e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1200s
max time network
1212s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plfc1aef75
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Contacts a large (719) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 14 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4420	netsh.exe
4904	netsh.exe
1396	netsh.exe
1920	netsh.exe
4576	netsh.exe
1984	netsh.exe
936	netsh.exe
4652	netsh.exe
3744	netsh.exe
3744	netsh.exe
1400	netsh.exe
5048	netsh.exe
4180	netsh.exe
520	netsh.exe

Executes dropped EXE 8 IoCs

pid	Process
4152	svchost.exe
4424	~tlE25.tmp
2904	svchost.exe
656	~tlE6D2.tmp
1612	svchost.exe
2728	~tl2F2C.tmp
2184	svchost.exe
1660	~tl9607.tmp

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl2F2C.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tl2F2C.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tl9607.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl9607.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	~tlE25.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tlE25.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1384	schtasks.exe
2828	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	~tl2F2C.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl2F2C.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	~tl9607.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1144	powershell.exe
2752	powershell.exe
1144	powershell.exe
2752	powershell.exe
2752	powershell.exe
1144	powershell.exe
2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2548	powershell.exe
1920	powershell.exe
1920	powershell.exe
2548	powershell.exe
1920	powershell.exe
2548	powershell.exe
4424	~tlE25.tmp
4424	~tlE25.tmp
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4424	~tlE25.tmp
4424	~tlE25.tmp
2904	svchost.exe
2904	svchost.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe
656	~tlE6D2.tmp
656	~tlE6D2.tmp
3144	powershell.exe
3144	powershell.exe
4484	powershell.exe
3144	powershell.exe
4484	powershell.exe
4484	powershell.exe
1612	svchost.exe
1612	svchost.exe
4752	powershell.exe
4488	powershell.exe
4752	powershell.exe
4488	powershell.exe
4752	powershell.exe
4488	powershell.exe
2728	~tl2F2C.tmp
2728	~tl2F2C.tmp
1800	powershell.exe
1128	powershell.exe
1800	powershell.exe
1800	powershell.exe
1128	powershell.exe
1128	powershell.exe
2184	svchost.exe
2184	svchost.exe
4480	powershell.exe
520	powershell.exe
4480	powershell.exe
4480	powershell.exe
520	powershell.exe
520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeIncreaseQuotaPrivilege	1144	powershell.exe
Token: SeSecurityPrivilege	1144	powershell.exe
Token: SeTakeOwnershipPrivilege	1144	powershell.exe
Token: SeLoadDriverPrivilege	1144	powershell.exe
Token: SeSystemProfilePrivilege	1144	powershell.exe
Token: SeSystemtimePrivilege	1144	powershell.exe
Token: SeProfSingleProcessPrivilege	1144	powershell.exe
Token: SeIncBasePriorityPrivilege	1144	powershell.exe
Token: SeCreatePagefilePrivilege	1144	powershell.exe
Token: SeBackupPrivilege	1144	powershell.exe
Token: SeRestorePrivilege	1144	powershell.exe
Token: SeShutdownPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeSystemEnvironmentPrivilege	1144	powershell.exe
Token: SeRemoteShutdownPrivilege	1144	powershell.exe
Token: SeUndockPrivilege	1144	powershell.exe
Token: SeManageVolumePrivilege	1144	powershell.exe
Token: 33	1144	powershell.exe
Token: 34	1144	powershell.exe
Token: 35	1144	powershell.exe
Token: 36	1144	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeIncreaseQuotaPrivilege	1920	powershell.exe
Token: SeSecurityPrivilege	1920	powershell.exe
Token: SeTakeOwnershipPrivilege	1920	powershell.exe
Token: SeLoadDriverPrivilege	1920	powershell.exe
Token: SeSystemProfilePrivilege	1920	powershell.exe
Token: SeSystemtimePrivilege	1920	powershell.exe
Token: SeProfSingleProcessPrivilege	1920	powershell.exe
Token: SeIncBasePriorityPrivilege	1920	powershell.exe
Token: SeCreatePagefilePrivilege	1920	powershell.exe
Token: SeBackupPrivilege	1920	powershell.exe
Token: SeRestorePrivilege	1920	powershell.exe
Token: SeShutdownPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeSystemEnvironmentPrivilege	1920	powershell.exe
Token: SeRemoteShutdownPrivilege	1920	powershell.exe
Token: SeUndockPrivilege	1920	powershell.exe
Token: SeManageVolumePrivilege	1920	powershell.exe
Token: 33	1920	powershell.exe
Token: 34	1920	powershell.exe
Token: 35	1920	powershell.exe
Token: 36	1920	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeIncreaseQuotaPrivilege	3996	powershell.exe
Token: SeSecurityPrivilege	3996	powershell.exe
Token: SeTakeOwnershipPrivilege	3996	powershell.exe
Token: SeLoadDriverPrivilege	3996	powershell.exe
Token: SeSystemProfilePrivilege	3996	powershell.exe
Token: SeSystemtimePrivilege	3996	powershell.exe
Token: SeProfSingleProcessPrivilege	3996	powershell.exe
Token: SeIncBasePriorityPrivilege	3996	powershell.exe
Token: SeCreatePagefilePrivilege	3996	powershell.exe
