amadey | d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

Analysis

max time kernel
291s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
Size 1.3MB
Sample240919-2nj57avdnc
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455
SSDEEP 24576:b9yEBs1ZKaxv6rRVO9VdLCjJehm4v2TeLUzguXpdQhgRQ7SoYafkW:bxqZK66rb4V0cxtQzv5dQhgRQ7SxID
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey cryptbot meshagent 1176f2 backdoor credential_access discovery execution persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Extracted

Family

cryptbot

analforeverlovyu.top
thirtvf13ht.top

Attributes

url_path
/v1/upload.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000001abd6-74.dat	family_meshagent

MeshAgent
MeshAgent is a trojan written in C++.
trojan backdoor meshagent

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4148 created 3284	4148	Waters.pif	55
PID 4148 created 3284	4148	Waters.pif	55

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe\" "	meshagent32-group.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
4148	Waters.pif
1096	Installeraus.exe
1452	meshagent32-group.exe
4596	MeshAgent.exe
1664	66ea90ff1fefe_15.exe
2868	channel3.exe
1152	service123.exe
4464	service123.exe
1108	service123.exe
3644	service123.exe
4472	service123.exe
1412	QuantumFlow.scr

Loads dropped DLL 5 IoCs

pid	Process
1152	service123.exe
4464	service123.exe
1108	service123.exe
3644	service123.exe
4472	service123.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ipinfo.io
25	ipinfo.io
22	api64.ipify.org
23	api64.ipify.org

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wwin32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wgdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\msasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wuser32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wkernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\profapi.pdb	MeshAgent.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wuser32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\powrprof.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\wsspicli.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\Windows.Storage.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5919ADD3F6EDC9BE82E53C42EC0B85EF7C717827	MeshAgent.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\Windows.Storage.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\powrprof.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wsspicli.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\powrprof.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\shlwapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\bcrypt.pdb	MeshAgent.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\56EB8E147F3EB0A39003446804911B7D0446DE09	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wkernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\cryptbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\wgdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\profapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\wkernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wrpcrt4.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5104	tasklist.exe
1412	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 208	1664	66ea90ff1fefe_15.exe	120

