0e18291d4e4d572f384a1fad25834a6a35ed89bb01a1de97ea78dfb950c968f5

Analysis

max time kernel
497s
max time network
1156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WeModPatcher.bat
Size

74KB
MD5

6c7320a093b6d15789939f1122e7edbe
SHA1

e9eab0865e2841e356ff0c12905881b73af5b1f9
SHA256

0e18291d4e4d572f384a1fad25834a6a35ed89bb01a1de97ea78dfb950c968f5
SHA512

32b0c0644533c92de5204c62882800e7fc8e6dd01aa3e72b1c3b8c89797d807afd618b6fa707cbff63a905d2f421a7981e217781da4a98ed0466728c786cc593
SSDEEP

1536:/VogcKgOXARTYGtJg7j18RH5KmM21q7bosOX4Fw7oo5:/VYGX+YG821MosOD

Score

6^/10

discovery execution

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com
50	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1568	tasklist.exe
2448	tasklist.exe
4644	tasklist.exe
3588	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1252	powershell.exe
4664	powershell.exe
1912	powershell.exe
2140	powershell.exe
1544	powershell.exe
3760	powershell.exe
3744	powershell.exe
2940	powershell.exe
472	powershell.exe
2308	powershell.exe
228	powershell.exe
4212	powershell.exe
436	powershell.exe
4572	powershell.exe
2300	powershell.exe
1856	powershell.exe
2352	powershell.exe
2268	powershell.exe
4184	powershell.exe
4240	powershell.exe
3480	powershell.exe
1632	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3744	powershell.exe
3744	powershell.exe
436	powershell.exe
436	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4184	powershell.exe
4184	powershell.exe
4240	powershell.exe
4240	powershell.exe
3480	powershell.exe
3480	powershell.exe
2940	powershell.exe
2940	powershell.exe
1252	powershell.exe
1252	powershell.exe
2300	powershell.exe
2300	powershell.exe
4664	powershell.exe
4664	powershell.exe
472	powershell.exe
472	powershell.exe
1912	powershell.exe
1912	powershell.exe
2308	powershell.exe
2308	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
2140	powershell.exe
2140	powershell.exe
1632	powershell.exe
1632	powershell.exe
1856	powershell.exe
1856	powershell.exe
4212	powershell.exe
4212	powershell.exe
1544	powershell.exe
1544	powershell.exe
2352	powershell.exe
2352	powershell.exe
2268	powershell.exe
2268	powershell.exe
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	2448	tasklist.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	472	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	4644	tasklist.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	3588	tasklist.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2940	4176	cmd.exe	85
PID 4176 wrote to memory of 2940	4176	cmd.exe	85
PID 2940 wrote to memory of 860	2940	cmd.exe	86
PID 2940 wrote to memory of 860	2940	cmd.exe	86
PID 4176 wrote to memory of 384	4176	cmd.exe	90
PID 4176 wrote to memory of 384	4176	cmd.exe	90
PID 384 wrote to memory of 3744	384	cmd.exe	91
PID 384 wrote to memory of 3744	384	cmd.exe	91
PID 4176 wrote to memory of 1508	4176	cmd.exe	93
PID 4176 wrote to memory of 1508	4176	cmd.exe	93
PID 1508 wrote to memory of 4352	1508	net.exe	94
PID 1508 wrote to memory of 4352	1508	net.exe	94
PID 4176 wrote to memory of 436	4176	cmd.exe	95
PID 4176 wrote to memory of 436	4176	cmd.exe	95
PID 4176 wrote to memory of 4664	4176	cmd.exe	96
PID 4176 wrote to memory of 4664	4176	cmd.exe	96
PID 4664 wrote to memory of 1568	4664	cmd.exe	97
PID 4664 wrote to memory of 1568	4664	cmd.exe	97
PID 4176 wrote to memory of 3580	4176	cmd.exe	99
PID 4176 wrote to memory of 3580	4176	cmd.exe	99
PID 3580 wrote to memory of 4572	3580	cmd.exe	100
PID 3580 wrote to memory of 4572	3580	cmd.exe	100
PID 4176 wrote to memory of 616	4176	cmd.exe	101
PID 4176 wrote to memory of 616	4176	cmd.exe	101
PID 616 wrote to memory of 3824	616	cmd.exe	102
PID 616 wrote to memory of 3824	616	cmd.exe	102
PID 4176 wrote to memory of 2984	4176	cmd.exe	103
PID 4176 wrote to memory of 2984	4176	cmd.exe	103
PID 4176 wrote to memory of 1364	4176	cmd.exe	104
PID 4176 wrote to memory of 1364	4176	cmd.exe	104
PID 4176 wrote to memory of 4140	4176	cmd.exe	105
PID 4176 wrote to memory of 4140	4176	cmd.exe	105
PID 4140 wrote to memory of 4184	4140	cmd.exe	106
PID 4140 wrote to memory of 4184	4140	cmd.exe	106
PID 4176 wrote to memory of 2748	4176	cmd.exe	107
PID 4176 wrote to memory of 2748	4176	cmd.exe	107
PID 2748 wrote to memory of 4240	2748	cmd.exe	108
PID 2748 wrote to memory of 4240	2748	cmd.exe	108
PID 4176 wrote to memory of 3480	4176	cmd.exe	109
PID 4176 wrote to memory of 3480	4176	cmd.exe	109
PID 4176 wrote to memory of 3448	4176	cmd.exe	110
PID 4176 wrote to memory of 3448	4176	cmd.exe	110
PID 3448 wrote to memory of 2448	3448	cmd.exe	111
PID 3448 wrote to memory of 2448	3448	cmd.exe	111
PID 4176 wrote to memory of 2940	4176	cmd.exe	112
PID 4176 wrote to memory of 2940	4176	cmd.exe	112
PID 4176 wrote to memory of 384	4176	cmd.exe	115
PID 4176 wrote to memory of 384	4176	cmd.exe	115
PID 384 wrote to memory of 1252	384	cmd.exe	116
PID 384 wrote to memory of 1252	384	cmd.exe	116
PID 4176 wrote to memory of 2300	4176	cmd.exe	117
PID 4176 wrote to memory of 2300	4176	cmd.exe	117
PID 4176 wrote to memory of 3124	4176	cmd.exe	118
PID 4176 wrote to memory of 3124	4176	cmd.exe	118
PID 3124 wrote to memory of 4664	3124	cmd.exe	119
PID 3124 wrote to memory of 4664	3124	cmd.exe	119
PID 4176 wrote to memory of 3580	4176	cmd.exe	120
PID 4176 wrote to memory of 3580	4176	cmd.exe	120