Token: SeBackupPrivilege	3996	powershell.exe
Token: SeRestorePrivilege	3996	powershell.exe
Token: SeShutdownPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeSystemEnvironmentPrivilege	3996	powershell.exe
Token: SeRemoteShutdownPrivilege	3996	powershell.exe
Token: SeUndockPrivilege	3996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1144	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	71
PID 2984 wrote to memory of 1144	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	71
PID 2984 wrote to memory of 2752	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 2984 wrote to memory of 2752	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 2984 wrote to memory of 1384	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 2984 wrote to memory of 1384	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 2984 wrote to memory of 4152	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 2984 wrote to memory of 4152	2984	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 4152 wrote to memory of 1920	4152	svchost.exe	80
PID 4152 wrote to memory of 1920	4152	svchost.exe	80
PID 4152 wrote to memory of 2548	4152	svchost.exe	82
PID 4152 wrote to memory of 2548	4152	svchost.exe	82
PID 4152 wrote to memory of 4424	4152	svchost.exe	84
PID 4152 wrote to memory of 4424	4152	svchost.exe	84
PID 4424 wrote to memory of 1200	4424	~tlE25.tmp	85
PID 4424 wrote to memory of 1200	4424	~tlE25.tmp	85
PID 4424 wrote to memory of 1984	4424	~tlE25.tmp	87
PID 4424 wrote to memory of 1984	4424	~tlE25.tmp	87
PID 4424 wrote to memory of 4904	4424	~tlE25.tmp	89
PID 4424 wrote to memory of 4904	4424	~tlE25.tmp	89
PID 4424 wrote to memory of 3996	4424	~tlE25.tmp	90
PID 4424 wrote to memory of 3996	4424	~tlE25.tmp	90
PID 4424 wrote to memory of 5028	4424	~tlE25.tmp	93
PID 4424 wrote to memory of 5028	4424	~tlE25.tmp	93
PID 4424 wrote to memory of 320	4424	~tlE25.tmp	96
PID 4424 wrote to memory of 320	4424	~tlE25.tmp	96
PID 4424 wrote to memory of 2828	4424	~tlE25.tmp	98
PID 4424 wrote to memory of 2828	4424	~tlE25.tmp	98
PID 4424 wrote to memory of 2904	4424	~tlE25.tmp	100
PID 4424 wrote to memory of 2904	4424	~tlE25.tmp	100
PID 2904 wrote to memory of 3152	2904	svchost.exe	101
PID 2904 wrote to memory of 3152	2904	svchost.exe	101
PID 2904 wrote to memory of 5048	2904	svchost.exe	103
PID 2904 wrote to memory of 5048	2904	svchost.exe	103
PID 2904 wrote to memory of 1396	2904	svchost.exe	105
PID 2904 wrote to memory of 1396	2904	svchost.exe	105
PID 2904 wrote to memory of 3744	2904	svchost.exe	107
PID 2904 wrote to memory of 3744	2904	svchost.exe	107
PID 2904 wrote to memory of 4408	2904	svchost.exe	109
PID 2904 wrote to memory of 4408	2904	svchost.exe	109
PID 2904 wrote to memory of 656	2904	svchost.exe	111
PID 2904 wrote to memory of 656	2904	svchost.exe	111
PID 656 wrote to memory of 4636	656	~tlE6D2.tmp	112
PID 656 wrote to memory of 4636	656	~tlE6D2.tmp	112
PID 656 wrote to memory of 4180	656	~tlE6D2.tmp	114
PID 656 wrote to memory of 4180	656	~tlE6D2.tmp	114
PID 656 wrote to memory of 520	656	~tlE6D2.tmp	116
PID 656 wrote to memory of 520	656	~tlE6D2.tmp	116
PID 656 wrote to memory of 3144	656	~tlE6D2.tmp	118
PID 656 wrote to memory of 3144	656	~tlE6D2.tmp	118
PID 656 wrote to memory of 4484	656	~tlE6D2.tmp	120
PID 656 wrote to memory of 4484	656	~tlE6D2.tmp	120
PID 1612 wrote to memory of 3000	1612	svchost.exe	123
PID 1612 wrote to memory of 3000	1612	svchost.exe	123
PID 1612 wrote to memory of 1920	1612	svchost.exe	125
PID 1612 wrote to memory of 1920	1612	svchost.exe	125
PID 1612 wrote to memory of 3744	1612	svchost.exe	127
PID 1612 wrote to memory of 3744	1612	svchost.exe	127
PID 1612 wrote to memory of 4752	1612	svchost.exe	129
PID 1612 wrote to memory of 4752	1612	svchost.exe	129
PID 1612 wrote to memory of 4488	1612	svchost.exe	131
PID 1612 wrote to memory of 4488	1612	svchost.exe	131
PID 1612 wrote to memory of 2728	1612	svchost.exe	134
PID 1612 wrote to memory of 2728	1612	svchost.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1384
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\~tlE25.tmp
    C:\Users\Admin\AppData\Local\Temp\~tlE25.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:1200
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1984
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:320
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:2828
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:3152
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5048
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\~tlE6D2.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tlE6D2.tmp
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:656
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:4636
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4180
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3144
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4484

