fc9401bcdc8d6e57300a64127a7e0262672c00f7563b85ec0a55dd22ab3fbd1c

Analysis

max time kernel
115s
max time network
389s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/09/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Super_God_Mode.ps1
Size

223KB
MD5

3a83854c0848a78b8f04b5266832318c
SHA1

80f27e77d3202d50a3773a07f5db756652ebfe03
SHA256

fc9401bcdc8d6e57300a64127a7e0262672c00f7563b85ec0a55dd22ab3fbd1c
SHA512

2b3e3f40dce22711f2c5711754bf83972864f34b4e8cf136f005dc125c82cfb77a8bacc71ac1f685b15e3cdaf060f1b54ee339dcc35095655906272d442058f4
SSDEEP

3072:p0ILKTB3eTLVDShJ89d7M+t2f7tW94fcMXF6UnTs3G1qZNPAAskrtZnd/:9SeTLVDShJYJ2fpi1l/

Score

6^/10

execution

Malware Config

Signatures

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\System Settings\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\Deep Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\URL Protocols\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\Hidden App Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\__Script Result Statistics\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\CLSID Shell Folder Shortcuts\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\Special Named Folders\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\Super God Mode\All Task Links\desktop.ini	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1716	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 560031000000000084580b6212004170704461746100400009000400efbe84580b6284580b622e0000009f5201000000010000000000000000000000000000004dcb23014100700070004400610074006100000016000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 780031000000000084580b621100557365727300640009000400efbe724a0b5d84580b622e000000320500000000010000000000000000003a0000000000e6b62f0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000084584f6d100041646d696e003c0009000400efbe84580b6284584f6d2e000000945201000000010000000000000000000000000000004b945000410064006d0069006e00000014000000	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000025591254100054656d7000003a0009000400efbe84580b62255912542e000000b35201000000010000000000000000000000000000006c1c4f00540065006d007000000014000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1408	1716	powershell.exe	76
PID 1716 wrote to memory of 1408	1716	powershell.exe	76
PID 1408 wrote to memory of 4156	1408	csc.exe	77
PID 1408 wrote to memory of 4156	1408	csc.exe	77
PID 1716 wrote to memory of 292	1716	powershell.exe	78
PID 1716 wrote to memory of 292	1716	powershell.exe	78
PID 292 wrote to memory of 4124	292	csc.exe	79
PID 292 wrote to memory of 4124	292	csc.exe	79
PID 1716 wrote to memory of 2164	1716	powershell.exe	80
PID 1716 wrote to memory of 2164	1716	powershell.exe	80
PID 2164 wrote to memory of 2568	2164	csc.exe	81
PID 2164 wrote to memory of 2568	2164	csc.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Super_God_Mode.ps1
1⤵
- Drops desktop.ini file(s)
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ou3vus02\ou3vus02.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9DE.tmp" "c:\Users\Admin\AppData\Local\Temp\ou3vus02\CSC1E100D42F4324DB48F93CB20B8169D16.TMP"
    3⤵
    PID:4156
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pvysyzn1\pvysyzn1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:292
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp" "c:\Users\Admin\AppData\Local\Temp\pvysyzn1\CSC119998D3DD9D42EFBF8A9CC3B443148C.TMP"
    3⤵
    PID:4124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jjf1v2wd\jjf1v2wd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEAC8.tmp" "c:\Users\Admin\AppData\Local\Temp\jjf1v2wd\CSCF18F55594F442F698E538D128BAD563.TMP"
    3⤵
    PID:2568

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2864

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{ED7BA470-8E54-465E-825C-99712043E01C}
1⤵
PID:1220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2356

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3180

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4129138312\2337188909.pri

Filesize
70KB

MD5
e322d3c7e1754ddd018872f57a06c321

SHA1
e14924571895f52450a5771fd7345e4f3a1d4365

SHA256
c941852be0e054e38b22aeb159c5a099a2fced8820b1a9eb7c9de122b03e8e40

SHA512
d32fe6fe58c204b115fd1c487c3132b43d764bb1a12af7958c0b58ea8221dd0acbbe965d91678d8d057f87ded94e1077365af7c909d38e58b7e22608286e7f82

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Windows\4185669309\3653706970.pri