PID 3580 wrote to memory of 472	3580	cmd.exe	121
PID 3580 wrote to memory of 472	3580	cmd.exe	121
PID 4176 wrote to memory of 4588	4176	cmd.exe	123
PID 4176 wrote to memory of 4588	4176	cmd.exe	123
PID 4176 wrote to memory of 2004	4176	cmd.exe	124
PID 4176 wrote to memory of 2004	4176	cmd.exe	124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WeModPatcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\curl.exe
    curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
    3⤵
    PID:860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "[string]([Version]'1.2.3', [Version]'1.2.3' | measure-object -maximum).maximum"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[string]([Version]'1.2.3', [Version]'1.2.3' | measure-object -maximum).maximum"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::title='WeModPatcher'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\tasklist.exe
    tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Process -Id 4176).ProcessName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Id 4176).ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3824
- C:\Windows\system32\chcp.com
  chcp 850
  2⤵
  PID:2984
- C:\Windows\system32\mode.com
  mode con cols=24 lines=10
  2⤵
  PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::title='WeModPatcher'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\tasklist.exe
    tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host -B 13 -F 13 '....' -NoNewline; Write-Host -B 5 -F 5 '....' -NoNewline; Write-Host -B 1 -F 1 '....' -NoNewline; Write-Host -B 9 -F 9 '....' -NoNewline; Write-Host -B 3 -F 3 '....' -NoNewline; Write-Host -B 11 -F 11 '...' `n`n -NoNewline; Write-Host -B 0 -F 10 ' WeModPatcher v1.2.3'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "[math]::Round((24 - '1280x680'.length) / 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[math]::Round((24 - '1280x680'.length) / 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host -B 0 -F 0 ''.PadRight(8) -NoNewline; Write-Host -B 0 -F 14 '1280x680'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).DisplayName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Culture).DisplayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).Name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Culture).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- C:\Windows\system32\chcp.com
  chcp 850
  2⤵
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
  2⤵
  PID:2004
- - C:\Windows\system32\mshta.exe
    mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
    3⤵
    PID:1676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WeModPatcher.bat" "
1⤵
PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
  2⤵
  PID:5096
- - C:\Windows\system32\curl.exe
    curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "[string]([Version]'1.2.3', [Version]'1.2.3' | measure-object -maximum).maximum"
  2⤵
  PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[string]([Version]'1.2.3', [Version]'1.2.3' | measure-object -maximum).maximum"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::title='WeModPatcher'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
  2⤵
  PID:2268
- - C:\Windows\system32\tasklist.exe
    tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Process -Id 3392).ProcessName"
  2⤵
  PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Id 3392).ProcessName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  PID:1132
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1724
- C:\Windows\system32\chcp.com
  chcp 850
  2⤵
  PID:2620
- C:\Windows\system32\mode.com
  mode con cols=24 lines=10
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
  2⤵
  PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
  2⤵
  PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::title='WeModPatcher'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
  2⤵
  PID:1620
- - C:\Windows\system32\tasklist.exe
    tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host -B 13 -F 13 '....' -NoNewline; Write-Host -B 5 -F 5 '....' -NoNewline; Write-Host -B 1 -F 1 '....' -NoNewline; Write-Host -B 9 -F 9 '....' -NoNewline; Write-Host -B 3 -F 3 '....' -NoNewline; Write-Host -B 11 -F 11 '...' `n`n -NoNewline; Write-Host -B 0 -F 10 ' WeModPatcher v1.2.3'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "[math]::Round((24 - '1280x680'.length) / 2)"
  2⤵
  PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[math]::Round((24 - '1280x680'.length) / 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host -B 0 -F 0 ''.PadRight(8) -NoNewline; Write-Host -B 0 -F 14 '1280x680'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).DisplayName"
  2⤵
  PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Culture).DisplayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).Name"
  2⤵
  PID:1332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Culture).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\Windows\system32\chcp.com
  chcp 850
  2⤵
  PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
  2⤵
  PID:3244
- - C:\Windows\system32\mshta.exe
    mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
    3⤵
    PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
d8cb9759be15a8f0f56376ca3479d293