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.exe	meshagent32-group.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files (x86)\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HardlyAircraft	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
File opened for modification	C:\Windows\ViewpictureKingdom	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
File opened for modification	C:\Windows\BrandonBlind	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
File opened for modification	C:\Windows\IpaqArthur	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
1240	powershell.exe
3432	powershell.exe
5088	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeshAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuantumFlow.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	channel3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installeraus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	meshagent32-group.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ea90ff1fefe_15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	channel3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	channel3.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4888	schtasks.exe
1200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
1240	powershell.exe
1240	powershell.exe
1240	powershell.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeDebugPrivilege	1412	tasklist.exe
Token: SeAssignPrimaryTokenPrivilege	4680	wmic.exe
Token: SeIncreaseQuotaPrivilege	4680	wmic.exe
Token: SeSecurityPrivilege	4680	wmic.exe
Token: SeTakeOwnershipPrivilege	4680	wmic.exe
Token: SeLoadDriverPrivilege	4680	wmic.exe
Token: SeSystemtimePrivilege	4680	wmic.exe
Token: SeBackupPrivilege	4680	wmic.exe
Token: SeRestorePrivilege	4680	wmic.exe
Token: SeShutdownPrivilege	4680	wmic.exe
Token: SeSystemEnvironmentPrivilege	4680	wmic.exe
Token: SeUndockPrivilege	4680	wmic.exe
Token: SeManageVolumePrivilege	4680	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	4680	wmic.exe
Token: SeIncreaseQuotaPrivilege	4680	wmic.exe
Token: SeSecurityPrivilege	4680	wmic.exe
Token: SeTakeOwnershipPrivilege	4680	wmic.exe
Token: SeLoadDriverPrivilege	4680	wmic.exe
Token: SeSystemtimePrivilege	4680	wmic.exe
Token: SeBackupPrivilege	4680	wmic.exe
Token: SeRestorePrivilege	4680	wmic.exe
Token: SeShutdownPrivilege	4680	wmic.exe
Token: SeSystemEnvironmentPrivilege	4680	wmic.exe
Token: SeUndockPrivilege	4680	wmic.exe
Token: SeManageVolumePrivilege	4680	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1064	wmic.exe
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1064	wmic.exe
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	2404	wmic.exe
Token: SeIncreaseQuotaPrivilege	2404	wmic.exe
Token: SeSecurityPrivilege	2404	wmic.exe
Token: SeTakeOwnershipPrivilege	2404	wmic.exe
Token: SeLoadDriverPrivilege	2404	wmic.exe
Token: SeSystemtimePrivilege	2404	wmic.exe
Token: SeBackupPrivilege	2404	wmic.exe
Token: SeRestorePrivilege	2404	wmic.exe
Token: SeShutdownPrivilege	2404	wmic.exe
Token: SeSystemEnvironmentPrivilege	2404	wmic.exe
Token: SeUndockPrivilege	2404	wmic.exe
Token: SeManageVolumePrivilege	2404	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	2404	wmic.exe
Token: SeIncreaseQuotaPrivilege	2404	wmic.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4148	Waters.pif
4148	Waters.pif
4148	Waters.pif
1412	QuantumFlow.scr
1412	QuantumFlow.scr
1412	QuantumFlow.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5064	4904	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe	74
PID 4904 wrote to memory of 5064	4904	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe	74
PID 4904 wrote to memory of 5064	4904	d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe	74
PID 5064 wrote to memory of 5104	5064	cmd.exe	76
PID 5064 wrote to memory of 5104	5064	cmd.exe	76
PID 5064 wrote to memory of 5104	5064	cmd.exe	76
PID 5064 wrote to memory of 4964	5064	cmd.exe	77
PID 5064 wrote to memory of 4964	5064	cmd.exe	77
PID 5064 wrote to memory of 4964	5064	cmd.exe	77
PID 5064 wrote to memory of 1412	5064	cmd.exe	79
PID 5064 wrote to memory of 1412	5064	cmd.exe	79
PID 5064 wrote to memory of 1412	5064	cmd.exe	79
PID 5064 wrote to memory of 2868	5064	cmd.exe	80
PID 5064 wrote to memory of 2868	5064	cmd.exe	80
PID 5064 wrote to memory of 2868	5064	cmd.exe	80
PID 5064 wrote to memory of 3772	5064	cmd.exe	81
PID 5064 wrote to memory of 3772	5064	cmd.exe	81
PID 5064 wrote to memory of 3772	5064	cmd.exe	81
PID 5064 wrote to memory of 2496	5064	cmd.exe	82
PID 5064 wrote to memory of 2496	5064	cmd.exe	82
PID 5064 wrote to memory of 2496	5064	cmd.exe	82
PID 5064 wrote to memory of 1848	5064	cmd.exe	83
PID 5064 wrote to memory of 1848	5064	cmd.exe	83
PID 5064 wrote to memory of 1848	5064	cmd.exe	83
PID 5064 wrote to memory of 4148	5064	cmd.exe	84
PID 5064 wrote to memory of 4148	5064	cmd.exe	84
PID 5064 wrote to memory of 4148	5064	cmd.exe	84
PID 5064 wrote to memory of 4536	5064	cmd.exe	85
PID 5064 wrote to memory of 4536	5064	cmd.exe	85
PID 5064 wrote to memory of 4536	5064	cmd.exe	85
PID 4148 wrote to memory of 2600	4148	Waters.pif	86
PID 4148 wrote to memory of 2600	4148	Waters.pif	86
PID 4148 wrote to memory of 2600	4148	Waters.pif	86
PID 4148 wrote to memory of 4000	4148	Waters.pif	88
PID 4148 wrote to memory of 4000	4148	Waters.pif	88
PID 4148 wrote to memory of 4000	4148	Waters.pif	88
PID 2600 wrote to memory of 4888	2600	cmd.exe	89
PID 2600 wrote to memory of 4888	2600	cmd.exe	89
PID 2600 wrote to memory of 4888	2600	cmd.exe	89
PID 4148 wrote to memory of 1096	4148	Waters.pif	92
PID 4148 wrote to memory of 1096	4148	Waters.pif	92
PID 4148 wrote to memory of 1096	4148	Waters.pif	92
PID 1096 wrote to memory of 1452	1096	Installeraus.exe	93
PID 1096 wrote to memory of 1452	1096	Installeraus.exe	93
PID 1096 wrote to memory of 1452	1096	Installeraus.exe	93
PID 4148 wrote to memory of 1664	4148	Waters.pif	96
PID 4148 wrote to memory of 1664	4148	Waters.pif	96
PID 4148 wrote to memory of 1664	4148	Waters.pif	96
PID 4596 wrote to memory of 4680	4596	MeshAgent.exe	97
PID 4596 wrote to memory of 4680	4596	MeshAgent.exe	97
PID 4596 wrote to memory of 4680	4596	MeshAgent.exe	97
PID 4596 wrote to memory of 1064	4596	MeshAgent.exe	99
PID 4596 wrote to memory of 1064	4596	MeshAgent.exe	99
PID 4596 wrote to memory of 1064	4596	MeshAgent.exe	99
PID 4596 wrote to memory of 2404	4596	MeshAgent.exe	101
PID 4596 wrote to memory of 2404	4596	MeshAgent.exe	101
PID 4596 wrote to memory of 2404	4596	MeshAgent.exe	101
PID 4596 wrote to memory of 292	4596	MeshAgent.exe	103
PID 4596 wrote to memory of 292	4596	MeshAgent.exe	103
PID 4596 wrote to memory of 292	4596	MeshAgent.exe	103
PID 4596 wrote to memory of 1104	4596	MeshAgent.exe	105
PID 4596 wrote to memory of 1104	4596	MeshAgent.exe	105
PID 4596 wrote to memory of 1104	4596	MeshAgent.exe	105
PID 4596 wrote to memory of 4144	4596	MeshAgent.exe	107

