f911a357abf083c321d7240e1070b470c9d2a64c1503700dbec45980c88c0aa4

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Majid Z Hacker Website.exe
Size

127KB
MD5

b4d0b69f3c391acca7128a66abd480f7
SHA1

8ccac1861f4c544c51a5c7d4a0fb32796ab30488
SHA256

349b87c3ebd55cab9daa375c468b62be416063af859a16bed78cf4bd06fb5c07
SHA512

9578df157aafc7740e12952d1abba08fa9e032fc73073e1787fffb7e24ce6963d98d7bdd4539297be0123626efdfccb63c7dea411d82ceef7bf6197ff2806ff1
SSDEEP

3072:iqRaMrUwmuvDWLcg0CmHmFXfy57jQtMrpGIXFb177dWVqu:inx1FWmxf87UIXpl7dWVR

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\script.vbs	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WScript.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

752 netsh.exe

pid	process
752	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Majid Z Hacker Website.exeWScript.exeWScript.exewindows.exemicrosoft corporation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Majid Z Hacker Website.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	microsoft corporation.exe

Drops startup file 4 IoCs

Processes:

windows.exemicrosoft corporation.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e23fc64d012fb66b44b10cd7ea0e2414.exe	microsoft corporation.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e23fc64d012fb66b44b10cd7ea0e2414.exe	microsoft corporation.exe

Executes dropped EXE 4 IoCs

Processes:

microsoft corporation.exewindows.exewindows.exemicrosoft corporation.exe

pid process

3860 microsoft corporation.exe
3760 windows.exe
3640 windows.exe
3240 microsoft corporation.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3860	microsoft corporation.exe
3760	windows.exe
3640	windows.exe
3240	microsoft corporation.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

windows.exemicrosoft corporation.exewindows.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Updates\\windows.exe"	windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Updates\\windows.exe"	windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e23fc64d012fb66b44b10cd7ea0e2414 = "\"C:\\ProgramData\\microsoft corporation.exe\" .."	microsoft corporation.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e23fc64d012fb66b44b10cd7ea0e2414 = "\"C:\\ProgramData\\microsoft corporation.exe\" .."	microsoft corporation.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe"	windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe"	windows.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

windows.exe

description	ioc	process
File created	C:\autorun.inf	windows.exe
File opened for modification	C:\autorun.inf	windows.exe
File created	F:\autorun.inf	windows.exe
File opened for modification	F:\autorun.inf	windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

Majid Z Hacker Website.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings Majid Z Hacker Website.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Majid Z Hacker Website.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemicrosoft corporation.exe

pid	process
4028	powershell.exe
4028	powershell.exe
2368	powershell.exe
2368	powershell.exe
1080	powershell.exe
1080	powershell.exe
3684	powershell.exe
3684	powershell.exe
4508	powershell.exe
4508	powershell.exe
5104	powershell.exe
5104	powershell.exe
2736	powershell.exe
2736	powershell.exe
4620	powershell.exe
4620	powershell.exe
3272	powershell.exe
3272	powershell.exe
4228	powershell.exe
4228	powershell.exe
4028	powershell.exe
4028	powershell.exe
1080	powershell.exe
5104	powershell.exe
4508	powershell.exe
5112	powershell.exe
5112	powershell.exe
3684	powershell.exe
2368	powershell.exe
4228	powershell.exe
5112	powershell.exe
4620	powershell.exe
3272	powershell.exe
3860	microsoft corporation.exe
3860	microsoft corporation.exe
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemicrosoft corporation.exemicrosoft corporation.exe

description	pid	process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	3860	microsoft corporation.exe
Token: SeDebugPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe
Token: 33	3240	microsoft corporation.exe
Token: SeIncBasePriorityPrivilege	3240	microsoft corporation.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

windows.exewindows.exe

pid process

3760 windows.exe
3640 windows.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

windows.exewindows.exe

pid process

3760 windows.exe
3640 windows.exe

pid	process
3760	windows.exe
3640	windows.exe

pid	process
3760	windows.exe
3640	windows.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