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1920
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Windows\TEMP\~tl2F2C.tmp
  C:\Windows\TEMP\~tl2F2C.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    - Modifies data under HKEY_USERS
    PID:1920
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:936
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:3744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1128

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2184
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:4496
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1400
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:520
- C:\Windows\TEMP\~tl9607.tmp
  C:\Windows\TEMP\~tl9607.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1660
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:3956
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4576
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
MD5 268b890dae39e430e8b127909067ed96
SHA1 35939515965c0693ef46e021254c3e73ea8c4a2b
SHA512 abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c52a8c500524cf01ddeeed03e0094a0a1d091f51e176a056c0161d772cc880ea
MD5 1aaefd8dbea9c6014590e1ed3dd7c1bb
SHA1 38b329bcb1947b6b3d49369674029d7ec44f8d03
SHA512 b5d2b43447191027dca7f197764a64b5d87e53f735e73a26fd70811bc9c32db6822e754033acbdb14c31ab21c067d3a803ee623af96c2621ece7bb06beee858c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c84be60ef26edebeb3f233a5b662dfc5c72ee3130325ce2dd9449e10b128f135
MD5 c9031c9f6cd097a3439ee3270902f055
SHA1 a2208217b77700989255f8f0c77f29274543ad11
SHA512 6a723ffceee15954173375bb3e839369bd368976daeaa983b6ea21799ddcb72b4da893d3c568b95aa4886df1a40eb74962941704b8b9d4b699d7abb3cec848ed
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e4eb4fb73a9fe0a0915c47f2709dae0e6066c17899bc232af9d53e3db4f1e7aa
MD5 277f815fbaa230013c019caacf9597f8
SHA1 cda94065bcb653e063554eafb726c973f48d931a
SHA512 1064d277066df34ca566886ede489e52dac0676396c03796d6ab1a4d25264d56dead8b1f9f072118bb5201e0b9cb8bbfd63b1c90d4b9a442479864a7dc036353
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b54921d0a2cde46e59ac6054ce7a82bff1274d4ea32e9d56a05c5ccc5b3b29c
MD5 866fdfa8fc2f927538216f5f343a60ee
SHA1 5146e865179dfd3095a4bfdcc78698b319062273
SHA512 a970bdcea98f98b7346dcce7d0688ca7b6598cec4bcc2940af96fbf2225dd0be11b045961103719cf67261679ba35a4c828f130385101ad50cd40e34407d680a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0be50dc848ae2551b97bb78c64966ffec1c531a269f3a23d9af8014f1f9b803e
MD5 aadfcab3eba322ef809fccee9bdd60a0
SHA1 85263f474f153a53a17751822b832c27c216839e
SHA512 59504b8a5982bd9b46561d8704b08661e1a231f9eb6e7a1a41c54a78f615e7096e486af7c7791fc89ddbacf25dc77f98bbd9068e5e88e90370e5d20ee4c9f4d0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_er3xega0.din.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_er3xega0.din.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