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3284
- C:\Users\Admin\AppData\Local\Temp\d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe
  "C:\Users\Admin\AppData\Local\Temp\d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5104
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4964
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1412
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 607698
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "MaskBathroomCompositionInjection" Participants
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
      Waters.pif Q
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\1000404101\Installeraus.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000404101\Installeraus.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Users\Admin\AppData\Roaming\MSIX\meshagent32-group.exe
        
        "C:\Users\Admin\AppData\Roaming\MSIX\meshagent32-group.exe" -fullinstall
        6⤵
        Sets service image path in registry
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\1000412001\66ea90ff1fefe_15.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000412001\66ea90ff1fefe_15.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1664
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\1000413001\channel3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000413001\channel3.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1152
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1200
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4000

C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - System Location Discovery: System Language Discovery
  PID:292
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Windows\SysWOW64\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5088

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4464

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3644

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4472

\??\c:\windows\system32\wscript.EXE
c:\windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js"
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.scr
  "C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.scr" "C:\Users\Admin\AppData\Local\QuantumDynamics Lab\W"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MeshAgent.db.tmp

Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp
Size 153KB
SHA256 f9f35a9035c9110077fd9df39974d54d61c5d1ba7fc33a1c1c2d993fa90e81dc
MD5 f5a4ffcf232996869dcd046cf1dfbd08
SHA1 8a3c5e09749215b4b095ed66b7f4418ed55b2a4c
SHA512 62615fa8698ee82a366406b4cc5dfd661e743e87d40946ba46cf1273568556032edcbe01ce1b56200d0482e37a0489816e244ebe59c7eec4360f42252cdeb1fa
SSDEEP 3072:+j9+KQMjmUGOnfzA7rkqwydxKB7txPU63:09+MaPOnfEkqDmBpxPUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuantumFlow.js

Path C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js
Size 178B
SHA256 6d480ed7d55d386049f17d91480fb3eee3b88535eef17370b87c515011e452c0
MD5 d7279a49b341dad92ebeb082555f74ea
SHA1 6e095d0b29fad590f07abd43a9e0bbbe7f52a409
SHA512 b0798a35320cd4309e7e04279fae2da929e75a6edc3265f4e0739bca1164864cca6074f01a0a2fca5c14952e17f90ac0d3c5433c2d50ecf512d5ff5611f0d326
MD5 SHA1 SHA512

