9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9

Analysis

max time kernel
300s
max time network
304s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe
Size 32.3MB
Sample240607-azzw8sff25
SHA256 9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9
MD5 e0a55162b5dcbced35871b2d231d00b0
SHA1 94290227df417cdedd9490ee86c8ade2419a29d7
SHA512 2ae874c56609c37e2f6740e98e1d4cf9147c15e5b618e37338e56492a9d0ac72eae63147ba3e1ecdf2313f1c946f1783fbc2d27f083e2567861bc4f6bee67361
SSDEEP 393216:7z+xbRsFxOneTyARk9kr2ed5c/Yc73o49Fi05cVGF/FGdOrrdSo:7u9sFD+ng2qq/1746FD+8/FGdOrr0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe
4204	powershell.exe
4656	powershell.exe
2148	powershell.exe
2856	powershell.exe
704	powershell.exe
4868	powershell.exe
3068	powershell.exe
4364	powershell.exe
2028	powershell.exe
4136	powershell.exe
4700	powershell.exe
4300	powershell.exe
4300	powershell.exe
4868	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3960	9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe
8	winsvc.exe
4312	winsvc.exe
1860	WINCFG.EXE
3612	WINNET.EXE

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\data\netDb\rT\routerInfo-TVYCmLfkONtcMepxLFIj4OHGMXfHPKhmoJaf-tkNa2U=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rW\routerInfo-WekPyXC4XGQSMl8hCxOp6t9kdc2pJCdVkpJtrdzdJ1w=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\data\netDb\r0\routerInfo-0Z0u8n5MnqtmBeeYeJnnT8Cs4qTWyHK8jrwOdUOZbP0=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rZ\routerInfo-Ze1qQG9JRYBrYqygfpRMmxTueaMrJsVjU5eWpddsD2I=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rt\routerInfo-tJHHRgs9Dr04vFisCaEJKWL7uQFAz3UUmTWsL4N0N3U=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rt\routerInfo-tM9oEj59yc54zvWUn84cKPS0S2JpZ~bZ~8A-FdTragU=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rg\routerInfo-gJ~CLfQo8XCfMMRKb0vGsqG2cMVTUsWle4FaLqOncBo=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r3\routerInfo-35dH3Zs2KYv2ujyUQOyKvCQr4enNJs-BbBxyXgSpxNo=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rA\routerInfo-AftVb3RKDekveCaLWN55970yiPN7ZomjHQQdb1SweKA=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r9\routerInfo-9UpDLX1xGqa0oezir7n9B-6OJSf1YtzrEez8jVzdwfs=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rk\routerInfo-kqWHla2cpGjSA8P~8uFyMuki3Wfi6LDfDfZWcE8spao=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rC\routerInfo-CIdtQA9mnlhNa9wLlU1ZkkjW0GL8TiRExkEuY3b-dRo=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rt\routerInfo-tApQ7dqLvohm-MpR4VZA4QuqqI5ei-9Sk0BngqmBvTM=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rL\routerInfo-LOQ6MDANnx2TEq0F-Z~7uwmH4u-~E-VIEt2Tmv94ZvI=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rF\routerInfo-F1L-QR1LNG1~rmTmrel-CMcWmHFjxqyBL83EQ~Yd0~Y=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r1\routerInfo-10twsWjFIQNm-epJbb9XO~3rDQH4op05OS9-ipOdc3Y=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rE\routerInfo-EPZd9xeuq1sPPJtoyLco7qjTVVYo8KCkL~zNip9-y7E=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rL\routerInfo-LjBCWdmoBzqOxYvkJA8L8KEUbMqJvW7vo8yNsmpldWw=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rL\routerInfo-LCVNvDL3FzQsvzPhSTuS0Ueqj~q-rQxuVRBYr0SVC2k=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rr\routerInfo-r2gKTUWqU69nenn1FvArWkA5Gl3dCxBndWV8div3ojs=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r6\routerInfo-6PG1ESuQkQyYSZbvkUpCBvk8a2P6XQ7lGkWm-cs426w=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r6\routerInfo-6LK598i7Mp2DbzGCQoUkBtQ6hGyLN3HuJHnnwjTAiyg=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rj\routerInfo-jreRwjmWmCpGX0HzFWqkInnETlR~GheqBOcFN2z6RGY=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r9\routerInfo-9JibBz2h7DOMtjQkNJlC0oCuck6CX-GMeNpF1cj1UYo=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r9\routerInfo-9n-PGawZ04SKh7rs74YRip7SJheGn56Q3LzkgZEm2U8=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\data\netDb\ry\routerInfo-y6IY7o~qyroUSKTVQ-HEr0meuwxJ4Vm7iqtP6yoRjPA=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