SHA1
42c782cd5972ea8242691daa05425ac3aaa8844a

SHA256
0020842f7ad31c8d553933da597c96a958e418abfeee2e0a9c8e16c51f9d2ba7

SHA512
62a1411f9f8ba4387f12e6d469ca8ab321ff81d8c8489e9fcd8125a0b8e6a63300dc5a872d692d194fb272f6b43f638eb3e05a0af72399d0c9ca0bd1b40ff4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e936ffde1732f536cc835ed3e6c83842

SHA1
05a7c09e599c32003ea21329932a032ace4f592c

SHA256
da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552

SHA512
35d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a2b24af1492f112d2e53cb7415fda39f

SHA1
dbfcee57242a14b60997bd03379cc60198976d85

SHA256
fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

SHA512
9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
59583cecd69c4401d92a7a17a16f194b

SHA1
6134e6c5ec66c755f1537dd984c66b293a207a46

SHA256
b3804330d219ae8b7ab3c7b36329b611f8e2c69e90fc86d77760b18d8428f6a6

SHA512
084a905d9543be8af45126ff5bd40db819f7cddee9db7618eb42c1229145b944ebd8c61696ac7ec617bd0e55152931bf964b6af01018e9bfce964b4e16121e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
abd8cd8a245d0c9d06ff8957265b30fd

SHA1
dc635022e9066bf12651616151ff8b97b85585b1

SHA256
e84dd6a23f13f218fd7b7fb754459015f186df9c78b51f715bff47d1238bb298

SHA512
4e372a3ff8868de5878f9ff8006878c2c04450f00afde2234db6890828870deb8da9375048b934f4ea6d432cc1f0f23a2d391f72d2382f9ee6c4c2644f308735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
2b1197120326a33663f426ba4a827059

SHA1
3a37f3a77ced744194e8aed477b592110fd3a480

SHA256
c109609b2c0e5d85d63db58f76be777d61689e24fda709fe79aac97d76aae906

SHA512
24fcf75626289b9429ddc69f52b1a02f20a2493de9e32d34aeecf8b66230058cac93115782ee5b32232a1705443edffb9d18ab2487be807b310104a7053f0146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ee729b3f29fe5309aba80adfc4ff900c

SHA1
41ccdb4562d50f309432fcddd383183ccbaeaa02

SHA256
84d2a1bf568e774dd510f7aec806687121ed58a71b513642b41971cedf5d2773

SHA512
760870f804109125cf594106795cf52f7023124a492407f670f1e78ac83e5f6c604234facacbed9d49296605a3dc237b2d28159f3c32169f5792f99ba6aa507f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1c6495a58a1b0679c76dc4fe2df2c3cb

SHA1
67eccd75add684d2267766c31716c17a299cfd19

SHA256
66a67fa0a1250929073cba832220abbc62d93144dca58babbecc30632ae42853

SHA512
68beb0cd075196453e5219352170d33ff7799d777669d29b0ae2e6fdccd7423f2bb7291ec6ca5371b76aab121059a592380018eeef9cdc6391e2e6aed32e6757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
90b00424e6de0ca7eb4686c96a0f3265

SHA1
f7552ce23fa550304f21e85a448c93e3a285a3ae

SHA256
177bd48d3ff386e32314c4ef29834352cb63b83554159fbe821a78cb14759759

SHA512
2a85199a37184ff8f8414acb97ac278ddacfe1185db65d631c47afb63c079e8952cc3e3ee44591625bb70755fde7a3513f65aafa5112ad1e2d6c9fd5b1298919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ba7bb8c22d72f7d6094bf4b7a11fd2df