Submit Download

Installeraus.exe

Path C:\Users\Admin\AppData\Local\Temp\1000404101\Installeraus.exe
Size 1.8MB
SHA256 e6148c7e8cec3a4565e97a139d2b09dbdf2f30460054fa168624fdc1050421d3
MD5 749bd6bf56a6d0ad6a8a4e5712377555
SHA1 6e4ff640a527ed497505c402d1e7bdb26f3dd472
SHA512 250f1825f5d2577124606818a8c370bb862d74dfebddd8c25ec2b43448626b583e166e101f65ebe12b66b8767af7ad75a8d9f5a3afd4e10f4dd3e6239efe9a7d
SSDEEP 49152:UkQletNpj4NmwF1tBE6BAfTm9k9MJsuAfChboFtcZo:UFletXjoD1tBEc90XCo6Zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

66ea90ff1fefe_15.exe

Path C:\Users\Admin\AppData\Local\Temp\1000412001\66ea90ff1fefe_15.exe
Size 2.3MB
SHA256 e301b79d4279d52c49c886fcd0ab8acc3941c5cf28c7dd0eb57e8af81fe476fb
MD5 96cb7df578398d5d46dd4daeffbdc41f
SHA1 7b7ecf7d006c2e2cd2b237dde3402f6b78e6c54b
SHA512 84e915d323b1595c387123f7f5d8b5d291e2c2c9a8df9e4eba69deff9cc0ba195872065daa6f1c808a848eb8fd259cfd5f5ea164b8a3c9407bd6ca25fffc8479
SSDEEP 49152:Al0Ivwg2krKlsBijSIpWALFfi1zfPmX9YSVY8ZAAiJte:tIvliWVA9i1Te2SVYYAD
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel3.exe

Path C:\Users\Admin\AppData\Local\Temp\1000413001\channel3.exe
Size 6.4MB
SHA256 f7fc894aa5a966220f4ea8dcfd46dd79a062d00e7885342668816d68568eb234
MD5 bc1ad95e28c180667ee85dccaa553f7e
SHA1 6659d5b6247db85dbb04425efeaf6b75ec15963f
SHA512 fc15f334255fbafad494b935390bff361832d5092695591f5697df40bf173751ddec9e114261c8cc3d7ac01d3e22bb88e13b8fd0a214b804ff723578d6414efd
SSDEEP 49152:wP9UnzBbvljJEW9EgCDIZo86U6Ha7kAKvmnUWKsRv8ydz2QkRtb0kc3FBTO+cpRP:pnzBbEMCD+DsbhyvFdz2QatovTMYyfNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

torque.exe

Path C:\Users\Admin\AppData\Local\Temp\1000415001\torque.exe
Size 4KB
SHA256 efec912465df5c55b4764e0277aa4c4c549e612b4f3c5abf77aaec647729f78a
MD5 ddc9229a87f36e9d555ddae1c8d4ac09
SHA1 e902d5ab723fa81913dd73999da9778781647c28
SHA512 08b5ad94168bf90bae2f2917fde1b2a36650845fdcb23881d76ddddae73359fbd774c92083ba03a84083c48d4922afb339c637d49dfa67fbf9eb95b3bf86baa6
SSDEEP 48:66sn7l2zMdoHSe0rHNMMb9Y7VxCioXsTfxZsFtow/ljhFvCFipfbNtm:PYqX9VxCJ8U/3F5zNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\607698\Q
Size 794KB
SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
MD5 7b5632dcd418bcbae2a9009dbaf85f37
SHA1 32aaf06166854718f0bcbb2f7173c2732cfb4d33
SHA512 c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838
SSDEEP 12288:LtQJu7osksZQ7FuV65iFeG1bdMpX+rLvW6hwpos+s5E/RjyGF3tgO85c1XLwaMBO:LtOHrFuhF31iWB4zuNtIuXLuY9v1Pd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Waters.pif

Path C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

968772205171

Path C:\Users\Admin\AppData\Local\Temp\968772205171
Size 75KB
SHA256 4ee04e910e88f4ce1bc227af76245556893b774a1f58cdff02cd45b5fc3b8ddd
MD5 2780daca825aba5851576e8e9de571e0
SHA1 09f3c0e53109b0461cf885c1d8515131c4ab5adf
SHA512 43a0f359e173dc720fa6db695de0647ff5d8e2c69f9ca5934ca1655f25684ed06d0b110d265ab97e570aef96894f6c39117cd2ac542dc9067130cfa0e385ea4b
SSDEEP 1536:sLq6dTKZzxd9B6jXjiU/NtrFlhikn7A4yGIHx/Mt6YGqY+jCJ:nQTBtrDh3n07Hx/Mt6YGq3jO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Asbestos