\data\netDb\rL\routerInfo-LSJakspcbMw6AvneXTU1dI-EVGVYaDwEAmb15C7jNR0=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rW\routerInfo-W-FaI2tdh0bm20T93V6JiCmBLX8eHq6TvBlno6qF0uM=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rA\routerInfo-AbME6ppDJSKkikGxwS9dxsTko9x~Nt7x5xz7n0~wKl4=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rS\routerInfo-S2UqSZY7cNoJDAz18B5iRWEBIt34rgvz~lzsqqBUN4Y=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rZ\routerInfo-ZTW8ILpzBk2Wsea2t4SUSUf2zXaLZKvw1Li~6pqt3po=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rz\routerInfo-zOTfm3lcwuaegC~PlwqWVQVaXbSRh0RejfBmzlEAdvM=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rr\routerInfo-rbzH~EumFOhcWyPQ2ffOMiOs3fRARg9SZxLkjS-Bo0Y=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\data\netDb\rp\routerInfo-pgENcrk--FR5ubkoMUnpD0jstVuv~zGh9wDr3dimztE=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\ro\routerInfo-onjR2Et2hLSvokqE7b7LtThEgD~GhKo6q0raO9zoITI=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rw\routerInfo-wy0iMoXJcM1pvRZ~6qt8vT1BiVxsp8CRaiWTn1DRzBI=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rI\routerInfo-IZ05v0TKZKueJUrwcVpg4VNe-vg6GkWMre-xlvvTqs4=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rV\routerInfo-VUlgkpwfvkxQ70dSuN4SBNUxh9KMAX5dgNjIpXI44yE=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\ry\routerInfo-yqY9u0GEj86njtGXxB5G-OXEtp4uLGpEI4qtG7NgX68=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rW\routerInfo-WaiAO7RKzeRim5vBxLVWyzbnJOsj9WLVdh6cPTxz-2o=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r0\routerInfo-0AqenC-ZFlPd~uBU2vca26ku94mGQuM33~S9UvAeD24=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rs\routerInfo-s7L3HxLzulzt17kHMsqgLYxNSzlera7sJCkw2bZHNDk=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rr\routerInfo-rcjTzdvEPBbMfbbbugZNRWNe9kaFsBYV~Iual19877c=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rn\routerInfo-nEZ~nSjlfav6~TzktxLkBKeum8in8K6qEvjDqLpv8Kc=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rk\routerInfo-kqTOynAB4L1KoHKNkagivcd4-bzUwPZGSQtfbEKzk-M=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rP\routerInfo-PKbpQxfoV64FLJUHP-FSPd~6dRgPlvNuyqpBlEmU~GY=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rn\routerInfo-nHat3PL9iTIsGksuwGCOOICn2RDrnQHs5w~Grn9LoMY=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\netDb\rB\routerInfo-B9ryMllc8NYI9PW7ZTDoHLTykRGxyiqSPf31ujI5Lks=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r0\routerInfo-0QbYDBNHJnDhsSiXpl63EiXlD5LVfG3J87DTc3s8~ns=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rj\routerInfo-j9Fe9Kd3BfBRX4tc34i-dvBLauUlcf9sHeebBMIj~ws=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rn\routerInfo-nfVjgZBN4bWF8~6SdMrKv4I4tjw0avNxSAlzRTpQheU=.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\netDb\rK\routerInfo-K64CrI4MATjrpuv7U83O6vrDV1FpVCa3uIe8CLKLenk=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\re\routerInfo-enXThU6TgL9SRYIsL8B5S76TwF3HNI4bP2cjrlbYaA4=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r3\routerInfo-3pL0JiF4IV9r6yQgJR2h0n2f-1x0niEMMyHx58qrhJ4=.dat	WINNET.EXE
File created	C:\Windows\system32\data\destinations\urctcyk6otflpno3qfecobnd3wjzbgqxg4veiyztgkoocwh5v7tq.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rA\routerInfo-ASs3ZbebPc7AnHYlndm~GFllRdbMaXkSTQET47fErh0=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rd\routerInfo-d16mZCxrFUnHcXoocStZ8E55m8hDXf8M-p7rbGdUXNw=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rR\routerInfo-RCtlzeEbg7wZQ4ar30YS2hji9jccW6ZvQ36QzaLXSEk=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r~\routerInfo-~OTNd-HhgVbQoCBgfAR5Lzi9SFmGglG1~WpQWJS0cxM=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\r1\routerInfo-1raAFupalt1-5x8W9gXdcXlxBiM35C8ff1wMYFrDVqw=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rV\routerInfo-VpMspLjZMRQ1~SX3AZMR9VZKBufrhdEgQzppU6Zeh7E=.dat	WINNET.EXE
File created	C:\Windows\system32\data\netDb\rN\routerInfo-NdgGJiL5A4l5iE6~YIba4RwvfB9VRMFZhmgYDM11SEg=.dat	WINNET.EXE

