e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1198s
max time network
1203s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plfc1aef75
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Contacts a large (632) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 14 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2540	netsh.exe
1584	netsh.exe
4612	netsh.exe
216	netsh.exe
3240	netsh.exe
2196	netsh.exe
2328	netsh.exe
5004	netsh.exe
4576	netsh.exe
3952	netsh.exe
2068	netsh.exe
3096	netsh.exe
4304	netsh.exe
3696	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	~tl48A3.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	~tl7380.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
3328	svchost.exe
2492	~tl7380.tmp
1608	svchost.exe
4016	~tl48A3.tmp
1928	svchost.exe
3208	~tlDB6E.tmp
2912	svchost.exe
1488	~tl3F7B.tmp

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tlDB6E.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl3F7B.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl7380.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tl7380.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1616	schtasks.exe
4964	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tlDB6E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl3F7B.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	~tlDB6E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1036	powershell.exe
2704	powershell.exe
2704	powershell.exe
1036	powershell.exe
2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
3264	powershell.exe
2020	powershell.exe
3264	powershell.exe
2020	powershell.exe
2492	~tl7380.tmp
2492	~tl7380.tmp
4640	powershell.exe
4640	powershell.exe
3264	powershell.exe
3264	powershell.exe
2492	~tl7380.tmp
2492	~tl7380.tmp
1608	svchost.exe
1608	svchost.exe
2420	powershell.exe
2420	powershell.exe
3392	powershell.exe
3392	powershell.exe
4016	~tl48A3.tmp
4016	~tl48A3.tmp
4376	powershell.exe
4376	powershell.exe
3540	powershell.exe
3540	powershell.exe
1928	svchost.exe
1928	svchost.exe
4240	powershell.exe
4240	powershell.exe
2628	powershell.exe
2628	powershell.exe
3208	~tlDB6E.tmp
3208	~tlDB6E.tmp
2912	powershell.exe
2084	powershell.exe
2084	powershell.exe
2912	powershell.exe
2912	svchost.exe
2912	svchost.exe
3228	powershell.exe
3228	powershell.exe
1124	powershell.exe
1124	powershell.exe
1488	~tl3F7B.tmp
1488	~tl3F7B.tmp
1760	powershell.exe
1760	powershell.exe
2372	powershell.exe
2372	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1036	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	93
PID 2576 wrote to memory of 1036	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	93
PID 2576 wrote to memory of 2704	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	94
PID 2576 wrote to memory of 2704	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	94
PID 2576 wrote to memory of 1616	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	97
PID 2576 wrote to memory of 1616	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	97
PID 2576 wrote to memory of 3328	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 2576 wrote to memory of 3328	2576	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 3328 wrote to memory of 2020	3328	svchost.exe	102
PID 3328 wrote to memory of 2020	3328	svchost.exe	102
PID 3328 wrote to memory of 3264	3328	svchost.exe	104
PID 3328 wrote to memory of 3264	3328	svchost.exe	104
PID 3328 wrote to memory of 2492	3328	svchost.exe	106
PID 3328 wrote to memory of 2492	3328	svchost.exe	106
PID 2492 wrote to memory of 4092	2492	~tl7380.tmp	107
PID 2492 wrote to memory of 4092	2492	~tl7380.tmp	107
PID 2492 wrote to memory of 3096	2492	~tl7380.tmp	109
PID 2492 wrote to memory of 3096	2492	~tl7380.tmp	109
PID 2492 wrote to memory of 4304	2492	~tl7380.tmp	111
PID 2492 wrote to memory of 4304	2492	~tl7380.tmp	111
PID 2492 wrote to memory of 4640	2492	~tl7380.tmp	113
PID 2492 wrote to memory of 4640	2492	~tl7380.tmp	113
PID 2492 wrote to memory of 3264	2492	~tl7380.tmp	115
PID 2492 wrote to memory of 3264	2492	~tl7380.tmp	115
PID 2492 wrote to memory of 4404	2492	~tl7380.tmp	117
PID 2492 wrote to memory of 4404	2492	~tl7380.tmp	117
PID 2492 wrote to memory of 4964	2492	~tl7380.tmp	119
PID 2492 wrote to memory of 4964	2492	~tl7380.tmp	119
PID 2492 wrote to memory of 1608	2492	~tl7380.tmp	121
PID 2492 wrote to memory of 1608	2492	~tl7380.tmp	121
PID 1608 wrote to memory of 1580	1608	svchost.exe	122
PID 1608 wrote to memory of 1580	1608	svchost.exe	122
PID 1608 wrote to memory of 216	1608	svchost.exe	124
PID 1608 wrote to memory of 216	1608	svchost.exe	124
PID 1608 wrote to memory of 3696	1608	svchost.exe	126
PID 1608 wrote to memory of 3696	1608	svchost.exe	126
PID 1608 wrote to memory of 2420	1608	svchost.exe	128