Path C:\Users\Admin\AppData\Local\Temp\Asbestos
Size 60KB
SHA256 37576e4b3a1e0004b4cf7da625b865a62d895411ed157c538f5f4cd3aa6fab7a
MD5 19121d99734080f4fdd9ca3008168360
SHA1 b00acbdd3fa952df781ca9ad5c86ded9f2d51ec6
SHA512 e2e863d19e2f560c1deb018c3c2748be170b11fcb520ed7e7ea20727646bcacb0b5c3ed04e856943c67e51f5083c90aa3dd1f8794a83901a203c8bac4fa51c92
SSDEEP 768:pQPj48UQOUiubxsOEndF1tUQy7i0l78krIt96cOkjZb/heni1jmTdwV0RlqgiaOX:pSj48u0HqxGNQ3OwbykjmTC0LwaRf4NR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ashley

Path C:\Users\Admin\AppData\Local\Temp\Ashley
Size 52KB
SHA256 ddb7f60ab5f8957955dd20f2dc270e3ef833d3727f374a8c4c444634bd05609d
MD5 e522956891659c41bd8550b8d5e16231
SHA1 4380c8a0c30db1532728cdb72707f9f1847cc87d
SHA512 35c81ef1a2c040dbd52cad9f38fda43d8836d955b62e478ae941a4ba67d297dc1c4b40d6b30959c5d2f784d5cb0d19c795307906d52ad0e7eb72bd0e4235172f
SSDEEP 1536:9MMj34ywB5KqgcGsc5wVEiZcTtFEvO1HI3s3oHQ6:9tbE5ucfc5QDZcJh1Qst6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bet

Path C:\Users\Admin\AppData\Local\Temp\Bet
Size 55KB
SHA256 32b3d9d5bc58659ea524aa2cabd9cfc81b73e679e3d2cc899dfb00439612f5ff
MD5 0f3f07b667e947c4da38813d6d651e2a
SHA1 692622d5e5705f8f65db96f70d8c7c2f7fd5a640
SHA512 449ab13dd860b08570c589dc24e468dd880434c3be774ba4f078d8f116d710326fc546de621dce8a27e134f70f651d44642ec0ece37375332a7d7725e9ddcf9c
SSDEEP 1536:p3avQ59o+H306WG6NoG8vYyAHJfpshydbA:dDCAE6WGGoJvFAohyFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\Emotions
Size 19KB
SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
MD5 b98d78c3abe777a5474a60e970a674ad
SHA1 079e438485e46aff758e2dff4356fdd2c7575d78
SHA512 6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d
SSDEEP 384:vLaGlKPODYuBO3zViP3suELSs/APtOSFaOMJJj0xJUb+OeFB2l5UWiSiSK:vLaVWYn3isuELD/OtOHTCOcBS59isK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ensures

Path C:\Users\Admin\AppData\Local\Temp\Ensures
Size 75KB
SHA256 2686b284d1c21d06ab10829c16657334e13428210ccda89f68bfb8acbfc72b42
MD5 c6fa82d60cfbf9e83b4cf3cbd1f01552
SHA1 a310c3577c5e439aa306a0a5dae2c75ea39c126e
SHA512 e35a67a63fac7db37431bc0ab910a9c33a41e5a910ae79181a74aaf13ed23d65ef500a9e5a482e749cd9666c146d8403f83c6be2d9aa013d6d7c6bc0f07fac9c
SSDEEP 1536:fI3458kia8Jlj6YRC2wYIwr4fCQkZaKjZvKAQL5LUrCDdH0Qzyu:W4e3lJh6uCzNMKCBDtVWIGZUQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fla

Path C:\Users\Admin\AppData\Local\Temp\Fla
Size 82KB
SHA256 e0c1c46fa4582a3826f7aed2f7fb454d3ee42a425f214321910c25cc1d8879d5
MD5 e139e52f93ae3e19ab47f437cbe8b3de
SHA1 2d5b56c3c0a454fefbf7c7a466ad000c05258bd6
SHA512 4feba8bf6916c979fa45e16a368f22a165985e1dfd75697fd7a7534f5e64afe438206074b2f8aa884d5666e80c55544c62d5cc48f8429e7c843c01d1af060878
SSDEEP 1536:cuyEKyPM+hX1pEvTBru6C2fqwXaHXsCM34ruECVgfc7qNS8Id:1xKu9LGC2BXaH8CLru/EDId
MD5 SHA1 SHA512 SSDEEP