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4256	sc.exe
792	sc.exe
4292	sc.exe
1860	sc.exe

Kills process with taskkill 12 IoCs

evasion

pid	Process
1836	taskkill.exe
4972	taskkill.exe
2224	taskkill.exe
2940	taskkill.exe
1004	taskkill.exe
1388	taskkill.exe
364	taskkill.exe
2456	taskkill.exe
2560	taskkill.exe
984	taskkill.exe
3436	taskkill.exe
4352	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4300	powershell.exe
4300	powershell.exe
4300	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe
4312	winsvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4300	powershell.exe
Token: SeIncreaseQuotaPrivilege	4300	powershell.exe
Token: SeSecurityPrivilege	4300	powershell.exe
Token: SeTakeOwnershipPrivilege	4300	powershell.exe
Token: SeLoadDriverPrivilege	4300	powershell.exe
Token: SeSystemtimePrivilege	4300	powershell.exe
Token: SeBackupPrivilege	4300	powershell.exe
Token: SeRestorePrivilege	4300	powershell.exe
Token: SeShutdownPrivilege	4300	powershell.exe
Token: SeSystemEnvironmentPrivilege	4300	powershell.exe
Token: SeUndockPrivilege	4300	powershell.exe
Token: SeManageVolumePrivilege	4300	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeBackupPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	4868	powershell.exe
Token: SeUndockPrivilege	4868	powershell.exe
Token: SeManageVolumePrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeShutdownPrivilege	4780	powercfg.exe
Token: SeCreatePagefilePrivilege	4780	powercfg.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeShutdownPrivilege	3304	powercfg.exe
Token: SeCreatePagefilePrivilege	3304	powercfg.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	1540	powercfg.exe
Token: SeCreatePagefilePrivilege	1540	powercfg.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeShutdownPrivilege	3984	powercfg.exe
Token: SeCreatePagefilePrivilege	3984	powercfg.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	1516	powercfg.exe
Token: SeCreatePagefilePrivilege	1516	powercfg.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2148	powershell.exe
Token: SeSecurityPrivilege	2148	powershell.exe
Token: SeTakeOwnershipPrivilege	2148	powershell.exe
Token: SeLoadDriverPrivilege	2148	powershell.exe
Token: SeSystemtimePrivilege	2148	powershell.exe
Token: SeBackupPrivilege	2148	powershell.exe
Token: SeRestorePrivilege	2148	powershell.exe
Token: SeShutdownPrivilege	2148	powershell.exe
Token: SeSystemEnvironmentPrivilege	2148	powershell.exe
Token: SeUndockPrivilege	2148	powershell.exe
Token: SeManageVolumePrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3960	3748	9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe	75
PID 3748 wrote to memory of 3960	3748	9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe	75
PID 3960 wrote to memory of 8	3960	9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe	76
PID 3960 wrote to memory of 8	3960	9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe	76
PID 8 wrote to memory of 4136	8	winsvc.exe	77
PID 8 wrote to memory of 4136	8	winsvc.exe	77
PID 4136 wrote to memory of 4292	4136	powershell.exe	79