PID 1608 wrote to memory of 2420	1608	svchost.exe	128
PID 1608 wrote to memory of 3392	1608	svchost.exe	130
PID 1608 wrote to memory of 3392	1608	svchost.exe	130
PID 1608 wrote to memory of 4016	1608	svchost.exe	132
PID 1608 wrote to memory of 4016	1608	svchost.exe	132
PID 4016 wrote to memory of 3880	4016	~tl48A3.tmp	133
PID 4016 wrote to memory of 3880	4016	~tl48A3.tmp	133
PID 4016 wrote to memory of 2328	4016	~tl48A3.tmp	135
PID 4016 wrote to memory of 2328	4016	~tl48A3.tmp	135
PID 4016 wrote to memory of 2540	4016	~tl48A3.tmp	137
PID 4016 wrote to memory of 2540	4016	~tl48A3.tmp	137
PID 4016 wrote to memory of 4376	4016	~tl48A3.tmp	139
PID 4016 wrote to memory of 4376	4016	~tl48A3.tmp	139
PID 4016 wrote to memory of 3540	4016	~tl48A3.tmp	141
PID 4016 wrote to memory of 3540	4016	~tl48A3.tmp	141
PID 1928 wrote to memory of 1000	1928	svchost.exe	144
PID 1928 wrote to memory of 1000	1928	svchost.exe	144
PID 1928 wrote to memory of 1584	1928	svchost.exe	146
PID 1928 wrote to memory of 1584	1928	svchost.exe	146
PID 1928 wrote to memory of 3952	1928	svchost.exe	148
PID 1928 wrote to memory of 3952	1928	svchost.exe	148
PID 1928 wrote to memory of 4240	1928	svchost.exe	150
PID 1928 wrote to memory of 4240	1928	svchost.exe	150
PID 1928 wrote to memory of 2628	1928	svchost.exe	152
PID 1928 wrote to memory of 2628	1928	svchost.exe	152
PID 1928 wrote to memory of 3208	1928	svchost.exe	154
PID 1928 wrote to memory of 3208	1928	svchost.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1616
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\~tl7380.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl7380.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:4092
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3096
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:4404
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:4964
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:1580
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:216
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\~tl48A3.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tl48A3.tmp
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4016
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:3880
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2328
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:1000
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1584
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:3952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\TEMP\~tlDB6E.tmp
  C:\Windows\TEMP\~tlDB6E.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:2324
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:5004
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2912
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:1588
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4576
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\TEMP\~tl3F7B.tmp
  C:\Windows\TEMP\~tl3F7B.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:2244
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2068
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 26209c196c9c45202d27468ea707b2b46f375bb612d50271924a28f9210df6a1
MD5 750e4be22a6fdadd7778a388198a9ee3
SHA1 8feb2054d8a3767833dd972535df54f0c3ab6648
SHA512 b0415087dfc32908b449b876b395a607698b0f7b72031916b6fe7c002e4b163ba318b7e85c8ce41f007429e666974c04967bc14345e3f4614e34d94f5c8ae804
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710
MD5 ef647504cf229a16d02de14a16241b90
SHA1 81480caca469857eb93c75d494828b81e124fda0
SHA512 a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2621d6be25df3c54d7e9659387e405b45ba3cbe4ab3884583116df0d08b1c417
MD5 066e9e3e70e51aaf987b315d2b54427d
SHA1 fa4ca7aece7dc00874fa43e9d785773e88921c8a
SHA512 03f513acdebc58582c528408aa7536513831c43a03e5678fcd921022c0cfc3dfcb509c138b6244de31b234a0eeea87f57774edeacdb11bab3f2370c2228d8260
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16
MD5 cae60f0ddddac635da71bba775a2c5b4
SHA1 386f1a036af61345a7d303d45f5230e2df817477
SHA512 28ed8a8bc132ef56971cfd7b517b17cdb74a7f8c247ef6bff232996210075e06aa58a415825a1e038cfb547ad3dc6882bf1ca1b68c5b360ef0512a1440850253
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 20f12589048e701c05f50cdff1df194161e947a7fccb7facf6bd84b443ebffc4
MD5 f1d088a05614c7bb2014374c62d4f562
SHA1 fc3de5ab99fdd347d408f884679cab5d30a7e61b
SHA512 f46d9b7cb4657caa9053b04f3841fe4e4c3b554f6598c2ab2ccd72b608f5ca706799758ca6bb3cd61ce6cc45046ee42d5d6c8086f5877de1a2249cd33ec643ac
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_bq4v223c.gdz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bq4v223c.gdz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

