5JC+Hp4H8bK+t7v8FEf8l5BaBBlz6s6:xa3H9RtHucbvh8yfi8O/
TLSH
T135C312C36292F9F6D6427B9C3288C401F2DE04E9BF1E4DB7A04D5A508D2E40AC3E5D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 2289ef5f47632ab73c76054a443219896c8761b2ab52772557cfedd8fb114b36
MD5 3238cae7e8965669a91ac50cbdf2da3b
SHA1 4ffd593be060f48784cbe315012e4676539796b9
SHA512 2c052d6e292ee0d87bf6b2a11744c1b8a113b83920ccda85938ea85d046be84595e3333e758fe75e0fc5646b1bf27f7a288e8219992cb6b8f9efae70954bb277
TLSH
T180615D9575B9E2C1EA1015DE642347295FCE00C4105F06E597A9EB406C92714E3DAFF7
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 47KB
SHA256 10cb60526699ff81c3b6d30cb3b961f3e42639b4bebbd17e3ba1380cf6e3012b
MD5 7bb43d4371ae36ec2c6fdea182f02415
SHA1 932f4f2bca67464837ffffa1f1a1653ef4ede1f8
SHA512 a70bc3242f2650425676f6cfdbc2636260847fd49824a012b15a7938fa0f1642d79c948991fef1f8f6b47a0a7dd6e2f356493f17ee9925c8a1009d1731eddf13
SSDEEP 768:gjtByVJeIr9grLtxfAtRNdE2Mjyy4bpYsNCjKMPLgEXg66KQOgGDvpIIRBPpvfJK:g5ByfaxkdEsujKMjbXgpd6yIRBBf5i
TLSH
T14723F18302517EDAD7A2BF182989C9DAF3EE40E6791F487A50C0D6448E7611ACBF4D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 59KB
SHA256 ecab967e8634a3284898e85454fbe3b46c7772543bc9fbe031d32376aae5b17a
MD5 8736e264b40f26eb3e1827483ede4a69
SHA1 bc257a1af052c826393594830f4e79ae6ff478d0
SHA512 466738a0e42d55c7e96f2e0cdf760e28214629a41f58960da18cd6bae6704bfba5591528e9fee6ba0f17242f931a9fda722ccc1c450fc82957bafbe19cf4cdef
SSDEEP 1536:g5ByfaxkdEsujKMjbXgpd6yIRBBf5wsC+Hp4wd:gKatXjsuyI9f5JC+Hp4O
TLSH
T1A25302D30151BADBD682FF982585C88AF3EF00DB795F4D3660C496888DA641BCAE4E1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 c88f6fc69085b79f18e21e6396c4ab8ebb5242e53671582671b25e75c5ac063c
MD5 dab212b74433e6ebac0ddb0ea1ebdac8
SHA1 41003c4a68343d051ba0b2b86cf167d4fd4e2371
SHA512 f6286143a207b6c61745dc4d9a231a4e7b3f4bc096a2ca2355c11cc0c22cf9500161c30559d9b6c3fff05efb759be214d49fe3b463ad84ef63a11da832bbfb27
TLSH
T187818F9531A6A2C1E61058D96C138618CFCE0195A01F0EF64B68D6445CA3329E2D6FA7
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 4KB
SHA256 d170fbaf625e36351c8ed7e3b3e4a5d5ccfc5b8d21a541a065ffb41ee4c06d75
MD5 37f171dbd451d0241e165c12cf7e18b2
SHA1 f394c0f04f628ee2415171f74f58316c5d79ea75
SHA512 6dd35f6fa7316bd3fb2d694b3ab4f9d563b9419f714fb141f2d16ecb04cdfc1fcc63a7e6b5993f30dccb366f5ba7f40da023fef69f21522b4ea0b3a2ee9603bd
SSDEEP 96:QWEYsCS7OTrzRdPz2QwIdWtgiLtEUKOyoZ8TqjmMCIGP8gdC+J72:QWsn7kRd2QwyWtg0tEay6sMCIGP8gr2
TLSH
T150A18D9630A6E6C1EB105D896C23C50CDBDE0057601F4EE75BB8D8808CE3328F2D2B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GraveReforms1747.1GY

Path C:\Drivers\givinglounge8\GraveReforms1747.1GY
Size 10.3MB
SHA256 2604761e24c7656dbd77883217eb6131f499c0792863e17c5dbfaedd66208ee0
MD5 69c414daf9537b09ef0395c7509e8442
SHA1 6afb2e678322de1860db6cd1421b7cc95fd2e29e
SHA512 93495652ae6eab038a071045c3e049e348b94598a867f19708c21ec1a1f653257ec32ad7cee14f839b376f024d84db045f18dd91389c27e8d2894cf8b6850401
SSDEEP 196608:0E7P4mMFeJLvS282g/58hhga/LN8pCawXhnrvVHVl4+pHhVIuMG:LbMFeJSZhkjN9frvpVK+MG
TLSH
T148B633BB497810CB6413B2DF526BE74FCF2B6188348AF9D5B39609D877425C85382CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CQ7DT.tmp\_ការអញ្ជើញចូលរួមកិច្ចប្រជុំស្តីពីក.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-662-0x00000199BD740000-0x00000199BD96D000-memory.dmp

Download

memory/1680-887-0x000002179C040000-0x000002179C26D000-memory.dmp

Download

memory/1784-5-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/1784-35-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/3540-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3540-60-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3672-1112-0x000001EC72260000-0x000001EC7248D000-memory.dmp

Download

memory/3760-171-0x0000027CFB610000-0x0000027CFB6F9000-memory.dmp

Download

memory/3760-228-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-177-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-659-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-598-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-195-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-278-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/3760-347-0x0000027CFB700000-0x0000027CFB7EC000-memory.dmp

Download

memory/4592-466-0x00000208393C0000-0x00000208395ED000-memory.dmp

Download

memory/4612-370-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-593-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-592-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-440-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-439-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-377-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-371-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-372-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-354-0x000001D9F3B40000-0x000001D9F6DB1000-memory.dmp

Download

memory/4612-352-0x000001D9F2930000-0x000001D9F3B38000-memory.dmp

Download

memory/5076-24-0x0000028D32660000-0x0000028D3288D000-memory.dmp

Download