Filesize
62KB

MD5
92b5756967fe5d19ade2bcd27a007859

SHA1
14c79e384dbf750d4c774aa6cbdc7c0c411b8c5a

SHA256
52f0ac09a645f0fb0f7241b98aeef977b3260c079d6c5678716dbee50b231a3a

SHA512
05d13d94c50a24da063ac05056480989953637c37c2dc95c06c2a838f75335780cfb02a3fe521f528a0034aeb9fd7495ba4f32c8e1e590e79c33007cff976098

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE9DE.tmp

Filesize
1KB

MD5
d27d1548862afb175efacf0fc0928881

SHA1
f9918d471d03041f65f2290ceaa538771203be85

SHA256
c75768d900f0070cd67ee95fce540735621a8225387c9fbe87b92145d95e3642

SHA512
1f371c35b8b9116d0d54d4203517cb53e41bdeca0e792fdb213696a7643db9188b5b91b6bf5f5b805057383786d11d0431b9657c5c5e204d22becb7f45b2068b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp

Filesize
1KB

MD5
73bacf052354cec465e61c4adc80fa23

SHA1
aa1360047049a93b2f1b1f0860d8d7214374af23

SHA256
418c37fa5a0593d51a2d1844e6c4cd45f992c3c0f6bad0d8deaae6e0fdbae28e

SHA512
90ec11a836212c47e71e704c652b5be26ceab56d244c60a2f270ac3c1beab548e20f2cf9172447b6bc2c29ce62cc7d952669759c286a89b8761300dde55c9b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEAC8.tmp

Filesize
1KB

MD5
8a6daaac07682d46cfb77733b6e26284

SHA1
ebf8798ab1f2568b83242c2c6ea9a8bf20827365

SHA256
ce1dc3f4f4a682cc09e9c9787a5530c396bc76e278858d659ff93a511a9d6c66

SHA512
ffe81c48a02ac39ca1b43edd5fac769588ef94552a4a5a7ea5924ea37bc0d9fc4b2db27307c2496d3e473233fa8fc82540075580c468d4b459bd2e68f4df3556

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k0bdqudi.t53.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jjf1v2wd\jjf1v2wd.dll

Filesize
3KB

MD5
2791c9766aacc370f313e20ab3539a85

SHA1
db00fd8b484db620050e92bf67d347b96c7843dc

SHA256
e09c0c6a3c69099791436793832f19b784188cb0a23b36f909ed2c2ad82b29b3

SHA512
692119bd6bd3e97809fc0c6b8363550e44c4efe715b3bbf1ffbf4742d7b5627d249f30f55cb1b7430e649cab14397cb8a13c53b24c534c900eb8db85b631fe24

Download Submit
C:\Users\Admin\AppData\Local\Temp\ou3vus02\ou3vus02.dll

Filesize
3KB

MD5
f34e968b3142b9c1e0420eebc07d2625

SHA1
8a17c25af637b320661b4e45fb58fe1f25b737e5

SHA256
df640b2e0cec0785d28a83668ffc72f6eff3cdbf665794618c889e3dfe489162

SHA512
4cb83ffb293fa5c835658e154371e2f5558fbc1309355d8e6b98f4a3fbc21d7a1c185e737e302ed606db43f86cf1b5d748f903258ae314584281006b4e1e6ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\pvysyzn1\pvysyzn1.dll

Filesize
3KB

MD5
ecd563d371cd0c99bae8b1e3e041ef3b

SHA1
ab76ac0e983ed9f9ad20f9635137030154414776

SHA256
ee5b9d7dd6c60a602bcdac573759ce4b062df1e3e9084f96b93761684487f583

SHA512
d4792647290d10f63a3ee767e1641fadf6a370d703a49b95a03cfc94d9b3189965d516c514425fec4d9197e1f5e194b797ef26294615d8fbb3a24198a1fca0cd

Download Submit
C:\Users\Admin\Desktop\Super God Mode\All Task Links\How to change your Windows password.url

Filesize
202B

MD5
cbd53868f606365bd234bc4895a17e4d

SHA1
f80c7194509e12c5141f49f7f77dd4e180ef8c7d

SHA256
d83b35da3045eb6554c803f6495f32de7330e2573697968bd85949fca487ac69

SHA512
41c18687c99fd7073ac20eb7fdc1e3186594ae91c56d0aa170d9e51852bc02c8debff326571cf0b9a81d837ebbf1c1ea4790718d110fb1853c638408b1895a70

Download Submit
C:\Users\Admin\Desktop\Super God Mode\All Task Links\How to install a program.url

