e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1607s
max time network
1654s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-pljenaef83
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Contacts a large (898) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 18 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1864	netsh.exe
3860	netsh.exe
1316	netsh.exe
4144	netsh.exe
916	netsh.exe
1932	netsh.exe
2492	netsh.exe
4168	netsh.exe
2640	netsh.exe
8	netsh.exe
2724	netsh.exe
3544	netsh.exe
4932	netsh.exe
4868	netsh.exe
4536	netsh.exe
764	netsh.exe
2408	netsh.exe
2428	netsh.exe

Executes dropped EXE 10 IoCs

pid	Process
3404	svchost.exe
4884	~tl59FD.tmp
4532	svchost.exe
1560	~tl3152.tmp
3240	svchost.exe
3604	~tl1347.tmp
2492	svchost.exe
1408	~tl7C93.tmp
4616	svchost.exe
688	~tlE562.tmp

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tlE562.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tl1347.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl1347.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl7C93.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tlE562.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	~tl7C93.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\System\svchost.exe	~tl59FD.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	~tl59FD.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4888	schtasks.exe
5116	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl7C93.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	~tl7C93.tmp
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	~tl1347.tmp
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	powershell.exe
2192	powershell.exe
1392	powershell.exe
1392	powershell.exe
2192	powershell.exe
1392	powershell.exe
3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
708	powershell.exe
3420	powershell.exe
708	powershell.exe
3420	powershell.exe
708	powershell.exe
3420	powershell.exe
4884	~tl59FD.tmp
4884	~tl59FD.tmp
1492	powershell.exe
1492	powershell.exe
2496	powershell.exe
1492	powershell.exe
2496	powershell.exe
2496	powershell.exe
4884	~tl59FD.tmp
4884	~tl59FD.tmp
4532	svchost.exe
4532	svchost.exe
1952	powershell.exe
1952	powershell.exe
1952	powershell.exe
364	powershell.exe
364	powershell.exe
364	powershell.exe
1560	~tl3152.tmp
1560	~tl3152.tmp
4252	powershell.exe
4252	powershell.exe
1384	powershell.exe
1384	powershell.exe
4252	powershell.exe
1384	powershell.exe
3240	svchost.exe
3240	svchost.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe
3604	~tl1347.tmp
3604	~tl1347.tmp
4712	powershell.exe
4712	powershell.exe
4248	powershell.exe
4712	powershell.exe
4248	powershell.exe
4248	powershell.exe
2492	svchost.exe
2492	svchost.exe
2256	powershell.exe
3688	powershell.exe
3688	powershell.exe
2256	powershell.exe
3688	powershell.exe
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	2192	powershell.exe
Token: SeSecurityPrivilege	2192	powershell.exe
Token: SeTakeOwnershipPrivilege	2192	powershell.exe
Token: SeLoadDriverPrivilege	2192	powershell.exe
Token: SeSystemProfilePrivilege	2192	powershell.exe
Token: SeSystemtimePrivilege	2192	powershell.exe
Token: SeProfSingleProcessPrivilege	2192	powershell.exe
Token: SeIncBasePriorityPrivilege	2192	powershell.exe
Token: SeCreatePagefilePrivilege	2192	powershell.exe
Token: SeBackupPrivilege	2192	powershell.exe
Token: SeRestorePrivilege	2192	powershell.exe
Token: SeShutdownPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeSystemEnvironmentPrivilege	2192	powershell.exe
Token: SeRemoteShutdownPrivilege	2192	powershell.exe
Token: SeUndockPrivilege	2192	powershell.exe
Token: SeManageVolumePrivilege	2192	powershell.exe
Token: 33	2192	powershell.exe
Token: 34	2192	powershell.exe
Token: 35	2192	powershell.exe
Token: 36	2192	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeIncreaseQuotaPrivilege	3420	powershell.exe
Token: SeSecurityPrivilege	3420	powershell.exe
Token: SeTakeOwnershipPrivilege	3420	powershell.exe
Token: SeLoadDriverPrivilege	3420	powershell.exe
Token: SeSystemProfilePrivilege	3420	powershell.exe
Token: SeSystemtimePrivilege	3420	powershell.exe
Token: SeProfSingleProcessPrivilege	3420	powershell.exe
Token: SeIncBasePriorityPrivilege	3420	powershell.exe
Token: SeCreatePagefilePrivilege	3420	powershell.exe
Token: SeBackupPrivilege	3420	powershell.exe
Token: SeRestorePrivilege	3420	powershell.exe
Token: SeShutdownPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeSystemEnvironmentPrivilege	3420	powershell.exe
Token: SeRemoteShutdownPrivilege	3420	powershell.exe
Token: SeUndockPrivilege	3420	powershell.exe
Token: SeManageVolumePrivilege	3420	powershell.exe
Token: 33	3420	powershell.exe
Token: 34	3420	powershell.exe
Token: 35	3420	powershell.exe