~tlE25.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tlE25.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tlE6D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tlE6D2.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 9.7MB
SHA256 da6e67b9bc0118e2ffaa829edcd53b03f257aa4543de8ef5a9d1aca9a32dedb3
MD5 d890ac310c8287ce0fd07cbf05da75be
SHA1 9b5265c5dd6dc0a5e78155eb9c7c27a6e5d160ac
SHA512 06ece43d7e1741c4a5ae297f85e3b821077cf2dc2cb2af53b50be13630b15003ea310e9a3059cc106187e480f2392886a7fa865be7e7f3abb3cbb0a49f5058ef
SSDEEP 24576:QjT0TPIGDgDt7NvrJRp+2aWRYYU07FEv53AUddpmMdwd0HQQo5vA7z//S6GiD4sY:RWxQ+DODcHN
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c918bf6bad93b653f9d05007634b088be7b91ed4350b777905d0520d93d650eb
MD5 478f1c1fcff584f4f440469ed71d2d43
SHA1 0900e9dc39580d527c145715f985a5a86e80b66c
SHA512 4ed62f2add77e0dd8e07e101ee06bdb8a15808b701c7580b09704bd4befdecf7cfe2fa29d6e96f2149a92f4e1b0cae0d9810a5cde3f4940145f8120f7322d1a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1416aa77da9fc2715f5283b9507843174b18b7978a46b026e0621c3f4a2c4aea
MD5 948adf78c3a9ffa30effc0cca33d7694
SHA1 63bb769cd64a85f204ef39fa19d6e1d0f7f2db8b
SHA512 e42aafea6d1df8902ee2d3ca92f4c5be2c79537e457e2361e6112a408dc39d4c8f0d5b5729a3ed5cee3235d5b3a8c85b945ca3939a7db4b6fed0e289a65f6f96
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0b40d0e3861c3d5aac3ee31c86c5731e01cb6f7903a968a5f900d3864b5e6eea
MD5 09fe7c02f2adc32934f56a99cea9b2c0
SHA1 2961850df6bcf021176f8a8a8c96dc8f91ddbade
SHA512 3c59562b9fb08399e417c462c439cbb7d3622a62a0efc4ef0b9f7b8746d8fb602eba7bc9a4c3841666a8e02c4125538d1fe25f5aac747214e7b1cbe3a245f646
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 efe946b98958b43e1d816ff829f8605786d1b6250a8415fe7b2f66401ed89e13
MD5 861c9247c7f1298f235587960449c3eb
SHA1 38fb04aaf9a45d3d71c2ea52a459db4da0c660f1
SHA512 574d0421aa04d3940dee9395df05bd4c8bea253daee69fca15a047029b7e935beed663a8af4fe339a658a6ce5cbfce6a5cfbc39215a3efc8f27722b37d9334cf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f
MD5 302a7c179ef577c237c5418fb770fd27
SHA1 343ef00d1357a8d2ff6e1143541a8a29435ed30c
SHA512 f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699
MD5 SHA1 SHA512

Submit Download

memory/656-603-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/656-499-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/656-500-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/656-495-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/656-497-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/656-498-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1144-18-0x0000027EF87E0000-0x0000027EF87F0000-memory.dmp