SHA1
e68eab39081c17997a16bca1667f1544f11804a5

SHA256
0b479a9a243e4fa548d64277229f3c72cc7c6773001a235fc406c74e98d32b1a

SHA512
58288cb73c35eb08b28f9ad0e96ed17e89b6e361c015c233deba9eb39a928e7216576c897bed531625171606ff9952361c40b14df27c0aa7e2e68228aeb0de4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b66db53846de4860ca72a3e59b38c544

SHA1
2202dc88e9cddea92df4f4e8d83930efd98c9c5a

SHA256
b1a00fcea37b39a5556eea46e50711f7713b72be077a73cb16515ca3538d6030

SHA512
72eff4ae1d541c4438d3cd85d2c1a8c933744b74c7a2a4830ffe398fee88f1a8c5b241d23e94bcdf43b4be28c2747b331a280a7dc67ab67d8e72c6569f016527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
edc94d6cffeec0aa87c5efc4d515f79a

SHA1
8ab843d139d849f5e72008e14013aa1008945e6d

SHA256
47d73c514b6ba6bea241dac0491ce942cedb7a5fb9621dca3c95ce5511f272f2

SHA512
0b9505035c2b8a9094647be0836afe701489d5b51ac758d13233c1e563809b219bb4443f2e527503af14573c32d733618dab1a35c8c7b789fbe4d52711572f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2238871af228384f4b8cdc65117ba9f1

SHA1
2a200725f1f32e5a12546aa7fd7a8c5906757bd1

SHA256
daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882

SHA512
1833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7933e0baa897b4fd2670463100130180

SHA1
f153bbbf679272fb402b97d7d512fa87e7a1b4b5

SHA256
480cb95927ce0d2b85aea907e31b166982104f6b356d46ea7e3725f64e8331ff

SHA512
e308b8bba73551966152fba0178549a0759f5cfe74190464ae0c68cfd25c7fdb791662fd8e87b7aeeb4488039ac50882342b99058314f0b85e2f518e6b08ec21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d7cc6f8bcdde0d48a769f385f6e85a01

SHA1
68b09cbf621bf0103f46d4a9a724e7ac7bc555f9

SHA256
9e53725d765b5a6a606b81f27ad74b8c8c8c5090c5ed941a4f8e66eb081907b7

SHA512
4a8bc55cb9e66208e20ac4965d69b8ed21d94d491f7e89aba1a627dcc51441bdd12be0e684356ae4d109fc3f5a41c02eca8b6b27c16cf97758c1b7e2ea0c2826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
eb6332ae9e8fec69c2236355e2638f9d

SHA1
71500d57fb304979afd6756f06d4b9a59f995eb7

SHA256
88e5ffe18fd4a772efce68f1b0db839846cafc42d36415508ad5356a44d38f32

SHA512
e87c864ba79bd7a10a62b55ad564cf3acb090e7d85707a6967497deeef5fcde1f0b4608ea8791bf81363ec583a0101d470d8f3cd2172ced8d4071d7f6c674aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
63e62e02ee9c90b7adfb2eefe7efa04f

SHA1
9bc1eda86f7f95345c2a3901288b6867447dee6b

SHA256
cbafbcef08446541d49da9d11842ab860628a7d317db15f570b7b1e1048ade11

SHA512
3d2bf16c2a9b42e28dc9d2c18d6d697d3749b14f2f6c708ea9e587022aeb5fbbcffaa49c4f4f994f1cd1f6c886b8d8b6ab3a29d3b65fe0659ea0f2fa9d47ba52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher.hta

Filesize
4KB

MD5
08fb8946a77933057022a08432ab3d4a

SHA1
3460879e46d2240c3a6763d3835b5d81463e9132

SHA256
fd6bc6af40f46e59dd0f764822bd4ae3d9cfde9ab77e0d3aa4525f9f04dd2ec5

SHA512
98264ba16a190e3f66329458349db5a3d20dd3da558b8d02550fd7525f46e50acf456586c6950668415d4ec8fa3e4db4b3c06f51c6acc2d332ea5f58b4ea775b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5i2lytq.rw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3744-1-0x0000011241C70000-0x0000011241C92000-memory.dmp

Filesize
136KB

Download
memory/3744-0-0x00007FFE0BE63000-0x00007FFE0BE65000-memory.dmp

Filesize
8KB

Download
memory/3744-11-0x00007FFE0BE60000-0x00007FFE0C921000-memory.dmp

Filesize
10.8MB

Download
memory/3744-15-0x00007FFE0BE60000-0x00007FFE0C921000-memory.dmp

Filesize
10.8MB

Download
memory/3744-12-0x00007FFE0BE60000-0x00007FFE0C921000-memory.dmp

Filesize
10.8MB

Download