~tl48A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl48A3.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tl7380.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl7380.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 7.0MB
SHA256 7d287b2901c4d082621e70e26fbf191e146837f46207dea193f9e97f0023327f
MD5 600577239a6f34248ebd80b79940b2f4
SHA1 bc0fea465be7236b7580c3a3b5e4b9a975485476
SHA512 2ca585ce64a4f8f07f23ebadf1da0711618569ce20c42a3052b2fb47c11224ce599768e1c8386cd936ade8c122e4c52a7733098c4af65e205c967db885c22fe1
SSDEEP 24576:0v/nPxCtTM7YstmLWpFBA6f7gi+o5Eqcswc6IbA3ith+EJEu+Bc41AcOjf9eoy64:gm6r0fh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c9e294b278566fc67bfe3e179e3a8a8202cb0d9c5d88067383ccb924d3e123b
MD5 a3cfb10d5c8b5c64d7ffb2764e7a5b62
SHA1 927f7b2ca2a3053123d4bba64fa758a62f656acf
SHA512 a4a2363a1d2e42a63552d41f3d10524a9aa2d73057d63d3ce1b12db53c2b11cacd7586909b565c1bf7a50131ede39ab15e8e077e0e6af6fab5a039427d3f4beb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 664B
SHA256 b74d49c17fc31f1a143024a6a0a214da62e0cc9fd6cee2a28a801e6f5513d248
MD5 9b7e8a743e906dd42bd1cd887463ddee
SHA1 4ac0cc2e5cfc748dc0fba743adefb641dc00201c
SHA512 d7b46d9990d94a7ece5abdb7141ddbd17e38da47579e4d71767f707ccfa8454178257301aef84173aa34dba8d21935e8d901ea7f65cce5308e06081546f0eb26
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dec9e943b9c8fbc1f5e3b46434f24dea0ae3fa798fa5ac9182b2acfa6f67d5d9
MD5 8c05e675f27458186149d0b3ae285ab9
SHA1 d766403004bb73251c3293d472fc40058a0456e1
SHA512 9bd8ff1d0284541b631cf8505b3712f11e41e5fb4480c6c68b2ec501062be17922e3cad25881fceaca9b05b6a058000a2b9a87cab3611157d39209a3424870e4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 796B
SHA256 7984387bca36d060a5822be86d48ccdbec8b2b15f3733eac78b2e1a13dbdb360
MD5 96c80f70ddba083aca13d8962434aad2
SHA1 5371d33807844f86022d89bb8e3f1837421aa0cb
SHA512 74997e3a5825154b3b05636f237ded2bf4949636b5c3831e45f8d353cb38d2249b58d05b54f32e77e214b5c260b022e9e1bba6931909d995ff03a5e4735a2add
MD5 SHA1 SHA512