PID 4136 wrote to memory of 4292	4136	powershell.exe	79
PID 8 wrote to memory of 704	8	winsvc.exe	80
PID 8 wrote to memory of 704	8	winsvc.exe	80
PID 704 wrote to memory of 1860	704	powershell.exe	82
PID 704 wrote to memory of 1860	704	powershell.exe	82
PID 8 wrote to memory of 2672	8	winsvc.exe	83
PID 8 wrote to memory of 2672	8	winsvc.exe	83
PID 2672 wrote to memory of 4256	2672	powershell.exe	85
PID 2672 wrote to memory of 4256	2672	powershell.exe	85
PID 8 wrote to memory of 4700	8	winsvc.exe	86
PID 8 wrote to memory of 4700	8	winsvc.exe	86
PID 4700 wrote to memory of 792	4700	powershell.exe	88
PID 4700 wrote to memory of 792	4700	powershell.exe	88
PID 4312 wrote to memory of 4300	4312	winsvc.exe	90
PID 4312 wrote to memory of 4300	4312	winsvc.exe	90
PID 4312 wrote to memory of 4868	4312	winsvc.exe	93
PID 4312 wrote to memory of 4868	4312	winsvc.exe	93
PID 4312 wrote to memory of 4364	4312	winsvc.exe	95
PID 4312 wrote to memory of 4364	4312	winsvc.exe	95
PID 4364 wrote to memory of 4780	4364	powershell.exe	97
PID 4364 wrote to memory of 4780	4364	powershell.exe	97
PID 4312 wrote to memory of 4204	4312	winsvc.exe	98
PID 4312 wrote to memory of 4204	4312	winsvc.exe	98
PID 4204 wrote to memory of 3304	4204	powershell.exe	100
PID 4204 wrote to memory of 3304	4204	powershell.exe	100
PID 4312 wrote to memory of 3068	4312	winsvc.exe	101
PID 4312 wrote to memory of 3068	4312	winsvc.exe	101
PID 3068 wrote to memory of 1540	3068	powershell.exe	103
PID 3068 wrote to memory of 1540	3068	powershell.exe	103
PID 4312 wrote to memory of 2028	4312	winsvc.exe	104
PID 4312 wrote to memory of 2028	4312	winsvc.exe	104
PID 2028 wrote to memory of 3984	2028	powershell.exe	106
PID 2028 wrote to memory of 3984	2028	powershell.exe	106
PID 4312 wrote to memory of 4656	4312	winsvc.exe	107
PID 4312 wrote to memory of 4656	4312	winsvc.exe	107
PID 4656 wrote to memory of 1516	4656	powershell.exe	109
PID 4656 wrote to memory of 1516	4656	powershell.exe	109
PID 4312 wrote to memory of 4352	4312	winsvc.exe	110
PID 4312 wrote to memory of 4352	4312	winsvc.exe	110
PID 4312 wrote to memory of 2456	4312	winsvc.exe	113
PID 4312 wrote to memory of 2456	4312	winsvc.exe	113
PID 4312 wrote to memory of 1836	4312	winsvc.exe	115
PID 4312 wrote to memory of 1836	4312	winsvc.exe	115
PID 4312 wrote to memory of 4972	4312	winsvc.exe	117
PID 4312 wrote to memory of 4972	4312	winsvc.exe	117
PID 4312 wrote to memory of 2148	4312	winsvc.exe	119
PID 4312 wrote to memory of 2148	4312	winsvc.exe	119
PID 4312 wrote to memory of 2856	4312	winsvc.exe	121
PID 4312 wrote to memory of 2856	4312	winsvc.exe	121
PID 4312 wrote to memory of 984	4312	winsvc.exe	123
PID 4312 wrote to memory of 984	4312	winsvc.exe	123
PID 4312 wrote to memory of 2224	4312	winsvc.exe	125
PID 4312 wrote to memory of 2224	4312	winsvc.exe	125
PID 4312 wrote to memory of 1004	4312	winsvc.exe	127
PID 4312 wrote to memory of 1004	4312	winsvc.exe	127
PID 4312 wrote to memory of 2940	4312	winsvc.exe	129
PID 4312 wrote to memory of 2940	4312	winsvc.exe	129