Majid Z Hacker Website.exeWScript.exeWScript.exewindows.exemicrosoft corporation.exemicrosoft corporation.exe

description	pid	process	target process
PID 1616 wrote to memory of 3860	1616	Majid Z Hacker Website.exe	microsoft corporation.exe
PID 1616 wrote to memory of 3860	1616	Majid Z Hacker Website.exe	microsoft corporation.exe
PID 1616 wrote to memory of 3860	1616	Majid Z Hacker Website.exe	microsoft corporation.exe
PID 1616 wrote to memory of 3760	1616	Majid Z Hacker Website.exe	windows.exe
PID 1616 wrote to memory of 3760	1616	Majid Z Hacker Website.exe	windows.exe
PID 1616 wrote to memory of 436	1616	Majid Z Hacker Website.exe	WScript.exe
PID 1616 wrote to memory of 436	1616	Majid Z Hacker Website.exe	WScript.exe
PID 1616 wrote to memory of 436	1616	Majid Z Hacker Website.exe	WScript.exe
PID 436 wrote to memory of 1572	436	WScript.exe	WScript.exe
PID 436 wrote to memory of 1572	436	WScript.exe	WScript.exe
PID 436 wrote to memory of 1572	436	WScript.exe	WScript.exe
PID 1572 wrote to memory of 1080	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 1080	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 1080	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4028	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4028	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4028	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2368	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2368	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2368	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3684	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3684	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3684	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5104	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5104	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5104	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2736	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2736	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 2736	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4228	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4228	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4228	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4508	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4508	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4508	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4620	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4620	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 4620	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3272	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3272	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 3272	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5112	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5112	1572	WScript.exe	powershell.exe
PID 1572 wrote to memory of 5112	1572	WScript.exe	powershell.exe
PID 3760 wrote to memory of 3640	3760	windows.exe	windows.exe
PID 3760 wrote to memory of 3640	3760	windows.exe	windows.exe
PID 3860 wrote to memory of 3240	3860	microsoft corporation.exe	microsoft corporation.exe
PID 3860 wrote to memory of 3240	3860	microsoft corporation.exe	microsoft corporation.exe
PID 3860 wrote to memory of 3240	3860	microsoft corporation.exe	microsoft corporation.exe
PID 3240 wrote to memory of 752	3240	microsoft corporation.exe	netsh.exe
PID 3240 wrote to memory of 752	3240	microsoft corporation.exe	netsh.exe
PID 3240 wrote to memory of 752	3240	microsoft corporation.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Majid Z Hacker Website.exe
"C:\Users\Admin\AppData\Local\Temp\Majid Z Hacker Website.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\microsoft corporation.exe
"C:\Users\Admin\AppData\Local\Temp\microsoft corporation.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860

C:\ProgramData\microsoft corporation.exe
"C:\ProgramData\microsoft corporation.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\microsoft corporation.exe" "microsoft corporation.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:752

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Roaming\Adobe\Updates\windows.exe
"C:\Users\Admin\AppData\Roaming\Adobe\Updates\windows.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\SysWOW64\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs" /elevate
3⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\windows.exe.log
Filesize
860B

MD5
c2dda6a07b935260fea374312f09cc1e

SHA1
a0af418e7dc2b37f7b7712f1f866b6a8fb425f0a

SHA256
e514619232e5f2a698f3e9bccdcff8b511ec262c562dc42926d00860bee769b4

SHA512
7268d562f3c33ea05cd772e5c05d3819d7c6c42bf5bc33649c8c70d5a9fd3f9110aea4c8c8ebf7383525a480fc0fc4f92a65746ef267329e3806480410b05100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
5905cb0e406e0e34449a81bcdc9731d1

SHA1
578b42f61f8b1bca40cacd8dc25a1f62648ae4ac

SHA256
8ec71e1dbf609709ab530ec6778ce1c47b6814a7ee081db81969ed68fb3ea7a9

SHA512
f220af1635cfefb61742c2ecdec22debb87b494d2d6f9f720f7cf0f3cf29919bc336f838e41b963f69ae85361a49960370550ff968a81d72224fa4428c242cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
4522f098f6db1933f417365e18363e39