Submit Download

memory/1036-28-0x000001D441180000-0x000001D441190000-memory.dmp

Download

memory/1036-36-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/1036-29-0x000001D441180000-0x000001D441190000-memory.dmp

Download

memory/1036-26-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/1608-214-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1608-172-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1608-173-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1608-175-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1928-342-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1928-271-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1928-273-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2020-51-0x00000230932D0000-0x00000230932E0000-memory.dmp

Download

memory/2020-79-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/2020-54-0x00000230932D0000-0x00000230932E0000-memory.dmp

Download

memory/2020-50-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/2420-186-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/2420-187-0x000002CF9FD90000-0x000002CF9FDA0000-memory.dmp

Download

memory/2420-188-0x000002CF9FD90000-0x000002CF9FDA0000-memory.dmp

Download

memory/2420-193-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/2492-131-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2492-132-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2492-130-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2492-174-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2492-129-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2492-127-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2576-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2576-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2576-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2576-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2576-46-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2628-321-0x000001E873C60000-0x000001E873C7C000-memory.dmp

Download

memory/2628-323-0x000001E873CA0000-0x000001E873CBA000-memory.dmp

Download

memory/2628-310-0x00007FF44EDC0000-0x00007FF44EDD0000-memory.dmp

Download

memory/2628-288-0x000001E872D80000-0x000001E872D90000-memory.dmp

Download

memory/2628-287-0x000001E872D80000-0x000001E872D90000-memory.dmp

Download

memory/2628-286-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/2704-24-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/2704-25-0x0000014FB4EA0000-0x0000014FB4EB0000-memory.dmp

Download

memory/2704-27-0x0000014FB4EA0000-0x0000014FB4EB0000-memory.dmp

Download

memory/2704-32-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/2704-23-0x0000014FB4F20000-0x0000014FB4F42000-memory.dmp

Download

memory/3208-402-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3208-346-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3264-66-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/3264-160-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3264-52-0x000001156CA20000-0x000001156CA30000-memory.dmp

Download

memory/3264-53-0x000001156CA20000-0x000001156CA30000-memory.dmp

Download

memory/3264-76-0x00007FFEE36C0000-0x00007FFEE4181000-memory.dmp

Download

memory/3264-149-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3264-150-0x000001C4C04B0000-0x000001C4C04C0000-memory.dmp

Download

memory/3264-151-0x000001C4C04B0000-0x000001C4C04C0000-memory.dmp

Download

memory/3328-49-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3328-80-0x0000000010000000-0x00000000104FC000-memory.dmp

Download

memory/3328-128-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3392-190-0x0000021DD6530000-0x0000021DD6540000-memory.dmp

Download

memory/3392-205-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3392-189-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3392-192-0x0000021DD6530000-0x0000021DD6540000-memory.dmp

Download

memory/3540-234-0x000001E271660000-0x000001E271670000-memory.dmp

Download

memory/3540-248-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3540-232-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/3540-233-0x000001E271660000-0x000001E271670000-memory.dmp

Download

memory/4016-217-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4016-213-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4016-218-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4016-250-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4016-215-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4016-216-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4240-322-0x0000015DEF070000-0x0000015DEF07A000-memory.dmp

Download

memory/4240-276-0x0000015DEE590000-0x0000015DEE5A0000-memory.dmp

Download

memory/4240-320-0x0000015DEE580000-0x0000015DEE58A000-memory.dmp

Download

memory/4240-309-0x0000015DEF2C0000-0x0000015DEF375000-memory.dmp

Download

memory/4240-308-0x00007FF4562E0000-0x00007FF4562F0000-memory.dmp

Download

memory/4240-307-0x0000015DEF050000-0x0000015DEF06C000-memory.dmp

Download

memory/4240-275-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/4376-245-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/4376-221-0x000002D54BC70000-0x000002D54BC80000-memory.dmp

Download

memory/4376-220-0x000002D54BC70000-0x000002D54BC80000-memory.dmp

Download

memory/4376-219-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/4640-157-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download

memory/4640-133-0x00007FFEE4140000-0x00007FFEE4C01000-memory.dmp

Download