C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe
"C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9-42a24e747bf55824\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe
  "C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9-42a24e747bf55824\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\winsvc.exe
    "C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9-42a24e747bf55824\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
        5⤵
        Launches sc.exe
        
        PID:4292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
        5⤵
        Launches sc.exe
        
        PID:1860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
        5⤵
        Launches sc.exe
        
        PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" start winsvc
        5⤵
        Launches sc.exe
        
        PID:792

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  PID:984
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  PID:2224
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  PID:1004
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  PID:2940
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  PID:2560
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  PID:1388
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  PID:364
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  PID:3436
- C:\WINDOWS\SYSTEM32\WINCFG.EXE
  "C:\WINDOWS\SYSTEM32\WINCFG.EXE"
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\WINDOWS\SYSTEM32\WINNET.EXE
  "C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 a166e551d09fc5f77e4ede547e3dc521b71f4b5c07b93f16de2b0f976fed6751
MD5 1cfe572f8a58e5c315192b2262b19389
SHA1 0ee01be5ceb2f4c1769d1461a33900abb85879ea
SHA512 7820fe3c45dd79a37c31d4a5a03a167b254f0e2eb5b9acf374944ffbebc3e2c919d494cdfcbf7d4d9e8142dac21d1c0e1c7e56fbfe337e8336e5302d88bcaa2f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8898436145a58dfb23968ad9be8494300c72871570fcff7d2c3e9edc19c5147
MD5 dbc93788fb8ec67457676537071edcfc
SHA1 7637b6a8ab7b2dee39d4bc9ae25b9f3432fea189
SHA512 08bdb8bfe7bb1e662b429a4ec0432285908565fc1ab34eff332873289cea90756758bb9de77c6d0358421976c4b67dd9d269e982cfaa9075bee45dead1a9ebda
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 40302e77ee0ee6d33d971fe7ac897466e0f2810f773b1762d70ccc11f0534ee1
MD5 04b297cd427d251218508d814f4cf0c5
SHA1 d9a91c825b24fbef812fb970e930fd85aed32e74
SHA512 a601863f2aae5cb25d2700bae46ef7bd7c9db6f3b1c5006c0d5cfa68ad1d4c77e148de6a87cec42de3d18d63a7f129506eb09fbf9086e719fb2c7cee1f5acb8e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e6dbc9230e3bb3cf463113a225256b66ca51015f4f891709b7374d4e69a9936
MD5 06482001c5b0268edff7b4dd24ef5faa
SHA1 cf6a1dd0d947a746a31adec00b1ac87c966dd53d
SHA512 b45423806a618c5ba714585babd58d529a6244a33c270d959dc235f709e9fa69abb7e8cfdde576a3f129ab6c4242e5133fe23b9e914d298430ac795f46582ed6
MD5 SHA1 SHA512