SHA1
eeb2c0c4227c3505c88f28961feebc75e74bda27

SHA256
ced1a391ec68da29459dd4e9dc62b3534a37ec3c235e0753c4139fccd9a2751f

SHA512
5497f7feba87fc4a05df5bc7c9fc604fab12f2731c9e6da2461f0d49134f64da6b607c8791b17c112aa84fc8cb85fdc49856217568c382af000075920bc31826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
8848bcccbfd0c7a301ce895f25d09838

SHA1
b8045cf49df7f6aea86fd5a6e7bc57bca722706f

SHA256
81df5c3e36a7cd874ae9a09f31de01a748cc6d9897e0375471d75f992bf91987

SHA512
f179e7291d2aad739a7e4d665aaec508252229a6d08490ef3c5be672721ad0c8187f399ea9f804ffd37a4b3e42d3a052e9da3ff439d368a46f0fcf1f5372420f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
73dd75799de2b342a1df2dfc6a54319b

SHA1
d8b2bbf143aa4e783cac26f0733e958bd0ee22a6

SHA256
360748c5136395ae45195c8c1b756bf56aa09a928c12870c41d06e52d2ddfde3

SHA512
8ec1d0858624a5bf6db6aee06ad1acdd850333990414497c4c88483090b67a35d9d53afd693ec1dd1966adaa09638f93f5a7a8faa5516ef1b44ffdd0975c1298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
a123815f5b1ac24f83a6429a0877b435

SHA1
4d2ea47ee5022e7d5861688ad4e0791807f46db2

SHA256
af7d1785013f2778adf581b2f6e4f17a9cdfee6b3242ef2c2e1b71cceaedda60

SHA512
bb590cbd632eb8ef7ee83b2388bb6721c5f79088c6e03e6cb45553ba3bed38823623ef9df99da3e0b50fd1e60192173a9c34b9507b052f6dc98ca697b2e89f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlc4ihxe.x4x.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\melt.txt
Filesize
45B

MD5
c65dda57254957c2ad83b548c55b42a5

SHA1
d88daf5dd37726325a30a3078c254128f5579f85

SHA256
adae127291a1d4f70e9ff1258044a01d95176fd9bb2c303ab94f3e62db429a44

SHA512
d74c977dd16046f024a6b012322dcfd0380fcc58a5db5e96d350852723bc1404d49a67d6185210711a24b9aeb94974212f4e056590e0742937821a459ba628b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\microsoft corporation.exe
Filesize
33KB

MD5
23fb3146d1455b890afdbd9511b48351

SHA1
9e0118366167c76de2d88fb354606d5e58677eb7

SHA256
58c8e3599d16762dfc51decf16c3d014cd8c8dd1aab59a0acff5372c5182bda7

SHA512
92a816b16f854cb19a28a9bd186223dd3f7961800b6486b32be1f270b26a0240c0f68ebe0f6c555b72f0e3388f3aa1a061fad50c0b09aaec1af9de1185fc8cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\script.vbs
Filesize
1KB

MD5
77a4da4863ffcaba51ce05d3c632158d

SHA1
253f9a594a6ca3a7a23acb90f8dc81939215ba4b

SHA256
ecd586281fc4655e40108fcf118beeae3411c1c1176951a763e47fb66d2e421f

SHA512
ba215fa65a011f5841f5e92b4053895c13368e894817551a982ca3e821726b8bbb13616bca8781fed08f4c83528d0d3ac233fa1f3e14ad4253fdefd9a22253cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
Filesize
145KB