Token: 36	3420	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2192	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 3692 wrote to memory of 2192	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 3692 wrote to memory of 1392	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 3692 wrote to memory of 1392	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 3692 wrote to memory of 4888	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 3692 wrote to memory of 4888	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 3692 wrote to memory of 3404	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	81
PID 3692 wrote to memory of 3404	3692	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	81
PID 3404 wrote to memory of 3420	3404	svchost.exe	83
PID 3404 wrote to memory of 3420	3404	svchost.exe	83
PID 3404 wrote to memory of 708	3404	svchost.exe	85
PID 3404 wrote to memory of 708	3404	svchost.exe	85
PID 3404 wrote to memory of 4884	3404	svchost.exe	87
PID 3404 wrote to memory of 4884	3404	svchost.exe	87
PID 4884 wrote to memory of 712	4884	~tl59FD.tmp	88
PID 4884 wrote to memory of 712	4884	~tl59FD.tmp	88
PID 4884 wrote to memory of 2492	4884	~tl59FD.tmp	90
PID 4884 wrote to memory of 2492	4884	~tl59FD.tmp	90
PID 4884 wrote to memory of 4168	4884	~tl59FD.tmp	92
PID 4884 wrote to memory of 4168	4884	~tl59FD.tmp	92
PID 4884 wrote to memory of 1492	4884	~tl59FD.tmp	93
PID 4884 wrote to memory of 1492	4884	~tl59FD.tmp	93
PID 4884 wrote to memory of 2496	4884	~tl59FD.tmp	96
PID 4884 wrote to memory of 2496	4884	~tl59FD.tmp	96
PID 4884 wrote to memory of 4744	4884	~tl59FD.tmp	98
PID 4884 wrote to memory of 4744	4884	~tl59FD.tmp	98
PID 4884 wrote to memory of 5116	4884	~tl59FD.tmp	100
PID 4884 wrote to memory of 5116	4884	~tl59FD.tmp	100
PID 4884 wrote to memory of 4532	4884	~tl59FD.tmp	102
PID 4884 wrote to memory of 4532	4884	~tl59FD.tmp	102
PID 4532 wrote to memory of 3536	4532	svchost.exe	103
PID 4532 wrote to memory of 3536	4532	svchost.exe	103
PID 4532 wrote to memory of 3860	4532	svchost.exe	105
PID 4532 wrote to memory of 3860	4532	svchost.exe	105
PID 4532 wrote to memory of 4868	4532	svchost.exe	107
PID 4532 wrote to memory of 4868	4532	svchost.exe	107
PID 4532 wrote to memory of 1952	4532	svchost.exe	109
PID 4532 wrote to memory of 1952	4532	svchost.exe	109
PID 4532 wrote to memory of 364	4532	svchost.exe	111
PID 4532 wrote to memory of 364	4532	svchost.exe	111
PID 4532 wrote to memory of 1560	4532	svchost.exe	113
PID 4532 wrote to memory of 1560	4532	svchost.exe	113
PID 1560 wrote to memory of 4736	1560	~tl3152.tmp	114
PID 1560 wrote to memory of 4736	1560	~tl3152.tmp	114
PID 1560 wrote to memory of 1316	1560	~tl3152.tmp	116
PID 1560 wrote to memory of 1316	1560	~tl3152.tmp	116
PID 1560 wrote to memory of 4536	1560	~tl3152.tmp	118
PID 1560 wrote to memory of 4536	1560	~tl3152.tmp	118
PID 1560 wrote to memory of 4252	1560	~tl3152.tmp	120
PID 1560 wrote to memory of 4252	1560	~tl3152.tmp	120
PID 1560 wrote to memory of 1384	1560	~tl3152.tmp	122
PID 1560 wrote to memory of 1384	1560	~tl3152.tmp	122
PID 3240 wrote to memory of 2488	3240	svchost.exe	125
PID 3240 wrote to memory of 2488	3240	svchost.exe	125
PID 3240 wrote to memory of 2640	3240	svchost.exe	127
PID 3240 wrote to memory of 2640	3240	svchost.exe	127
PID 3240 wrote to memory of 2408	3240	svchost.exe	129
PID 3240 wrote to memory of 2408	3240	svchost.exe	129
PID 3240 wrote to memory of 1284	3240	svchost.exe	131
PID 3240 wrote to memory of 1284	3240	svchost.exe	131
PID 3240 wrote to memory of 2808	3240	svchost.exe	133
PID 3240 wrote to memory of 2808	3240	svchost.exe	133
PID 3240 wrote to memory of 3604	3240	svchost.exe	136
PID 3240 wrote to memory of 3604	3240	svchost.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:4888
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- - C:\Users\Admin\AppData\Local\Temp\~tl59FD.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl59FD.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:712
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2492
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2496
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:4744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:5116
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:3536
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3860
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:364
    - - C:\Users\Admin\AppData\Local\Temp\~tl3152.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tl3152.tmp
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1560
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:4736
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1316
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4536
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4252
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1384

