donutloader | c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Size 1.9MB
Sample260426-v1rx8sc16w
SHA256 c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0
MD5 b0487bfacb148d68055aa7bbe2d0eee3
SHA1 4356dce47042e4b3bcbba456dd13e986f4f9c2e6
SHA512 4010b0ff5e674de7c3b13a537360e72821295eb4aedd2cd520733c525b9059925a0af8ea610683d4504133406d1c6c14db1366e7fdfc59cd9e0f82a71fc27957
SSDEEP 24576:FMyrv4FQ+c5IktyHa9vhwpHVCJ3taIL3OreJOw1OwJ:X4F5O9ECEIDseJOw1OwJ
TLSH
T116954B23B6457529E45ADE3A7826B2FC543F7DA06502BD0F67E0350CBE392402D2A67F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/files/0x0007000000024525-219.dat	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3808	powershell.exe
2828	powershell.exe
308	powershell.exe
5360	powershell.exe
3216	powershell.exe
5948	powershell.exe
4932	powershell.exe
3340	powershell.exe
4524	powershell.exe
1788	powershell.exe
1728	powershell.exe
4600	powershell.exe
4780	powershell.exe
4752	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe

Loads dropped DLL 6 IoCs

pid	Process
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
5444	MsiExec.exe
5444	MsiExec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	5444	MsiExec.exe
18	5444	MsiExec.exe
20	5444	MsiExec.exe
21	5444	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C66.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DCF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5246.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56DA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5848fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5848fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E2E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
4752	powershell.exe
4600	powershell.exe
5948	powershell.exe
4780	powershell.exe
4932	powershell.exe
3808	powershell.exe
4600	powershell.exe
4780	powershell.exe
5948	powershell.exe
4752	powershell.exe
4932	powershell.exe
3808	powershell.exe
1492	msiexec.exe
1492	msiexec.exe
5444	MsiExec.exe
5444	MsiExec.exe
5444	MsiExec.exe
5444	MsiExec.exe
2828	powershell.exe
308	powershell.exe
5360	powershell.exe
3340	powershell.exe
308	powershell.exe
3340	powershell.exe
2828	powershell.exe
5360	powershell.exe
4524	powershell.exe
1788	powershell.exe
1788	powershell.exe
1728	powershell.exe
1728	powershell.exe
3216	powershell.exe
3216	powershell.exe
1788	powershell.exe
4524	powershell.exe
4524	powershell.exe
3216	powershell.exe
1728	powershell.exe
5444	MsiExec.exe
5444	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeShutdownPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeIncreaseQuotaPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSecurityPrivilege	1492	msiexec.exe
Token: SeCreateTokenPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeAssignPrimaryTokenPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeLockMemoryPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeIncreaseQuotaPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeMachineAccountPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeTcbPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSecurityPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeTakeOwnershipPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeLoadDriverPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSystemProfilePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSystemtimePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeProfSingleProcessPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeIncBasePriorityPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeCreatePagefilePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeCreatePermanentPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeBackupPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeRestorePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeShutdownPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeDebugPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeAuditPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSystemEnvironmentPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeChangeNotifyPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeRemoteShutdownPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeUndockPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeSyncAgentPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeEnableDelegationPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeManageVolumePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeImpersonatePrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeCreateGlobalPrivilege	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe
Token: SeRestorePrivilege	1492	msiexec.exe
Token: SeTakeOwnershipPrivilege	1492	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4600	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	84
PID 4592 wrote to memory of 4780	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	86
PID 4592 wrote to memory of 5948	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	88
PID 4592 wrote to memory of 4752	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	90
PID 4592 wrote to memory of 4932	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	92
PID 4592 wrote to memory of 3808	4592	c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe	94
PID 1492 wrote to memory of 1324	1492	msiexec.exe	99
PID 1492 wrote to memory of 5444	1492	msiexec.exe	100
PID 5444 wrote to memory of 3340	5444	MsiExec.exe	101
PID 5444 wrote to memory of 2828	5444	MsiExec.exe	102
PID 5444 wrote to memory of 308	5444	MsiExec.exe	104
PID 5444 wrote to memory of 5360	5444	MsiExec.exe	106
PID 2828 wrote to memory of 4524	2828	powershell.exe	109
PID 3340 wrote to memory of 1788	3340	powershell.exe	110
PID 308 wrote to memory of 1728	308	powershell.exe	111
PID 5360 wrote to memory of 3216	5360	powershell.exe	112

C:\Users\Admin\AppData\Local\Temp\c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe
"C:\Users\Admin\AppData\Local\Temp\c522eb2c07cca1f37b1807092f3722e6d9ad6183820ad44373f82392c1af80a0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DB4BC5172FD7B6A97924E9E15EED6A0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D4C03FF6F4D6CDFA14B9890029B1A9FA
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5848fe.rbs

Path C:\Config.Msi\e5848fe.rbs
Size 3KB
SHA256 cb574c7fbdab81ccd9afbcd0ed873e9a953d3a8199c15732a4b91296aa35bee9
MD5 eb96e2b05f6da0055bcea625eb9c1cc1
SHA1 2bb9c133dcfe97d29d82a024ac430dfd4b9380a9
SHA512 deb44821ac55372bb31169336b403f1fbd092224c5068563502a92c03544ed1ec0faed54a1d54f2a04138b2c389196831ac4d0be28e67f398e1a62700b4ac01f
TLSH
T1A261A17496D3C2CCD491E8F187E3A0AC9FD98D6A5E65E468DE0F4DAD2953140FC1814E
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
TLSH
T1A351EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download