Filesize
204B

MD5
55b916e7fa7774c65688bd0bdf70f9a9

SHA1
ae86b4d811c71122f7adb124c77177d9bc165d84

SHA256
c25083de49d828372075f4e5323c122286041a6968dfeafd311daad312717b4c

SHA512
d8a4077063b6c19b94febb07f86cc3ea6137e88e687554cf597a246c4c26674ba0f3be311123d0019034d39c76e488c7896efef58e1adf367becef939570c7d7

Download Submit
C:\Users\Admin\Desktop\Super God Mode\All Task Links\Print the speech reference card.url

Filesize
210B

MD5
c68a3c683e75af92cf16f5c3193396c9

SHA1
943523f25bf681dc25e30fade5e93b098840f975

SHA256
325f72c9f236b9a002c75c78d276a2903869e7c6ba971e2d796e069a1b24e524

SHA512
56c0a92c8c48206e02a7706c9a6fb085ec520573480c81ceee75659be7f64e2b2d9833290f8e6c45f99be392e5c0616354aa022fb74ae79bf5e36c8ea613e91e

Download Submit
C:\Users\Admin\Desktop\Super God Mode\All Task Links\What happened to the Quick Launch toolbar_.url

Filesize
204B

MD5
0d0f38f49ea24b428fa08ae7106e4682

SHA1
3266fe8de3f2ba53be944ce2f68c1a97a872b04b

SHA256
7b42a56fcea00bec5e35fb3c7a53ba863aafc601ae0c252d4ec7d0552bec4048

SHA512
1ee4c144709aec7b249e4843142d06ffc6e4b9dabe49c65e601f52eb700d596b13ca6308c8b771d6fe55c81a4ee11efed8cf1a726e7feda1dc6ebcb6bf22b366

Download Submit
C:\Users\Admin\Desktop\Super God Mode\Deep Links\Change the search provider in Internet Explorer.lnk

Filesize
1KB

MD5
3626a6dc88ee3c6985f3d3557182015e

SHA1
6925b487fc15048af5120dea7ad5d599f35a4df5

SHA256
d975c6339dc7d64e5f6d163e6c511ffec92ebefcbeee4d4c2d1fb5008f6e2b98

SHA512
a83f010f3fc468d8d8c0fc1d4434a4284fa3f3e8d64bf702b284e84839689dadf0826b3d4e9ae709dc08efedb89877b96259b484948870aa6be42bb9dbb35625

Download Submit
C:\Users\Admin\Desktop\Super God Mode\Deep Links\Microsoft ChangJie Settings.lnk

Filesize
1KB

MD5
e902d4dfa2830f6ad8e150d3e4ccc4dc

SHA1
b9d906c6189cc818f97c51926a7eeaf1e0caa8ec

SHA256
05d17aba477a8fed028ffdd85a1fb5a32c7723bb4bc88bfcd85d01901272b131

SHA512
452e4bc28b3702a6c86ca25006f7d9749d6a0ffd72442e641e48307de117ef732bb415de946efe264cf87de8d2c99aa24d9730c745211eea5814060177b123bb

Download Submit
C:\Users\Admin\Desktop\Super God Mode\Deep Links\Microsoft New Phonetic Settings.lnk

Filesize
1KB

MD5
d993ff81bf3f3be67a9e8aff4090fac2

SHA1
ebdbdf930689fb558ef73f0420cac0ad83cf44d2

SHA256
09435fdebe1399391c1be0da240d9d29127a38394120397bc6c73542630368b4

SHA512
11b87c1db51616809e9c27a7acfe023b908f39fb1ecfab3c05b2f7a2c1277996d14e03cab3e92da288ccfcde6a421b0971158085bfa4763d01718fdc4deeaed3

Download Submit
C:\Users\Admin\Desktop\Super God Mode\Deep Links\Review your computer's status and resolve issues.lnk

Filesize
830B

MD5
5584b816233be80da21bd15cf571c746

SHA1
e72a08516153f426a2fe7bd20df58ea774493f5c

SHA256
2be55beb1f5ee5e09ec5a817a51e614059b6f40eb16fbae3d26ac34541e2ad52

SHA512
5f5765335999bc5921d25a4c6a211fe6d8d7fe5995b7f2ca2b950725e02ec61b04e47accc468fd63ca6f16b3654f1310ca94dac40b7cf7bc0de6f9d9d442a2b0