Submit Download

Language

Path C:\Users\Admin\AppData\Local\Temp\Language
Size 72KB
SHA256 9201319c9c07e4312717845e59c9fe3a987f70575cd63e4c042db778ebe4d5e9
MD5 5de7106df85e2f96f46f642d98433ad1
SHA1 f77a8182904a897a8d41858c6f5b87c3e8b21195
SHA512 7c4b04d513e80873ea3030162702e5eff8ea17b44844ba2809805f92c6a7d6ed396ef660b78e274334448f31c447f26212c6779e801f330611d6a01f04449047
SSDEEP 1536:45p8F8NfFPhjAjmtfoxAZM81pPb7kaGIWLWvzigna6zendSrfBp:SvtAWAx+M819pZWLa+ndeBp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Navy

Path C:\Users\Admin\AppData\Local\Temp\Navy
Size 56KB
SHA256 68e9a8d57ba2a484dd28a1afed5262a86aff4d81467b93b4072f329fab984f4c
MD5 d4eb107cfd9fc38ed7e7b253562e155a
SHA1 7fc17c27c9f4739c19211600398bf1ee9df84dc5
SHA512 3a95c48e7a61239cbaa857459a6a106536dfd8190205275e2549a9939116833141276dd5b6c81ff337d2340eedba633d9ca01a03fb490eb27184becc97626e0f
SSDEEP 1536:SKmS/F6SnG9rlnrMRBVty70dau0yjlifFQEsxdpy:SK2l9xMRfY7saujZimEsxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Participants

Path C:\Users\Admin\AppData\Local\Temp\Participants
Size 2KB
SHA256 7cbd6810cb4dd516eeb75df79d1db55f74471c11594333ac225f24bfc0fca7ca
MD5 f0e725addf4ec15a56aa0bde5bd8b2a7
SHA1 1f54a49195d3f7fd93c5fec06cc5904c57995147
SHA512 00f14e435e0f8396f6c94fd5ace3f3645e87511b9e41e8c7c7caadb751ed826f60362ac007c80e9c3bd16f8f31b3a9107cbb39bf5c26d20a0ab5129e695f5269
MD5 SHA1 SHA512

Submit Download

Rick

Path C:\Users\Admin\AppData\Local\Temp\Rick
Size 869KB
SHA256 27014daa44b8b92e1684970350c43bb1701d3a592572e650e1e00be1470e5f77
MD5 e0d37e7b879f4b4e0dde5006da5009bd
SHA1 33d19bdb8a0ae45a38ab6899381ca8bc1ea7c1a5
SHA512 68b2f357b3f02f3181df095ddc6fe8ff1810a150e832c245e428f973a096301b1d13fce00ad28af662c4aea371f872d56348fe7b5d2070ed3f1c49388efd3f60
SSDEEP 12288:OpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:OTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Streaming

Path C:\Users\Admin\AppData\Local\Temp\Streaming
Size 97KB
SHA256 dcf4784ea71a3e1a42318c09183d4b5981009d296814d3679ca68eb0a7c9e2ef
MD5 1501de696d22f872db44b548cba0e4fa
SHA1 ed8a2948aaf041bfd0196a180f5888bdddcb9879
SHA512 fa931ce9f6ab6928cec1c999f1aa6082bd7c5c74eff317fc6b1bd0d9f88de2753e157ebd4d6a2719c5861f7fdc12bcde5859945633c1a2b8e0967684771f84bc
SSDEEP 1536:e+Gh66UDm7aBhZ/gFRE4urykxXo1NmfT8ezajmKxZGq/9EZvWZ1hEvQn9E/bbZfR:Yh6ny7aviFOBe1NDezajmlLZC1yQn9Uz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Temperature