Submit Download

9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe

Path C:\Users\Admin\AppData\Local\Temp\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9-42a24e747bf55824\9c0a4d4e7eab8b61015041b7a160eb76abd8d96c7d821a006b1d98e28da0f4f9.exe
Size 41.7MB
SHA256 8f2c8aa98033bfcd9454cd4500901f67d463d906c10738ceeef92bd57d1c0388
MD5 e4d3985ebce671bc56d25eee558d049b
SHA1 d9301184167e089b8f45a6cc0f69f055ecccbccf
SHA512 cdccbff06132230ba8c32f08f499751eb00467a19fde47aec8d3f74e216b6b97432f3c5e730182eac1e88396e9c4876e523cd5d8caeed94012cbcaa8116632df
SSDEEP 393216:EDcz4rZq2Gsjjd3rvwLDwgWwwyTtd3LFUop1b:uczB+3bwvXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0voj00yl.2c0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0voj00yl.2c0.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

wincfg.exe

Path C:\Windows\System32\wincfg.exe
Size 34.2MB
SHA256 faf008f5223116aa68a612e502641a5c32c007aaf99ebedce902d8b23458ef68
MD5 84fe2e8cf93bfae56067fa593d04aa29
SHA1 1cb9d32df4b77172bea9e557b891e12ce1e09e9d
SHA512 b2a78596a7302907ec001094885abc34817659e209b5ba68bbcb2dfabdd52abfdc5ef5feb8641a756f12b93b892f5e8b7b4e7fd49b478c1e6c8bb97c434199b5
SSDEEP 196608:yodqwslr1J/A9Lc3jKj1kiXhK6uqyje91HR2ao:yaqllrOTGqyje91x2ao
MD5 SHA1 SHA512 SSDEEP

