e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1198s
max time network
1214s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plfc1aef75
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Contacts a large (651) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 14 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1444	netsh.exe
1132	netsh.exe
2436	netsh.exe
4444	netsh.exe
2404	netsh.exe
1260	netsh.exe
4152	netsh.exe
3364	netsh.exe
4280	netsh.exe
4152	netsh.exe
4228	netsh.exe
4808	netsh.exe
2612	netsh.exe
3716	netsh.exe

Executes dropped EXE 8 IoCs

pid	Process
5088	svchost.exe
5020	~tl1260.tmp
4032	svchost.exe
4796	~tlF128.tmp
672	svchost.exe
4812	~tlDEF4.tmp
2572	svchost.exe
4820	~tl3FE3.tmp

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl3FE3.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tlDEF4.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tlDEF4.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[2].htm	~tlDEF4.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tl3FE3.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\svchost.exe	~tl1260.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	~tl1260.tmp
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1544	schtasks.exe
4008	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	~tl3FE3.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	~tl3FE3.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	powershell.exe
4368	powershell.exe
4632	powershell.exe
4368	powershell.exe
4632	powershell.exe
4368	powershell.exe
5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
3076	powershell.exe
508	powershell.exe
3076	powershell.exe
508	powershell.exe
3076	powershell.exe
508	powershell.exe
5020	~tl1260.tmp
5020	~tl1260.tmp
3208	powershell.exe
2572	powershell.exe
3208	powershell.exe
2572	powershell.exe
3208	powershell.exe
2572	powershell.exe
5020	~tl1260.tmp
5020	~tl1260.tmp
4032	svchost.exe
4032	svchost.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
5068	powershell.exe
5068	powershell.exe
5068	powershell.exe
4796	~tlF128.tmp
4796	~tlF128.tmp
4140	powershell.exe
4140	powershell.exe
3012	powershell.exe
3012	powershell.exe
4140	powershell.exe
3012	powershell.exe
672	svchost.exe
672	svchost.exe
4048	powershell.exe
1008	powershell.exe
4048	powershell.exe
1008	powershell.exe
4048	powershell.exe
1008	powershell.exe
4812	~tlDEF4.tmp
4812	~tlDEF4.tmp
5056	powershell.exe
2104	powershell.exe
5056	powershell.exe
2104	powershell.exe
5056	powershell.exe
2104	powershell.exe
2572	svchost.exe
2572	svchost.exe
4256	powershell.exe
4256	powershell.exe
4256	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeIncreaseQuotaPrivilege	4368	powershell.exe
Token: SeSecurityPrivilege	4368	powershell.exe
Token: SeTakeOwnershipPrivilege	4368	powershell.exe
Token: SeLoadDriverPrivilege	4368	powershell.exe
Token: SeSystemProfilePrivilege	4368	powershell.exe
Token: SeSystemtimePrivilege	4368	powershell.exe
Token: SeProfSingleProcessPrivilege	4368	powershell.exe
Token: SeIncBasePriorityPrivilege	4368	powershell.exe
Token: SeCreatePagefilePrivilege	4368	powershell.exe
Token: SeBackupPrivilege	4368	powershell.exe
Token: SeRestorePrivilege	4368	powershell.exe
Token: SeShutdownPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeSystemEnvironmentPrivilege	4368	powershell.exe
Token: SeRemoteShutdownPrivilege	4368	powershell.exe
Token: SeUndockPrivilege	4368	powershell.exe
Token: SeManageVolumePrivilege	4368	powershell.exe
Token: 33	4368	powershell.exe
Token: 34	4368	powershell.exe
Token: 35	4368	powershell.exe
Token: 36	4368	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3076	powershell.exe
Token: SeSecurityPrivilege	3076	powershell.exe
Token: SeTakeOwnershipPrivilege	3076	powershell.exe
Token: SeLoadDriverPrivilege	3076	powershell.exe
Token: SeSystemProfilePrivilege	3076	powershell.exe
Token: SeSystemtimePrivilege	3076	powershell.exe
Token: SeProfSingleProcessPrivilege	3076	powershell.exe
Token: SeIncBasePriorityPrivilege	3076	powershell.exe
Token: SeCreatePagefilePrivilege	3076	powershell.exe
Token: SeBackupPrivilege	3076	powershell.exe
Token: SeRestorePrivilege	3076	powershell.exe
Token: SeShutdownPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeSystemEnvironmentPrivilege	3076	powershell.exe
Token: SeRemoteShutdownPrivilege	3076	powershell.exe
Token: SeUndockPrivilege	3076	powershell.exe
Token: SeManageVolumePrivilege	3076	powershell.exe
Token: 33	3076	powershell.exe
Token: 34	3076	powershell.exe
Token: 35	3076	powershell.exe
Token: 36	3076	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	3208	powershell.exe
Token: SeSecurityPrivilege	3208	powershell.exe
Token: SeTakeOwnershipPrivilege	3208	powershell.exe
Token: SeLoadDriverPrivilege	3208	powershell.exe
Token: SeSystemProfilePrivilege	3208	powershell.exe
Token: SeSystemtimePrivilege	3208	powershell.exe
Token: SeProfSingleProcessPrivilege	3208	powershell.exe
Token: SeIncBasePriorityPrivilege	3208	powershell.exe