Path C:\Users\Admin\AppData\Local\Temp\Temperature
Size 89KB
SHA256 7c16e21e29d442bf0b459d083198b22ee9c6d9926e3aa61f43dc3a1ee3ecb731
MD5 249d56cbe275c2258ccd964f0c6241d9
SHA1 8ac982fe39012b8812ed9dcf16e8e00c9a74b0bc
SHA512 440d7ff539e737e4e3b74549be7495d0f3b3230888355bc93eeca8084c80f255d988839ef455b4f6841fbaa64aabfdef9233130663aa3c24f711d01edb8e6be8
SSDEEP 1536:1HWiP7Yp/mHnQ1UpUMd4IupqP9kGoe3bpwZQnvcIwvbzZeaGFuo:1Hip/WnQ14ApqqGBbpwZQnv1kbzcnFuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Viruses

Path C:\Users\Admin\AppData\Local\Temp\Viruses
Size 89KB
SHA256 98232a6528beb079d8fa9d77751722159d4974e6859df867efb3ba7a3eec4bec
MD5 7c9dd6f9fa719321b72805df762a82da
SHA1 64b135116d963e47848e29a002a3207bc01ab2c0
SHA512 480d16e0d1e5021b9042378df235323324fc8341461e59d117471aa0da07fe8ef6367d0e14479b4bbb854f29d1f092ba3e9776fa2bf56b34ab73f5a858e6b3d0
SSDEEP 1536:BPKqba/VOmFEskJ/1ZiMJf9a1+y2bLt5ftfsCdUZFzE13jrDFMj/LdcdslzaqUAz:wF/VOuEDiSfocy2Pt5ftfEPzsz1E/LdH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Width

Path C:\Users\Admin\AppData\Local\Temp\Width
Size 67KB
SHA256 8e7415ed2d0d5c6e69d6a02bc3928c9adf685a43932e4543084b917946361974
MD5 12d9ad507c856d833101c9e367466555
SHA1 b6398b345226279cfab1559bf3847e3d9526dcff
SHA512 0ba3913d4a3ca266f0812263245a25caa0bbd9b81766992c8dc05466d9cd86cb79843c53c29bb26c005ef15c0f90ab97978209038181501135a7b27fb5b34d62
SSDEEP 1536:7Tpnkz3ka65XPhQX9zj/BhrpCOFaCAuWjlTHuq6ezUkhB+op9x0:hnMUXRPOX9z9hrpdFaFu09AFdK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

meshagent32-group.exe

Path C:\Users\Admin\AppData\Roaming\MSIX\meshagent32-group.exe
Size 3.7MB
SHA256 f32426d0fc71a3a054f0fe263133aabeb25c9d7d129238cfcfc0c1a40854c67e
MD5 e8bd5c14b8301039e7538298d26cf09b
SHA1 4702252fef2156b59ad61f1f397b205323b339c4
SHA512 7108e6379e9e2698dbac52549b5fc81d7b3c5bb02d4d3574b7be9e8ab9f6f473513e651c1ce0809d74273f02e837c36032666f739c05b71fa732899360b77cee
SSDEEP 49152:G8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5QpE:G8o8VOUs9joRbMc2tSW6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1
MD5 6bf0e5945fb9da68e1b03bdaed5f6f8d
SHA1 eed3802c8e4abe3b327c100c99c53d3bbcf8a33d
SHA512 977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 d11f214ecb4dc36679875801369ec25dc5f3803175c3c8db8aaf7a1c45771ee9
MD5 f78b5d8e3698ba5cf4c43350af683167
SHA1 a038797d706ad5adafaff928bbc4523ec4feb0cc
SHA512 f4f03b9717a16c8ea88e78a4e69500df56f627908f88331224f353f936d69fadd2e216a205af9172c439f5c5cbc8acb9dc36ac4fd311ee731ec79d4eab4d21d6
SSDEEP 384:HQ21TxnUY3XxYBc1teIAjWOgY9oH6P44o01kM4X7i0EHcfmm7W3r2lFlxB1C80qo:HzPUYH4ZPMY+a/alEH4eaHH/0jJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 22KB
SHA256 4cf5bbf06bf707882a9f967d53f6e73466339f6f7867bbb26efd970f7d2e9f0f
MD5 5ca9ee61238bd79c2ded0123507b3c61
SHA1 c31ff0bc5620bf9a4520fa6e8d456dcc049a27cd
SHA512 4a819bf36d085da3371d86da01afa25fa132f697fc7fc24848fb76224a9f0d65ef928deb1498fe08a910b331ac758086f947073f9a88dd1a4c6c534e95ad0057
SSDEEP 384:r2lzhn3UNz913yPte4SiljlbKAiQ01RxJeX7i0EyLFqS6t5xsXNcU8I84eG+L9EW:yrE1i443l5v2LulEyLENs+Gf+6Fbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4x0lj244.bl3.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_4x0lj244.bl3.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

memory/208-1204-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/208-1206-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/208-1203-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/1108-1236-0x0000000000130000-0x0000000000141000-memory.dmp

