donutloader | b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Size 2.7MB
Sample260419-ec7qsab19p
SHA256 b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57
MD5 97da8450fed45170c40da3befebcacaf
SHA1 3634208fbc19f09d1674713b2505bd42a14d1790
SHA512 c287cf42bfeee0d256adb12383bb68b6435d8dd4752c186ef7a65cab4976669b3bf5746afbdfa90f8dcfc24f8ad37f28be9f7393fa5a5181392fac587ddcb167
SSDEEP 24576:1yH0lBcmKcXmG+SOr9C6R+QfZaPK7DGgFEiZm2wkgMf1cBD1FYr9O55cUp:/NY7F8CeiZmwXf1aQOYUp
TLSH
T1C2D59E23B30D653AD86B093B693B9550183F7E6169368C83BBE4790C8F3AD015E2F657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/files/0x00070000000242c3-213.dat	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1304	powershell.exe
2116	powershell.exe
4288	powershell.exe
2040	powershell.exe
4980	powershell.exe
4784	powershell.exe
5028	powershell.exe
1788	powershell.exe
2580	powershell.exe
1824	powershell.exe
3372	powershell.exe
4820	powershell.exe
4296	powershell.exe
4116	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe

Loads dropped DLL 6 IoCs

pid	Process
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
4376	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3164 set thread context of 1236	3164	MsiExec.exe	117

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e587d68.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CBF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8037.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8123.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81D0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI884A.tmp	msiexec.exe
File created	C:\Windows\Installer\e587d68.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
4820	powershell.exe
2040	powershell.exe
4296	powershell.exe
4116	powershell.exe
4980	powershell.exe
4784	powershell.exe
2040	powershell.exe
4116	powershell.exe
4296	powershell.exe
4820	powershell.exe
4980	powershell.exe
4784	powershell.exe
1600	msiexec.exe
1600	msiexec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
1304	powershell.exe
1788	powershell.exe
2580	powershell.exe
5028	powershell.exe
2580	powershell.exe
1788	powershell.exe
1304	powershell.exe
5028	powershell.exe
1824	powershell.exe
2116	powershell.exe
2116	powershell.exe
3372	powershell.exe
3372	powershell.exe
4288	powershell.exe
4288	powershell.exe
1824	powershell.exe
1824	powershell.exe
2116	powershell.exe
4288	powershell.exe
3372	powershell.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
3164	MsiExec.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe
1236	Dism.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeIncreaseQuotaPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeCreateTokenPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeAssignPrimaryTokenPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeLockMemoryPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeIncreaseQuotaPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeMachineAccountPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeTcbPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSecurityPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeTakeOwnershipPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeLoadDriverPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSystemProfilePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSystemtimePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeProfSingleProcessPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeIncBasePriorityPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeCreatePagefilePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeCreatePermanentPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeBackupPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeRestorePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeShutdownPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeDebugPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeAuditPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSystemEnvironmentPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeChangeNotifyPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeRemoteShutdownPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeUndockPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeSyncAgentPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeEnableDelegationPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeManageVolumePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeImpersonatePrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeCreateGlobalPrivilege	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	Dism.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2040	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	84
PID 2400 wrote to memory of 4820	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	86
PID 2400 wrote to memory of 4296	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	88
PID 2400 wrote to memory of 4116	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	90
PID 2400 wrote to memory of 4980	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	92
PID 2400 wrote to memory of 4784	2400	b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe	94
PID 1600 wrote to memory of 4376	1600	msiexec.exe	99
PID 1600 wrote to memory of 3164	1600	msiexec.exe	100
PID 3164 wrote to memory of 5028	3164	MsiExec.exe	101
PID 3164 wrote to memory of 1788	3164	MsiExec.exe	102
PID 3164 wrote to memory of 1304	3164	MsiExec.exe	104
PID 3164 wrote to memory of 2580	3164	MsiExec.exe	107
PID 1788 wrote to memory of 2116	1788	powershell.exe	109
PID 2580 wrote to memory of 1824	2580	powershell.exe	110
PID 1304 wrote to memory of 3372	1304	powershell.exe	111
PID 5028 wrote to memory of 4288	5028	powershell.exe	112
PID 3164 wrote to memory of 1236	3164	MsiExec.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe
"C:\Users\Admin\AppData\Local\Temp\b81dbd9727c421e193c4451efa1398cc101f4456c2d92959c5037bd585ff9f57.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CA8CBF5AD850333F7C08A8596C694B1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3ED7E64043292436F7657CB6B614756F
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\windows\system32\Dism.exe
    C:\windows\system32\Dism.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e587d6b.rbs

Path C:\Config.Msi\e587d6b.rbs
Size 3KB
SHA256 e3133f0246585467ec033c27a74c8b44e16bab4ea7c0c7e87222586b7827d19f
MD5 b0278ed160e23ab19ca22e73c3ffcef8
SHA1 9921ee5f7e7d5508ee2a6032ce83b9fa4db1554f
SHA512 757dbb53ad69a7ede9f181827139224906ec6c6b1903236d79039a30f041079bacb4c859d4c0b5ab1f983712629f07130097730d0cfb4747e2dc5821fd1f7b81
TLSH
T19E61A27586D3C2CCD491E8F087E2A0BC8FD99D6A5E66E468EE0F4D6E6963140FC1814E
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download