Submit Download

winnet.exe

Path C:\Windows\System32\winnet.exe
Size 9.1MB
SHA256 fcd362e0632b35dad13a87f09ea6da4d07fa89516f42d64236d2cc3e3b2b725b
MD5 2fdbf4ba6ab24cf44aa0cc08cd77ca66
SHA1 df5e034ba45a932b9f5d3ed7adc4a71e0b376984
SHA512 81d73f7540ede7337922dc18fc6b110c87f621bc0349c3fa17f50d1cb924b0d9b30a4a772b2d548238b65a1be43d458f1991320e7308e608c6cf40ccc3e59a51
SSDEEP 98304:qS6/G31ALxFCEhIF1R94TS5++x81d9kpiB7T/jrpayDHDG9P:V31ALKDXz+BNDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 6b592cb255b42ec8a77467d3f0be5e9b2f15f1c72bc1cc8cbe44ae2891765aee
MD5 c2d12189fe761c06e01839b1f6726332
SHA1 fc9632b32d17d489580ac22968cd5d7f7d96ded1
SHA512 828fc907f67bbceb51c3eefb06b0a744aeba36afd9aaf0a663168fbb10caf8325d98d6c8f2a07eb1da22a6d7439e56a454560fc1ef7b624b57e3b80adbb89242
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 51f3420c13c267e315fd5b760752b57aeba1c8382c622d9d98b43add92fcde86
MD5 8eb24dbb0dd8780741e9a291996e9c9e
SHA1 5cdcc5b8aeb384977abe99c5d20bff64356707b5
SHA512 735c0445446c955f64be96b6ae2d3f811b1a319fc3ca12a97f9a3dfb459a234055449b60d55f8c8d70e7e18fed63e9229b9e29966e2ee12b0f89ce60e631a6d4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1d72df53c36b125d85869fc50c5d7bcf5ea25cc5300734362cf08f94c1eec9cc
MD5 68346e904fcf607efc57037f2a6bf5ca
SHA1 da4801d2f5013fd8e923fcdd6ac318c925784888
SHA512 b5b82bcb3aceb580c463461a765a5e66cccf97bcd76fad8d92aa1dfb0b1685227dd2845d81c044bafaf9e6fdffaeccc64ce29bdfd51ebf5f30f4edc6c1e1074c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1e403c953e5b99b4f65654b92ffdc5d6ad9029376a7dca6d535397d9387e8b33
MD5 2b7c7a5bee560ffc86bca65dabd9d7b5
SHA1 8b4ae4d7b911483b13cdeaece8d41d161729834d
SHA512 c9f27e2024b0cfcd80db05562c1e2da1e6320711d30f9021c1fb8a62bcdd29d5c84f4c19c7325fef7dfb31a25499fabc3f7a4ef9cc2fb02f2a178792de0e8e1e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 13bee7590409b7ab140abbbb9432153de5dfba23db54afb0a747238a28288b58
MD5 71cef3004d04753b5f74e1d026e36e1e
SHA1 7931552a7522487fb59abf37fe2fb26a2371f119
SHA512 b00744a7ba58cd7f430d7737e698c147fb1ac7bb43a9779aa15b1ae9ada79a14076fd81c03646df0413b34f04948377d20a1b19ec5679f0ce0cd8e31955a83f0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d7e418d31f0410c00f987b09dddebcb081ea5e74806a10b2f33ec24a4de1d1fc
MD5 f74a86b140e7d00c556e788229a00f77
SHA1 70f069137da6014cb39d4039ddcf7bc3f7592fe2
SHA512 92181880b62c96a1093d8e9e391dd170a5c14f3246d3502af7e89230e5cebe889a085409819fb2a7917a8d8d9caa33463b7353f96254d4adc38034ca7b114a8b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa27ccd79856ee68addbef7309c9d5597f6e80242743a22b209af671f017eaa1
MD5 879b7f8d74ebdd50dabfa6770a486851
SHA1 3a4d7c907995ce435f69da8e40c71d670d5ee914
SHA512 38d4b444e5f70f09506bcafe4a17f695206ef3288c219e78879e15b7493e072a047c1f50bc1cdc98b1700151dcccf227a3d12c2f27f0fae2b42f5202c335b3e9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fe7ec47c1ad5caa3dfed734ce060b1a6cb3ce06532102fbfc5ccbe7b8eea8e6e
MD5 b2eec3e8cf8a01c8c71b78333badcd9b
SHA1 c1f077f08d491cd5942d036096a67b05a8a4e575
SHA512 92c8d2506d0ac4e625c4039b28bcc9d1b58be881ded599fae27fe1a8017b36a06b36e776420de1f31481a92fae69cb93a8b3835f093287272c4d63b86ed1d927
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eb87b59cda411b38998b573c116ec3ccf578a354caab1833fcbeb5398c1dfa80
MD5 d412683430a3da6cd91873aa83136d07
SHA1 0e3779aed0e20b34069d7ccdf9c207eb952e383b
SHA512 1d4559913c261eb72d91ad2af195b5f6bf9f51aca53dd5608f62ea5660950de3e8876093418cc780d2aba1048a8e24f68f4bff0e8685d21b588355e8c925454c
MD5 SHA1 SHA512

Submit Download

memory/2148-755-0x000001E09C940000-0x000001E09C95C000-memory.dmp

Download

memory/2148-544-0x000001E09C860000-0x000001E09C919000-memory.dmp

Download

memory/2148-774-0x000001E09C920000-0x000001E09C92E000-memory.dmp

Download

memory/3612-1243-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1408-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1494-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1493-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1492-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1491-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1410-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1234-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1237-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1242-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1409-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1244-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1245-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1405-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1406-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/3612-1407-0x00007FF643B80000-0x00007FF6444AC000-memory.dmp

Download

memory/4136-17-0x0000024F71120000-0x0000024F71142000-memory.dmp

Download

memory/4136-20-0x0000024F71320000-0x0000024F71396000-memory.dmp

Download

memory/4300-168-0x0000017569710000-0x000001756971A000-memory.dmp

Download

memory/4300-129-0x00000175696F0000-0x000001756970C000-memory.dmp

Download

memory/4300-135-0x0000017569DF0000-0x0000017569EA9000-memory.dmp

Download

memory/4312-100-0x00007FF6CC650000-0x00007FF6CC660000-memory.dmp

Download

memory/4312-101-0x00007FF6CC660000-0x00007FF6CC670000-memory.dmp

Download