Download

memory/1152-1222-0x0000000000130000-0x0000000000141000-memory.dmp

Download

memory/1152-1223-0x00000000724F0000-0x000000007262C000-memory.dmp

Download

memory/1240-284-0x000000006EBF0000-0x000000006EC3B000-memory.dmp

Download

memory/1240-285-0x0000000008680000-0x000000000869E000-memory.dmp

Download

memory/1240-283-0x00000000088A0000-0x00000000088D3000-memory.dmp

Download

memory/1240-290-0x00000000088E0000-0x0000000008985000-memory.dmp

Download

memory/1240-226-0x00000000062D0000-0x0000000006620000-memory.dmp

Download

memory/1240-483-0x0000000008A40000-0x0000000008A5A000-memory.dmp

Download

memory/1240-228-0x00000000069C0000-0x0000000006A0B000-memory.dmp

Download

memory/1240-488-0x0000000008A30000-0x0000000008A38000-memory.dmp

Download

memory/1664-109-0x0000000000CA0000-0x0000000000EFE000-memory.dmp

Download

memory/1664-1201-0x0000000005CD0000-0x0000000005F06000-memory.dmp

Download

memory/1664-110-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/1664-1202-0x0000000001760000-0x0000000001782000-memory.dmp

Download

memory/2868-1200-0x0000000000400000-0x000000000106D000-memory.dmp

Download

memory/2868-1208-0x0000000000400000-0x000000000106D000-memory.dmp

Download

memory/2868-1217-0x0000000000400000-0x000000000106D000-memory.dmp

Download

memory/3432-582-0x000000006EBF0000-0x000000006EC3B000-memory.dmp

Download

memory/3432-897-0x0000000009F00000-0x000000000A578000-memory.dmp

Download

memory/3644-1251-0x0000000000130000-0x0000000000141000-memory.dmp

Download

memory/4148-570-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-45-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-41-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-103-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-42-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-43-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-44-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-106-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-70-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-573-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-46-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-47-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4148-66-0x0000000004280000-0x00000000042F1000-memory.dmp

Download

memory/4464-1221-0x0000000000130000-0x0000000000141000-memory.dmp

Download

memory/4472-1275-0x0000000000130000-0x0000000000141000-memory.dmp

Download

memory/4884-134-0x0000000006730000-0x000000000674C000-memory.dmp

Download

memory/4884-133-0x0000000006330000-0x0000000006680000-memory.dmp

Download

memory/4884-129-0x0000000005AB0000-0x00000000060D8000-memory.dmp

Download

memory/4884-200-0x0000000008720000-0x0000000008742000-memory.dmp

Download

memory/4884-130-0x0000000005990000-0x00000000059B2000-memory.dmp

Download

memory/4884-131-0x0000000005A30000-0x0000000005A96000-memory.dmp

Download

memory/4884-132-0x00000000062C0000-0x0000000006326000-memory.dmp

Download

memory/4884-128-0x0000000003260000-0x0000000003296000-memory.dmp

Download

memory/4884-201-0x0000000008C50000-0x000000000914E000-memory.dmp

Download

memory/4884-135-0x00000000067A0000-0x00000000067EB000-memory.dmp

Download

memory/4884-154-0x00000000077C0000-0x00000000077FC000-memory.dmp

Download

memory/4884-185-0x0000000007880000-0x00000000078F6000-memory.dmp

Download

memory/4884-198-0x0000000008680000-0x0000000008714000-memory.dmp

Download

memory/4884-199-0x0000000008610000-0x000000000862A000-memory.dmp

Download

memory/5088-974-0x000000006EBF0000-0x000000006EC3B000-memory.dmp

Download