Download

memory/1144-109-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/1144-104-0x0000027EF87E0000-0x0000027EF87F0000-memory.dmp

Download

memory/1144-48-0x0000027EF87E0000-0x0000027EF87F0000-memory.dmp

Download

memory/1144-23-0x0000027EF8970000-0x0000027EF89E6000-memory.dmp

Download

memory/1144-13-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/1612-618-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1612-942-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1920-125-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/1920-130-0x00000262774E0000-0x00000262774F0000-memory.dmp

Download

memory/1920-220-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/1920-165-0x00000262774E0000-0x00000262774F0000-memory.dmp

Download

memory/1920-215-0x00000262774E0000-0x00000262774F0000-memory.dmp

Download

memory/2548-128-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/2548-131-0x0000022C41890000-0x0000022C418A0000-memory.dmp

Download

memory/2548-219-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/2548-212-0x0000022C41890000-0x0000022C418A0000-memory.dmp

Download

memory/2548-163-0x0000022C41890000-0x0000022C418A0000-memory.dmp

Download

memory/2548-132-0x0000022C41890000-0x0000022C418A0000-memory.dmp

Download

memory/2728-1263-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2728-947-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2728-1266-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2752-16-0x0000023F1F7C0000-0x0000023F1F7D0000-memory.dmp

Download

memory/2752-15-0x0000023F1F7C0000-0x0000023F1F7D0000-memory.dmp

Download

memory/2752-96-0x0000023F1F7C0000-0x0000023F1F7D0000-memory.dmp

Download

memory/2752-14-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/2752-100-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/2752-17-0x0000023F1F940000-0x0000023F1F962000-memory.dmp

Download

memory/2752-50-0x0000023F1F7C0000-0x0000023F1F7D0000-memory.dmp

Download

memory/2904-496-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2904-385-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2904-383-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2984-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2984-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2984-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2984-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2984-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2984-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3144-507-0x000001C561FB0000-0x000001C561FC0000-memory.dmp

Download

memory/3144-504-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/3144-506-0x000001C561FB0000-0x000001C561FC0000-memory.dmp

Download

memory/3744-483-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/3744-389-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/3744-391-0x000001F681620000-0x000001F681630000-memory.dmp

Download

memory/3744-392-0x000001F681620000-0x000001F681630000-memory.dmp

Download

memory/3744-473-0x000001F681620000-0x000001F681630000-memory.dmp

Download

memory/3744-416-0x000001F681620000-0x000001F681630000-memory.dmp

Download

memory/3996-277-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/3996-375-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/3996-368-0x000001C7470D0000-0x000001C7470E0000-memory.dmp

Download

memory/3996-305-0x000001C7470D0000-0x000001C7470E0000-memory.dmp

Download

memory/3996-280-0x000001C7470D0000-0x000001C7470E0000-memory.dmp

Download

memory/3996-279-0x000001C7470D0000-0x000001C7470E0000-memory.dmp

Download

memory/4152-221-0x0000000015540000-0x0000000015A3C000-memory.dmp

Download

memory/4152-119-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4152-269-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4152-118-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4408-401-0x000001D9F1760000-0x000001D9F1770000-memory.dmp

Download

memory/4408-487-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/4408-482-0x000001D9F1760000-0x000001D9F1770000-memory.dmp

Download

memory/4408-446-0x000001D9F1760000-0x000001D9F1770000-memory.dmp

Download

memory/4408-402-0x000001D9F1760000-0x000001D9F1770000-memory.dmp

Download

memory/4408-399-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/4424-268-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4424-384-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4424-273-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4424-271-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4424-270-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4424-272-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4484-515-0x000001EA41840000-0x000001EA41850000-memory.dmp

Download

memory/4484-513-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/5028-374-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/5028-285-0x00007FFB40BF0000-0x00007FFB415DC000-memory.dmp

Download

memory/5028-289-0x0000014A74360000-0x0000014A74370000-memory.dmp

Download

memory/5028-290-0x0000014A74360000-0x0000014A74370000-memory.dmp

Download

memory/5028-334-0x0000014A74360000-0x0000014A74370000-memory.dmp

Download

memory/5028-366-0x0000014A74360000-0x0000014A74370000-memory.dmp

Download