Token: SeCreatePagefilePrivilege	3208	powershell.exe
Token: SeBackupPrivilege	3208	powershell.exe
Token: SeRestorePrivilege	3208	powershell.exe
Token: SeShutdownPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeSystemEnvironmentPrivilege	3208	powershell.exe
Token: SeRemoteShutdownPrivilege	3208	powershell.exe
Token: SeUndockPrivilege	3208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4368	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 5000 wrote to memory of 4368	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 5000 wrote to memory of 4632	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	75
PID 5000 wrote to memory of 4632	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	75
PID 5000 wrote to memory of 1544	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 5000 wrote to memory of 1544	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 5000 wrote to memory of 5088	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	80
PID 5000 wrote to memory of 5088	5000	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	80
PID 5088 wrote to memory of 3076	5088	svchost.exe	82
PID 5088 wrote to memory of 3076	5088	svchost.exe	82
PID 5088 wrote to memory of 508	5088	svchost.exe	83
PID 5088 wrote to memory of 508	5088	svchost.exe	83
PID 5088 wrote to memory of 5020	5088	svchost.exe	86
PID 5088 wrote to memory of 5020	5088	svchost.exe	86
PID 5020 wrote to memory of 2216	5020	~tl1260.tmp	87
PID 5020 wrote to memory of 2216	5020	~tl1260.tmp	87
PID 5020 wrote to memory of 4444	5020	~tl1260.tmp	89
PID 5020 wrote to memory of 4444	5020	~tl1260.tmp	89
PID 5020 wrote to memory of 4228	5020	~tl1260.tmp	91
PID 5020 wrote to memory of 4228	5020	~tl1260.tmp	91
PID 5020 wrote to memory of 3208	5020	~tl1260.tmp	93
PID 5020 wrote to memory of 3208	5020	~tl1260.tmp	93
PID 5020 wrote to memory of 2572	5020	~tl1260.tmp	95
PID 5020 wrote to memory of 2572	5020	~tl1260.tmp	95
PID 5020 wrote to memory of 4120	5020	~tl1260.tmp	98
PID 5020 wrote to memory of 4120	5020	~tl1260.tmp	98
PID 5020 wrote to memory of 4008	5020	~tl1260.tmp	100
PID 5020 wrote to memory of 4008	5020	~tl1260.tmp	100
PID 5020 wrote to memory of 4032	5020	~tl1260.tmp	102
PID 5020 wrote to memory of 4032	5020	~tl1260.tmp	102
PID 4032 wrote to memory of 1092	4032	svchost.exe	103
PID 4032 wrote to memory of 1092	4032	svchost.exe	103
PID 4032 wrote to memory of 1444	4032	svchost.exe	105
PID 4032 wrote to memory of 1444	4032	svchost.exe	105
PID 4032 wrote to memory of 2404	4032	svchost.exe	107
PID 4032 wrote to memory of 2404	4032	svchost.exe	107
PID 4032 wrote to memory of 2836	4032	svchost.exe	109
PID 4032 wrote to memory of 2836	4032	svchost.exe	109
PID 4032 wrote to memory of 5068	4032	svchost.exe	111
PID 4032 wrote to memory of 5068	4032	svchost.exe	111
PID 4032 wrote to memory of 4796	4032	svchost.exe	113
PID 4032 wrote to memory of 4796	4032	svchost.exe	113
PID 4796 wrote to memory of 1456	4796	~tlF128.tmp	114
PID 4796 wrote to memory of 1456	4796	~tlF128.tmp	114
PID 4796 wrote to memory of 1132	4796	~tlF128.tmp	116
PID 4796 wrote to memory of 1132	4796	~tlF128.tmp	116
PID 4796 wrote to memory of 1260	4796	~tlF128.tmp	117
PID 4796 wrote to memory of 1260	4796	~tlF128.tmp	117
PID 4796 wrote to memory of 4140	4796	~tlF128.tmp	119
PID 4796 wrote to memory of 4140	4796	~tlF128.tmp	119
PID 4796 wrote to memory of 3012	4796	~tlF128.tmp	122
PID 4796 wrote to memory of 3012	4796	~tlF128.tmp	122
PID 672 wrote to memory of 4636	672	svchost.exe	125
PID 672 wrote to memory of 4636	672	svchost.exe	125
PID 672 wrote to memory of 4808	672	svchost.exe	127
PID 672 wrote to memory of 4808	672	svchost.exe	127
PID 672 wrote to memory of 2612	672	svchost.exe	129
PID 672 wrote to memory of 2612	672	svchost.exe	129
PID 672 wrote to memory of 4048	672	svchost.exe	131
PID 672 wrote to memory of 4048	672	svchost.exe	131
PID 672 wrote to memory of 1008	672	svchost.exe	133
PID 672 wrote to memory of 1008	672	svchost.exe	133
PID 672 wrote to memory of 4812	672	svchost.exe	136
PID 672 wrote to memory of 4812	672	svchost.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1544
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:508
- - C:\Users\Admin\AppData\Local\Temp\~tl1260.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl1260.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:2216
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4444
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:4120
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:4008
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:1092
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1444
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\~tlF128.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tlF128.tmp
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:1456
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1132
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3012

