de52002c9566018c61b816f862325c681c756758e693c9d40b70670caf22a2c4

General

Target

SMKT_COPY20240604.exe
Size

314KB
MD5

c7ceecb921d43912ec928af816a43ede
SHA1

2c4266ebdae98fc609ffb191cf26e85dc0671faa
SHA256

144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86
SHA512

8b4ecfc89221af3d4dde2ab7effc288f9c9ddaba764b67acbde33fbc5c19d69e16d69c40f35de74e36f4eb12bdd2ffba44b702bea9d5249476dafc7f4f389e31
SSDEEP

6144:BXFKo5F4CtVeI8Y9BA6MA4ph2LN7LNNhEdMUjzz4elzC:BX54CVeI8Y9BA6uph2LN7LNNhTelO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

SMKT_COPY20240604.exe

pid	process
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe
224	SMKT_COPY20240604.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SMKT_COPY20240604.exe

description	pid	process	target process
PID 224 wrote to memory of 5084	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 5084	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 5084	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3436	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3436	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3436	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3076	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3076	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3076	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2408	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2408	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2408	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2956	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2956	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2956	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3260	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 400	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 400	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 400	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4876	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4876	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4876	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2252	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2252	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2252	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 920	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 920	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 920	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1940	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1940	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1940	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2984	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2984	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2984	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3872	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3872	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3872	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2152	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2152	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2152	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2164	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2164	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 2164	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3288	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3288	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3288	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1980	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1980	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1980	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4240	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4240	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 4240	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3220	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3220	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3220	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1852	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1852	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 1852	224	SMKT_COPY20240604.exe	cmd.exe
PID 224 wrote to memory of 3788	224	SMKT_COPY20240604.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SMKT_COPY20240604.exe
"C:\Users\Admin\AppData\Local\Temp\SMKT_COPY20240604.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:5084

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:3436

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:3076

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:2956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x75^38"
2⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4E^38"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:1940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
2⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3872

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:4240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:3788

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2256

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4724

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:4412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:2136

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:416

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:4920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:3924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:4400

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
2⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:4676

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3144

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3784

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
2⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4304

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3116

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:4140

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:3828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:3396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6D^38"
2⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:3796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x74^38"
2⤵
PID:4104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x68^38"
2⤵
PID:4672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:3280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6A^38"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:4748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x70^38"
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
2⤵
PID:3924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:3088

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
2⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:1924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0B^38"
2⤵
PID:4036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:816

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:4316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:3580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3128

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4732

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
2⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:3924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:440

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:3940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
2⤵
PID:5016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:3408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:4712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:4400

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:3788

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:4284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:440

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:2140

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4D^38"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:3396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:3448

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:4140

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
2⤵
PID:3952

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1F^38"
2⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:5104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3616

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:1836

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
2⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:1136

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
2⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
2⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
2⤵
PID:4036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
2⤵
PID:3836

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:1144

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:4712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:3468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
2⤵
PID:3408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:3660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4456

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3944

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:708

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:2216

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
2⤵
PID:4456

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:2288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
2⤵
PID:1176

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:3944

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
2⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
2⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
2⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
2⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:1924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
2⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x65^38"
2⤵
PID:4412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
2⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
2⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
2⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
2⤵
PID:712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
2⤵
PID:3128

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
2⤵
PID:5112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x76^38"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
2⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
2⤵
PID:3700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
2⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:788

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
2⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
2⤵
PID:3580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:2140

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:3380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:3088

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:1240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:4748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
2⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
2⤵
PID:872

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
2⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
2⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
2⤵
PID:1176

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
2⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:5104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsrFAF6.tmp\System.dll
Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrFAF6.tmp\nsExec.dll
Filesize
7KB

MD5
b4579bc396ace8cafd9e825ff63fe244

SHA1
32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c

SHA256
01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b

SHA512
3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a

Download Submit

Analysis

Sharing