Download Submit
C:\Users\Admin\Desktop\Super God Mode\Deep Links\System.lnk

Filesize
804B

MD5
846cc9cf134cfe72f24f5e6e536dbab6

SHA1
db00553d3e12c5b98554997df01a70d5f12da247

SHA256
230734e14e520ecfb1b4bd9506aca7548567749b4af16387f94219db1716c1d9

SHA512
33b64e550dc917bffda835d21b85ce5def46f16eff64c2810fe0ec4205e6e6747a3849e791778a112d2df44474a7c5fa55ea2eeac35262ebbed7d17f3a9dc327

Download Submit
C:\Users\Admin\Desktop\Super God Mode\desktop.ini

Filesize
69B

MD5
e3435cb945c26ea98d431ca192800be5

SHA1
2c4a0896e4ac6475ef59425b1b77175529f5ce44

SHA256
6fac2e0a3f2387d1ad1f3b6d07bd6d3fc1335e34b1d68353e5a8eaddd8a19230

SHA512
b1c7d91e5d9ea2d0cea52ff030138e907ff348fc0bd36743a95ab805e1da0fc68771cbfac4d3bd6e8609fc76c529b6a773085e7058959a9fbe119c49356a1bf4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jjf1v2wd\CSCF18F55594F442F698E538D128BAD563.TMP

Filesize
652B

MD5
65c98456a106a0b995842e9b0acf29ef

SHA1
7cca01f44739323ba09e084c16e1d71538f70a2c

SHA256
c269a57d77f3b080455312a0bdcf439a649d70d7e6be6b68b552606300a04627

SHA512
ac9cd84fab6a2db3d5ea117e4c25257f31259cfdeace463e32d02e56fabf3ab6ad88cc77f75b1d8500aed5271678d52ece200976cc2532775762147317ede489

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jjf1v2wd\jjf1v2wd.0.cs

Filesize
748B

MD5
331b36a40cdece32c067a40d20408736

SHA1
44ac28aecdeeb5acf40ce7cb9c54517dd73e720f

SHA256
c849d36962539251bac3655287b12bde59b9e59123757a7e3ccc18c6e7c788c2

SHA512
6c2048f73b2e727f3cdd76db196eb8bfd7294f4d8ef33a8314926361f89842ce5dbdebcc13781c0b7ea540b4de3012eb83228808179daf0e9993e463ee9cd12e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jjf1v2wd\jjf1v2wd.cmdline

Filesize
369B

MD5
043f011e40456409b0ff0b838cb54ffc

SHA1
1d08dd293e720f475012e96f51d40806e874d3db

SHA256
6737c510d482e817ede714f2605c7bf556d497750a0e1a893d0d86a4daad7221

SHA512
cc3d77031c8dbfe22dc353b2f4b2eefe4b512a63edc3744ca8987abce60ed700090d98be24ecc33785769bfcb32a4395fc0a0a2def441c6c40d55164c7bcd7c0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ou3vus02\CSC1E100D42F4324DB48F93CB20B8169D16.TMP

Filesize
652B

MD5
ee418c98d64d26586690f8fb42e3ef18

SHA1
8d27fe9a1471f24e284dfdcbe730f9e92131514e

SHA256
9720d46ae14d5e4952c535050b0868ebd33728ae767aa796f99eac4608442bdd

SHA512
0fffd81a809f44eee8e0ef062cef8d73316f4ef01689400dfbf4cadf76d661f3620a4eeee7578bac86cdccee3f00f72a358056508cfda43fd1efa8098a66850c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ou3vus02\ou3vus02.0.cs

Filesize
1KB

MD5
f62a3326583f8495f9bbc6e647a8fada

SHA1
59ab73b1870c5817cc7d714fff9f3c89f31f0476

SHA256
83ae288bc06dd57f6bf9a7353a1ac2b7da308dc6a1a2847da4f4a437db6e5069

SHA512
7b02674bf2ecf1976b0c522e4a4140fc0cb5bcd8cf7089c3d71364cda1678f071b7ba228792700dc21639383665740743a966d5d5a99d23d980925fa71b79684

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ou3vus02\ou3vus02.cmdline

Filesize
369B

MD5
2546d9e34c3d238718c5f21a96544b49

SHA1
752b2804ec5c8f269887e4c17dc4e5cbc8fef649

SHA256
2b36b92707851fa8c7b4eb819f30a3a4a3580debfb3478abcb820c69bfd9faaa

SHA512
7aef9995dc0aba3ad5ab038568cc287037636ebebe161c7482e28df32b0283d2dbec07f4cd96d961ac73bbb08b3f937824c766f3f6b4dcfdfecd6829b25cc2e6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pvysyzn1\CSC119998D3DD9D42EFBF8A9CC3B443148C.TMP