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:2488
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2640
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Windows\TEMP\~tl1347.tmp
  C:\Windows\TEMP\~tl1347.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:2448
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:2428
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4248

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2492
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  - Modifies data under HKEY_USERS
  PID:4636
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:8
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Windows\TEMP\~tl7C93.tmp
  C:\Windows\TEMP\~tl7C93.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1408
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:3804
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3544
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4288

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4616
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1864
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3696
- C:\Windows\TEMP\~tlE562.tmp
  C:\Windows\TEMP\~tlE562.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:688
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:3556
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1932
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
MD5 268b890dae39e430e8b127909067ed96
SHA1 35939515965c0693ef46e021254c3e73ea8c4a2b
SHA512 abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5d26d5ff6726ca53d3a507133cdc20ec05d48254b579e3e52ae0ace82ee612e6
MD5 73a24f612e878d0b934a39fe35bc615a
SHA1 484949edddbd4a281ed29f055b6da804022c4423
SHA512 f8d81e947a50160cb6b3d4d348719dea68377eb53631aa94ba8ae58235a66d5c743f1114180e03b2242c708dcc72cc9b06264f5155d580a7429c975e24251c97
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 583203b2ca50ddab959a42c176f7250b2b44b3693979c8a7845796e8f6383753
MD5 bac5178d31e1de458a9a25e926457615
SHA1 8453dd66a89c92a37100f847ba733e6216bec2bb
SHA512 00df9e6162cba57d0edc103745223077d4f5a10a75a0eb92632973c9227f0dc654b4f2289d1b2a9174f53909f09f8cf0a96f0e3b15e5561550509a626183098f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1106c90f26f6d5d3929935b61d138f75148b821a4e493fc1089961a68067c898
MD5 248e6c1deeb2dbab36005b9f0e00f24b
SHA1 1d370512dc789f4bee46a9ac8a1e76683387b0dd
SHA512 8e46ccf0e73180b0b3cb530b8edb2f6e75327ed9b6d05c7fde888581b91a0e84ff6dd8de4fcfe33a84d0ae44050b835dfd279135902f93a8930569c3c835723d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e289a519771fe74ff56c4936c77a33dcb4ff210818021713ccd02c455a969836
MD5 d0b73ff20adb16138629e5ad606e0e4b
SHA1 2e790f76c19b08015f4a3b217e6b3378355d0b9f
SHA512 4257a42f963c006b1dc666c571aaee4cb92f3d3e8284d1a70da8b4d9fcc8d2021543f2a8a68a893eb1300c7306fc3d397c0435120a9e01d637c709c497ff3881
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 91ce22770f2d6e6bbc82c4c28d087938a2a621b6d53532a7c77753e71d6e6598
MD5 67f82781e9a3ab9e969e54a643f34152
SHA1 ed051a7b3e8e8c76526ad7e9bf9e8f9dcea2dcc6
SHA512 28a5f11a5138ff45c73e38eb0eb4a4bf03f59cdc476ab76fba2a15136657b7f4e2a9bd477f6b0ac8da9c7de67b6a31b308c768ff4dececdd122f2f485ed5fda9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_qpeg2zb4.1qk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpeg2zb4.1qk.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

