Malware Analysis Report

2025-04-13 20:59

Sample ID 250308-ht8aessyfw
Target 4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
SHA256 4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf
Tags
darkcloud discovery execution stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf

Threat Level: Known bad

The file 4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe was found to be: Known bad.

Malicious Activity Summary

darkcloud discovery execution stealer

Darkcloud family

DarkCloud

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-08 07:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-08 07:02

Reported

2025-03-08 07:05

Platform

win7-20240729-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

Signatures

DarkCloud

stealer darkcloud

Darkcloud family

darkcloud

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2340 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2340 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2340 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2340 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 2340 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OjzZfu.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OjzZfu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6F.tmp"

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

Network

N/A

Files

memory/2340-0-0x000000007468E000-0x000000007468F000-memory.dmp

memory/2340-1-0x0000000000ED0000-0x0000000000FA8000-memory.dmp

memory/2340-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

memory/2340-3-0x0000000000520000-0x0000000000530000-memory.dmp

memory/2340-4-0x000000007468E000-0x000000007468F000-memory.dmp

memory/2340-5-0x0000000074680000-0x0000000074D6E000-memory.dmp

memory/2340-6-0x00000000055F0000-0x00000000056A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AG2B0QEC274DFIV9Z48G.temp

MD5 98ced1703ff20262e849b2af5f8b5cfc
SHA1 55edcf40e14597b5a5605fb988e85d1869306898
SHA256 1589d0686b0b70cfb9eed53fe132a3ab17cb2facb82a8e00dfc11f8ffb83bb89
SHA512 b5829effdc2357ed652bc221cfd6da5dc87c90f26ca7399d997d4630b86ad18cececb5290fad71309eac11563258d88e0cfbb6a227fcb18bab2971bb5f5ef5bd

C:\Users\Admin\AppData\Local\Temp\tmpC6F.tmp

MD5 7edf6cb7b4aa49fe1cbd45bc45826dcb
SHA1 9294a5c2c165ae6e09dd7ffba14727ce14291389
SHA256 e5e3e34c278c6b02c06d96c36da5a016f20992b8a93a4cbbe8ed5c3c1de59666
SHA512 01d9d8d888ec7f0d91c2700b8d316adc2f4e858616d980e190aba2e4e8aa1d330c1c322b0a4b9f52fa7d89f9b55089dd5d2e554f8b935e75f8ee0ea2628628ec

memory/2852-19-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2852-29-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2852-28-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2852-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2852-23-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2852-21-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2340-32-0x0000000074680000-0x0000000074D6E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-08 07:02

Reported

2025-03-08 07:05

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

Signatures

DarkCloud

stealer darkcloud

Darkcloud family

darkcloud

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5080 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 5080 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 5080 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Windows\SysWOW64\schtasks.exe
PID 5080 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
PID 5080 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OjzZfu.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OjzZfu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp"

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp

Files

memory/5080-0-0x000000007526E000-0x000000007526F000-memory.dmp

memory/5080-1-0x0000000000600000-0x00000000006D8000-memory.dmp

memory/5080-2-0x0000000005770000-0x0000000005D14000-memory.dmp

memory/5080-3-0x0000000005090000-0x0000000005122000-memory.dmp

memory/5080-4-0x0000000005150000-0x000000000515A000-memory.dmp

memory/5080-5-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/5080-6-0x0000000005740000-0x0000000005750000-memory.dmp

memory/5080-7-0x000000007526E000-0x000000007526F000-memory.dmp

memory/5080-8-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/5080-9-0x00000000064D0000-0x0000000006588000-memory.dmp

memory/5080-10-0x0000000008C20000-0x0000000008CBC000-memory.dmp

memory/4948-15-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/4948-16-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

memory/4948-18-0x0000000005770000-0x0000000005D98000-memory.dmp

memory/4948-17-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/2012-19-0x0000000075260000-0x0000000075A10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp

MD5 e2a5de162c4343c2d39b4e13fdf42a38
SHA1 288233948a2ce3e833c1ddf6874eb32bd07c98f2
SHA256 21de388580a5ad49d0b9d4fe05e0045bda76770fae386220e4e6a7ad787fb2fe
SHA512 73728778a3815a0fc2ae4ed9ad3a6f34962b8a4657f9eb8e337a61b0aa9e9477a3b95baf670293cea12fbee2d8f7c2d177e6480a7d332121b4a079895d3c5012

memory/2012-20-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/4948-22-0x0000000005E20000-0x0000000005E42000-memory.dmp

memory/2012-23-0x0000000075260000-0x0000000075A10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qljlfik.usi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3944-45-0x0000000000400000-0x000000000046D000-memory.dmp

memory/4948-40-0x00000000061A0000-0x00000000064F4000-memory.dmp

memory/3944-46-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2012-25-0x0000000005B10000-0x0000000005B76000-memory.dmp

memory/4948-24-0x0000000005FC0000-0x0000000006026000-memory.dmp

memory/5080-51-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/4948-52-0x0000000006C60000-0x0000000006CAC000-memory.dmp

memory/4948-50-0x00000000066B0000-0x00000000066CE000-memory.dmp

memory/2012-65-0x00000000071D0000-0x00000000071EE000-memory.dmp

memory/4948-60-0x0000000070040000-0x000000007008C000-memory.dmp

memory/2012-54-0x0000000070040000-0x000000007008C000-memory.dmp

memory/2012-53-0x0000000007190000-0x00000000071C2000-memory.dmp

memory/4948-75-0x00000000076E0000-0x0000000007783000-memory.dmp

memory/2012-76-0x0000000007B80000-0x00000000081FA000-memory.dmp

memory/2012-77-0x0000000007530000-0x000000000754A000-memory.dmp

memory/4948-78-0x0000000007A50000-0x0000000007A5A000-memory.dmp

memory/2012-79-0x00000000077B0000-0x0000000007846000-memory.dmp

memory/2012-80-0x0000000007730000-0x0000000007741000-memory.dmp

memory/2012-81-0x0000000007760000-0x000000000776E000-memory.dmp

memory/2012-82-0x0000000007770000-0x0000000007784000-memory.dmp

memory/2012-83-0x0000000007870000-0x000000000788A000-memory.dmp

memory/2012-84-0x0000000007850000-0x0000000007858000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d6a8b68195d75a12548e57f9f4e42b8c
SHA1 bb58d2ff8212b99b6d7896d016c6b166f5a2a67c
SHA256 4d4f1f68fa79fed495e36142aea32a0e5d2c62c7687df8f57e9d891763776876
SHA512 dea3ea2fe55c2abb8229d8ba89c167b1c0d83b683ce30043d697f19e9edd675ee8e0ae51e50f8f2302ab25876777083c328a375b4f578f391280774b36510acf

memory/4948-91-0x0000000075260000-0x0000000075A10000-memory.dmp

memory/2012-92-0x0000000075260000-0x0000000075A10000-memory.dmp