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:4636
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4808
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Windows\TEMP\~tlDEF4.tmp
  C:\Windows\TEMP\~tlDEF4.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:3032
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4152
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:4280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2104

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2572
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:2404
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:3364
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Windows\TEMP\~tl3FE3.tmp
  C:\Windows\TEMP\~tl3FE3.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4820
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:640
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3716
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
MD5 268b890dae39e430e8b127909067ed96
SHA1 35939515965c0693ef46e021254c3e73ea8c4a2b
SHA512 abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 29c8c762e3d3d24c6a904ce1c4427480d9034dadb88200604cb0dd3e197257bc
MD5 0d1043203a42a9605ec9aad0bac38a32
SHA1 c164bdd1842ec1dee356695bed0922190cc8a3fd
SHA512 cceb77ef877b3efc187b0b844e3f8fd2f0a90a305371d94c1177ed42f499fa6ae7c662892a7801cd2a641f501c25dd3e8919b33a8285f6a3616ef894671e78cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a53c373437e609c6adc68a68ab1543f42eec151f92464131f2ef29ea4df5c6bd
MD5 666d189697c9a56318eb99e2af15709c
SHA1 abddcce883e10261730e93e103bc9a59d278e3dc
SHA512 2984efd8962a1ae03415f3f82fd543e229a9003614362e43464540a971a34b55935e43bcd5626f495ec0b5c89d1d88c0b61a9fb5ed51365a20c2f166e4980f9e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 722862ed143005a57a13e1947e314aadd00702732b39b730a17b0de0ade62510
MD5 c436019d0f1ec3bbde8990b855916cf4
SHA1 b6fb9d55798d3bb2b1aef34f3ad072ab8a000c6c
SHA512 120b7d4d33c76a4a69c216e5b28c6b64e5a609bd9fdb6178a0eb9d6ae74fa93c3a4ffb33890cc9065fc832bf043e51d83dec7b730a48812655c153dc27ed80ea
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0e728d10a14ccd0ff11bd915c2b71b172120bd811286b9ec83d186dafcde25db
MD5 73af55e85d2dd1f14ff6b90aee30c1cd
SHA1 3cbd953d9da931a52a94c63b962b24166808ffd1
SHA512 3d822c9f1f7840f87eab645d53154fc3fb208a6d21fb81e0cc0b029f488ac99f811574111c73aae27a89bfd2b4d8b724f9837b0c2ab2e0a2396e6258ee116bc1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82886ea750d155e0572c25a872fd2be3312b5c5c6b4b1a4ec6217358b74ada9e
MD5 d955c383d2f5736ceec987e8da249c85
SHA1 16ec121dab4d5972f67eafe6e56789ed56712580
SHA512 ece0545eb43e2441b4b6160f22607a989739c9434d6abeef0fc225f77cea968dc7e837ab66e68f497cbeb67a76df5b8eef1d20e854477524d50eca2ec1c928d5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_kru1tbeg.3ft.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kru1tbeg.3ft.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