~tl3152.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl3152.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tl59FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl59FD.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 12.5MB
SHA256 c3a844d0e76868a8898142e34d96ea32a52d4cda760e73b8efa47aa71a7b3677
MD5 c9aeed9bb5e36d5b47609ca2a87b4cd1
SHA1 6a843f70edae76829c21bd45f620de5eb371b77d
SHA512 7c3fbbf102ae94fddf5ad21893975692cbd6c79ca26f36364e93f1318c19c213d867f4aa2119efc84a7764bb1a75e5a95dbe3831e11e533cfc0a96feacee6f09
SSDEEP 24576:q6YoF8/E+nQeJz1dzvpvECPAe5VR/gI5hZ+mAEGA7FS00Q5mpAbVlA4X99BQGyW3:dEELvAdYq1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c918bf6bad93b653f9d05007634b088be7b91ed4350b777905d0520d93d650eb
MD5 478f1c1fcff584f4f440469ed71d2d43
SHA1 0900e9dc39580d527c145715f985a5a86e80b66c
SHA512 4ed62f2add77e0dd8e07e101ee06bdb8a15808b701c7580b09704bd4befdecf7cfe2fa29d6e96f2149a92f4e1b0cae0d9810a5cde3f4940145f8120f7322d1a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c1ef61433c2ed33241ef562cf99be05d18e22ed6d27394337eac4558d2be51c5
MD5 e1b328ddc70189ccfeccf6b40150d4f0
SHA1 7808b3ab0acc6e7d61823448f5e99268a461b79a
SHA512 f249373a2c0f41b911e41d99598dcac800fbd161eaa9daf2497ba881503189dcb44d371e24cad0226bd24919eb6e66b46176155982b2508e17552201521615b2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3132ffaa68dbbccf3127fd0eeb0c470e2af227d5d93a42d830eaf9f5a64939d6
MD5 1858451431ae7b03c84c87fcbb000d51
SHA1 c79e259e2716bd457667af78baa3c9acf63562c1
SHA512 24ccfc235dfd2ccb3caf65190b8eed8cfad0e61eaff7352bbc29541f5588f56e60bd761f2300ab90ff3298ee165c2bc112015d959b23d015cc836a539eab1e27
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 240B
SHA256 4689c53fdc171ec7b82f2c5db6c72737cff7667b756a6032ff106ffe7830f4a3
MD5 3480183f55f2d89dbd4cccbe9900a854
SHA1 0e0bb598f5115840cc591b62d834f3ef763f4abf
SHA512 30e138a6bda0f10011a5f4e7b218a59169e646dfbed1ab8e7f2f4c800a7c265117d402184306dd26139f677e3ef737d96a71d97b4f3e45adddac8b52b6d98881
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61b14b9cdc7d69af43e8cdbaefb0b30d060bf7bf8286fadb61e4b2e4ccab7ce4
MD5 e3b158ba9452f5eacd016884bdf89010
SHA1 63c57073d12f5fae99252d3848f2972f04d275fa
SHA512 56c6364817ad1fe6c2194e403e78b64bdd7f8113c34405d78312fca44ca35a1a62de431ee656f4633fa9b423e6d1f3e1ee22b818df73c6ba8f941bb9c1979228
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ada1d940732df50a3884b19c50846a1b89619a9307c4e618e6caa2aaae8fb203
MD5 82c544da8fe5d7bba6a0e239940bbbf6
SHA1 d626dcb8b573a6751a4b4cd22ac8a3ceb592dd8f
SHA512 4fe2773135c001e2e9d4df54ef3277e983b440485c4c1d77d284d65031b679ee70f27e1248145de9945cd8f49f738eec153d3a55c54c967c5a9c2cf4877e3eb6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ea7a13ba25de7fd2201bae2b2fd5ef36eff668fb1e2db71a1226c03eb27b4f31
MD5 1ae6221f80aa9e2f533b5723b45fc272
SHA1 1e06cc4d83bf115fd48ad931c67214a2555468d0
SHA512 c4b1cd4112ce2baf145c6e42244a376c6a50b31fb0ef7d9c674302705d82c6142966b1e2ce552f47acd6857bd46b6916263549c369aa70e4464dadbd28068c82
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f
MD5 302a7c179ef577c237c5418fb770fd27
SHA1 343ef00d1357a8d2ff6e1143541a8a29435ed30c
SHA512 f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699
MD5 SHA1 SHA512

Submit Download

memory/364-444-0x000001DD1B900000-0x000001DD1B910000-memory.dmp

Download

memory/364-396-0x000001DD1B900000-0x000001DD1B910000-memory.dmp

Download

memory/364-477-0x000001DD1B900000-0x000001DD1B910000-memory.dmp

Download

memory/364-395-0x000001DD1B900000-0x000001DD1B910000-memory.dmp

Download

memory/364-481-0x00007FFC94800000-0x00007FFC951EC000-memory.dmp

Download

memory/364-391-0x00007FFC94800000-0x00007FFC951EC000-memory.dmp

Download

memory/708-125-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/708-127-0x0000012BEC9B0000-0x0000012BEC9C0000-memory.dmp