Filesize
652B

MD5
11d7f06f76f372817f4ece80dcc8909a

SHA1
9cade179c0dc1de50718d0889f0948547f43908b

SHA256
867f5d56502bf9c194ff95cbbf37fc3cfe043be1c26b5eb5b91488d7e9b345cc

SHA512
f062d8fad775f8e0a0a908423f9ae533650ff9156fc1aaefd2ef025ce08fe341a5727a773bb7f14de6932bfe5abcdb2e2a1654ee9cac3745d8a012d8f724b620

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pvysyzn1\pvysyzn1.0.cs

Filesize
359B

MD5
b432d1d066ff07eebec2eea30c57a6cb

SHA1
a6197d5ce01ebbaa5e7d64875eb3b6fb8f5cc168

SHA256
6db4ffddb07ac610ad48049020b0a93a5ceae9f4005ac37f14df5753be743b14

SHA512
e34878c3a5ec83f2ca3814ac3a272faba97897ab60baa939061c40916604db7e488d2748030f71e35e5c7cfa391989e4d04c413c870b9af1fec294a00f50a3dd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pvysyzn1\pvysyzn1.cmdline

Filesize
369B

MD5
3e3bae59de19b4f32834362a9ffba3d1

SHA1
fdfd99185e792f0d92fe0dfc33995d954b933e68

SHA256
7a13959835c06094f31159a0366c0066099da319e24dd7202bf44a33b8823866

SHA512
53f8c760ebfdcff43f091470b73cd08cb06c921054087d98a5a55f4f9c0ad400afc0674cd363efaf8cb66df253769eea8ac66e6999d9972ea8b803ead7471fae

Download Submit
memory/1716-52-0x000002619EE70000-0x000002619EEA8000-memory.dmp

Filesize
224KB

Download
memory/1716-1830-0x00000261A1B00000-0x00000261A1B0A000-memory.dmp

Filesize
40KB

Download
memory/1716-243-0x00000261A1AA0000-0x00000261A1AA8000-memory.dmp

Filesize
32KB

Download
memory/1716-126-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-125-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-119-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-110-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-99-0x00000261A1800000-0x00000261A180E000-memory.dmp

Filesize
56KB

Download
memory/1716-271-0x00000261A1AD0000-0x00000261A1AD8000-memory.dmp

Filesize
32KB

Download
memory/1716-71-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-70-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-69-0x00007FFE1D623000-0x00007FFE1D624000-memory.dmp

Filesize
4KB

Download
memory/1716-58-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-53-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-257-0x00000261A1AC0000-0x00000261A1AC8000-memory.dmp

Filesize
32KB

Download
memory/1716-0-0x00007FFE1D623000-0x00007FFE1D624000-memory.dmp

Filesize
4KB

Download
memory/1716-3297-0x00000261A3C60000-0x00000261A3C8A000-memory.dmp

Filesize
168KB

Download
memory/1716-10-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-9-0x000002619E370000-0x000002619E3E6000-memory.dmp

Filesize
472KB

Download
memory/1716-1829-0x00000261A1BE0000-0x00000261A1BF4000-memory.dmp

Filesize
80KB

Download
memory/1716-51-0x000002619E350000-0x000002619E358000-memory.dmp

Filesize
32KB

Download
memory/1716-3316-0x00000261A3C60000-0x00000261A3C82000-memory.dmp

Filesize
136KB

Download
memory/1716-50-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-3827-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-7-0x00007FFE1D620000-0x00007FFE1E00C000-memory.dmp

Filesize
9.9MB

Download
memory/1716-5-0x000002619E1C0000-0x000002619E1E2000-memory.dmp

Filesize
136KB

Download
memory/4728-3839-0x000002C80DC00000-0x000002C80DD00000-memory.dmp

Filesize
1024KB

Download
memory/4728-3844-0x000002C80DF00000-0x000002C80E000000-memory.dmp

Filesize
1024KB

Download
memory/4728-3852-0x000002C80E0E0000-0x000002C80E100000-memory.dmp

Filesize
128KB

Download
memory/4728-3869-0x000002C81ECE0000-0x000002C81EDE0000-memory.dmp

Filesize
1024KB

Download