~tl1260.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl1260.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tlF128.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tlF128.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 6.6MB
SHA256 f1340f8399ffd36819a6b5d35712743b8541da5053c4057d109ca321cec8e57c
MD5 5776481062e5dc4acdf70841f3c8f2bc
SHA1 cb83385553609313cf5cffb98e046c46c940339a
SHA512 ba11ba3748b03e0bb611d646a669b2b8bf21f353fc8c38b84be29669a63dea6b0585211a9bbb7a5f08a7452277a0b2c11bb3a25b7282b3fc609c8cda436e94cb
SSDEEP 24576:anJfaoie7uspadK+zUVx4Vrs3tpsyMEwsKwbIvydhWEZEWGZ4xXB/6yEEBXQDKdG:+6b4+zAfQyJDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c918bf6bad93b653f9d05007634b088be7b91ed4350b777905d0520d93d650eb
MD5 478f1c1fcff584f4f440469ed71d2d43
SHA1 0900e9dc39580d527c145715f985a5a86e80b66c
SHA512 4ed62f2add77e0dd8e07e101ee06bdb8a15808b701c7580b09704bd4befdecf7cfe2fa29d6e96f2149a92f4e1b0cae0d9810a5cde3f4940145f8120f7322d1a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 953764467f4ac2f0231d83e339aa31202fb7a0f70cb8f65760840d417b0b91c2
MD5 bfb1fccf085d0535e0450bc41b0475f2
SHA1 e8941f17f4ae7f79169e5373869f1680c6b2bd74
SHA512 48f26b978ec7092461dc876bc06c15f5d6137e27c5b1b7b34497e2f560b69c31bdecf4cdfe77e7aa07af65e8345210166286880bf619210528dab0f7228163e9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fe4841d6e0499e4978779a2b55699747048461a74aa334c65e2de8daaa46c54e
MD5 b70b3da78e6177e763781ace472b25f5
SHA1 2c9ece897535a5418b314b7257c9600009e0ce44
SHA512 81a244b31c913385c22abaee1df8c6e62176e7d88865282c608970b51c52dc57c948c33e70eab2ba061aca3d2413964c46dcb1bd9f4f4e6c5f194c9ece428526
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eae36799e650d57231b73f359eced2ab4313e1f417b46f5ed2c8e9fceadbb6b4
MD5 02e324bcaa785773d7064c084423352b
SHA1 3660085b6015f23941f282cf78cb2b2cac7dae3a
SHA512 dc1e4002bad07c418f7f5d752524b2f551acf19e1ac3408eb207609f08875bd2126313d79c91928923bf06253a921f629441c18f9ba75131cdb226f9e8985d21
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976
MD5 631f4b3792b263fdda6b265e93be4747
SHA1 1d6916097d419198bfdf78530d59d0d9f3e12d45
SHA512 e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe
MD5 SHA1 SHA512

Submit Download

memory/508-214-0x00000194FCE40000-0x00000194FCE50000-memory.dmp

Download

memory/508-166-0x00000194FCE40000-0x00000194FCE50000-memory.dmp

Download

memory/508-220-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/508-128-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/508-130-0x00000194FCE40000-0x00000194FCE50000-memory.dmp

Download

memory/508-133-0x00000194FCE40000-0x00000194FCE50000-memory.dmp

Download

memory/672-957-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/672-632-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2572-323-0x000001878B580000-0x000001878B590000-memory.dmp

Download

memory/2572-287-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/2572-290-0x000001878B580000-0x000001878B590000-memory.dmp

Download

memory/2572-372-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/2572-368-0x000001878B580000-0x000001878B590000-memory.dmp