Download

memory/708-129-0x0000012BEC9B0000-0x0000012BEC9C0000-memory.dmp

Download

memory/708-159-0x0000012BEC9B0000-0x0000012BEC9C0000-memory.dmp

Download

memory/708-216-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/1384-549-0x000001FC605D0000-0x000001FC605E0000-memory.dmp

Download

memory/1384-506-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/1384-509-0x000001FC605D0000-0x000001FC605E0000-memory.dmp

Download

memory/1384-510-0x000001FC605D0000-0x000001FC605E0000-memory.dmp

Download

memory/1384-588-0x000001FC605D0000-0x000001FC605E0000-memory.dmp

Download

memory/1392-98-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/1392-93-0x00000268CB670000-0x00000268CB680000-memory.dmp

Download

memory/1392-48-0x00000268CB670000-0x00000268CB680000-memory.dmp

Download

memory/1392-11-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/1492-359-0x00007FFC94870000-0x00007FFC9525C000-memory.dmp

Download

memory/1492-273-0x00000185F3070000-0x00000185F3080000-memory.dmp

Download

memory/1492-298-0x00000185F3070000-0x00000185F3080000-memory.dmp

Download

memory/1492-349-0x00000185F3070000-0x00000185F3080000-memory.dmp

Download

memory/1492-272-0x00007FFC94870000-0x00007FFC9525C000-memory.dmp

Download

memory/1560-600-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1560-492-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1560-491-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1560-494-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1560-489-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1560-493-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/1952-447-0x000001AE3C960000-0x000001AE3C970000-memory.dmp

Download

memory/1952-382-0x00007FFC94800000-0x00007FFC951EC000-memory.dmp

Download

memory/1952-386-0x000001AE3C960000-0x000001AE3C970000-memory.dmp

Download

memory/1952-385-0x000001AE3C960000-0x000001AE3C970000-memory.dmp

Download

memory/1952-468-0x00007FFC94800000-0x00007FFC951EC000-memory.dmp

Download

memory/1952-409-0x000001AE3C960000-0x000001AE3C970000-memory.dmp

Download

memory/2192-12-0x000001CCC6E40000-0x000001CCC6E50000-memory.dmp

Download

memory/2192-15-0x000001CCC6DA0000-0x000001CCC6DC2000-memory.dmp

Download

memory/2192-19-0x000001CCDF420000-0x000001CCDF496000-memory.dmp

Download

memory/2192-9-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/2192-50-0x000001CCC6E40000-0x000001CCC6E50000-memory.dmp

Download

memory/2192-100-0x000001CCC6E40000-0x000001CCC6E50000-memory.dmp

Download

memory/2192-105-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/2496-368-0x00007FFC94870000-0x00007FFC9525C000-memory.dmp

Download

memory/2496-364-0x000001C3CDE30000-0x000001C3CDE40000-memory.dmp

Download

memory/2496-283-0x000001C3CDE30000-0x000001C3CDE40000-memory.dmp

Download

memory/2496-277-0x00007FFC94870000-0x00007FFC9525C000-memory.dmp

Download

memory/2496-282-0x000001C3CDE30000-0x000001C3CDE40000-memory.dmp

Download

memory/2496-323-0x000001C3CDE30000-0x000001C3CDE40000-memory.dmp

Download

memory/3240-625-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3240-954-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3404-263-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3404-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3404-217-0x000000000A530000-0x000000000AA2C000-memory.dmp

Download

memory/3420-161-0x00000234DE900000-0x00000234DE910000-memory.dmp

Download

memory/3420-203-0x00000234DE900000-0x00000234DE910000-memory.dmp

Download

memory/3420-215-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/3420-120-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/3420-126-0x00000234DE900000-0x00000234DE910000-memory.dmp

Download

memory/3420-128-0x00000234DE900000-0x00000234DE910000-memory.dmp

Download

memory/3604-958-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3604-1276-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3692-112-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3692-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3692-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3692-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3692-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4252-501-0x000001AD79BF0000-0x000001AD79C00000-memory.dmp

Download

memory/4252-500-0x000001AD79BF0000-0x000001AD79C00000-memory.dmp

Download

memory/4252-540-0x000001AD79BF0000-0x000001AD79C00000-memory.dmp

Download

memory/4252-497-0x00007FFC94BD0000-0x00007FFC955BC000-memory.dmp

Download

memory/4532-377-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4532-376-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4532-490-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4532-379-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4884-378-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4884-267-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4884-266-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4884-265-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4884-262-0x0000000140000000-0x000000014015E400-memory.dmp

Download