MD5
aa4ba7df205e6f0dc8d847ab3c3681c2

SHA1
bb8c96c2f736f1d5f1923fc3b20f53b890b98e46

SHA256
59a0bd599e306457164b08b7fe23bbf4fe92b202beaad836d6faa28da61073ca

SHA512
0f8f57de1251e3102d1db2c72ed7c3f7cc1d12c3ce561a275d4d280944f77952970464c553da3ce6ce88e9462033818ed186e83eba1b8853d16d28bcc7140450

Download Submit
memory/1080-179-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/1080-156-0x0000000006120000-0x000000000616C000-memory.dmp

Filesize
304KB

Download
memory/1080-151-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/1080-209-0x00000000072E0000-0x0000000007383000-memory.dmp

Filesize
652KB

Download
memory/1080-36-0x0000000005250000-0x0000000005272000-memory.dmp

Filesize
136KB

Download
memory/1080-37-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/1080-38-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/1080-40-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/2368-286-0x0000000007E40000-0x0000000007E4E000-memory.dmp

Filesize
56KB

Download
memory/2368-287-0x0000000007E50000-0x0000000007E64000-memory.dmp

Filesize
80KB

Download
memory/2368-288-0x0000000007F50000-0x0000000007F6A000-memory.dmp

Filesize
104KB

Download
memory/2368-34-0x0000000002FC0000-0x0000000002FF6000-memory.dmp

Filesize
216KB

Download
memory/2368-289-0x0000000007F30000-0x0000000007F38000-memory.dmp

Filesize
32KB

Download
memory/2368-189-0x0000000006E40000-0x0000000006E5E000-memory.dmp

Filesize
120KB

Download
memory/2368-169-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/2368-168-0x0000000007AC0000-0x0000000007AF2000-memory.dmp

Filesize
200KB

Download
memory/2736-255-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/3272-276-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/3684-254-0x00000000077C0000-0x0000000007856000-memory.dmp

Filesize
600KB

Download
memory/3684-232-0x0000000007520000-0x000000000753A000-memory.dmp

Filesize
104KB

Download
memory/3684-275-0x0000000007740000-0x0000000007751000-memory.dmp

Filesize
68KB

Download
memory/3684-210-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/3684-233-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/3760-30-0x000000001C9F0000-0x000000001CA8C000-memory.dmp

Filesize
624KB

Download
memory/3760-27-0x00000000017A0000-0x00000000017B0000-memory.dmp

Filesize
64KB

Download
memory/3760-25-0x000000001BDB0000-0x000000001BE56000-memory.dmp

Filesize
664KB

Download
memory/3760-28-0x00007FFE7BCB5000-0x00007FFE7BCB6000-memory.dmp

Filesize
4KB

Download
memory/3760-145-0x00007FFE7BA00000-0x00007FFE7C3A1000-memory.dmp

Filesize
9.6MB

Download
memory/3760-29-0x000000001C480000-0x000000001C94E000-memory.dmp

Filesize
4.8MB

Download
memory/3760-31-0x00007FFE7BA00000-0x00007FFE7C3A1000-memory.dmp

Filesize
9.6MB

Download
memory/3760-39-0x000000001DCF0000-0x000000001DFFE000-memory.dmp

Filesize
3.1MB

Download
memory/3760-32-0x000000001BE60000-0x000000001BE68000-memory.dmp

Filesize
32KB

Download
memory/3760-33-0x000000001CBF0000-0x000000001CC3C000-memory.dmp

Filesize
304KB

Download
memory/3860-167-0x0000000074020000-0x00000000745D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-26-0x0000000074020000-0x00000000745D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-23-0x0000000074020000-0x00000000745D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-20-0x0000000074022000-0x0000000074023000-memory.dmp

Filesize
4KB

Download
memory/4028-211-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/4028-35-0x00000000057D0000-0x0000000005DF8000-memory.dmp

Filesize
6.2MB

Download
memory/4228-234-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/4508-199-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/4620-244-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/5104-231-0x0000000007C30000-0x00000000082AA000-memory.dmp

Filesize
6.5MB

Download
memory/5104-190-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download
memory/5112-265-0x0000000073E80000-0x0000000073ECC000-memory.dmp

Filesize
304KB

Download