Download

memory/2836-462-0x00007FFCC2E00000-0x00007FFCC37EC000-memory.dmp

Download

memory/2836-392-0x00007FFCC2E00000-0x00007FFCC37EC000-memory.dmp

Download

memory/2836-394-0x000002A21BCE0000-0x000002A21BCF0000-memory.dmp

Download

memory/2836-395-0x000002A21BCE0000-0x000002A21BCF0000-memory.dmp

Download

memory/2836-418-0x000002A21BCE0000-0x000002A21BCF0000-memory.dmp

Download

memory/2836-453-0x000002A21BCE0000-0x000002A21BCF0000-memory.dmp

Download

memory/3012-512-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/3012-517-0x000002176EB50000-0x000002176EB60000-memory.dmp

Download

memory/3012-520-0x000002176EB50000-0x000002176EB60000-memory.dmp

Download

memory/3076-129-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/3076-213-0x0000026886AA0000-0x0000026886AB0000-memory.dmp

Download

memory/3076-221-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/3076-131-0x0000026886AA0000-0x0000026886AB0000-memory.dmp

Download

memory/3076-134-0x0000026886AA0000-0x0000026886AB0000-memory.dmp

Download

memory/3076-163-0x0000026886AA0000-0x0000026886AB0000-memory.dmp

Download

memory/3208-284-0x000001B3FA640000-0x000001B3FA650000-memory.dmp

Download

memory/3208-281-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/3208-283-0x000001B3FA640000-0x000001B3FA650000-memory.dmp

Download

memory/3208-378-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/3208-320-0x000001B3FA640000-0x000001B3FA650000-memory.dmp

Download

memory/3208-374-0x000001B3FA640000-0x000001B3FA650000-memory.dmp

Download

memory/4032-499-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4032-388-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4032-386-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4140-507-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/4140-509-0x000002906E030000-0x000002906E040000-memory.dmp

Download

memory/4368-109-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/4368-12-0x0000017AFE6E0000-0x0000017AFE702000-memory.dmp

Download

memory/4368-52-0x0000017AFE710000-0x0000017AFE720000-memory.dmp

Download

memory/4368-14-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/4368-28-0x0000017AFE710000-0x0000017AFE720000-memory.dmp

Download

memory/4368-104-0x0000017AFE710000-0x0000017AFE720000-memory.dmp

Download

memory/4368-26-0x0000017AFE710000-0x0000017AFE720000-memory.dmp

Download

memory/4632-100-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/4632-16-0x00000192E8460000-0x00000192E84D6000-memory.dmp

Download

memory/4632-29-0x00000192E82D0000-0x00000192E82E0000-memory.dmp

Download

memory/4632-31-0x00000192E82D0000-0x00000192E82E0000-memory.dmp

Download

memory/4632-48-0x00000192E82D0000-0x00000192E82E0000-memory.dmp

Download

memory/4632-17-0x00007FFCC2F10000-0x00007FFCC38FC000-memory.dmp

Download

memory/4632-96-0x00000192E82D0000-0x00000192E82E0000-memory.dmp

Download

memory/4796-501-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4796-498-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4796-503-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4796-502-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4796-607-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4796-606-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4812-1279-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4812-961-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4812-1277-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/5000-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5000-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5000-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5000-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5000-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5020-277-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5020-275-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5020-276-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5020-274-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5020-387-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5020-272-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/5068-458-0x000001FB4F1B0000-0x000001FB4F1C0000-memory.dmp

Download

memory/5068-486-0x000001FB4F1B0000-0x000001FB4F1C0000-memory.dmp

Download

memory/5068-490-0x00007FFCC2E00000-0x00007FFCC37EC000-memory.dmp

Download

memory/5068-415-0x000001FB4F1B0000-0x000001FB4F1C0000-memory.dmp

Download

memory/5068-413-0x000001FB4F1B0000-0x000001FB4F1C0000-memory.dmp

Download

memory/5068-401-0x00007FFCC2E00000-0x00007FFCC37EC000-memory.dmp

Download

memory/5088-273-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5088-119-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5088-222-0x000000000A530000-0x000000000AA2C000-memory.dmp

Download

memory/5088-118-0x0000000140000000-0x0000000140644400-memory.dmp

Download