Analysis
- max time kernel
26s - max time network
26s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 16:10
Behavioral task
behavioral1
Sample
PINK Theme.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target PINK Theme.exe
- Size 4.7MB
- Sample260504-tmf35sft71
- SHA256 8be75984d959fd83a384550d4858958974f2e9821215b18b7e4c0e47c3b43ac9
- MD5 5919b685de68121280db1ece9bc23a2e
- SHA1 96191471972c0f93435f59beebb43fc2de763673
- SHA512 717fce8e36cda1811657c9075b4e9e9499fc4fb50b1687e73361bd08452d973cca9e15fd6469065b01fc8fe45a0efbbc6077ae8b6848f0db24231500eb574adb
- SSDEEP 98304:h5OQHNfk2gC2s4Gn+fGVPxEq55MJS7AdsmumtSF0zJe35x/tq:btHm9i4mU7lJS0dsD0SF0te35xA
- TLSH T13F36023BF28B653EE02A1B357AB2A120583B7E6165124C569AECF48CCF355701D3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
Andere
C2
-
http://ctrl.jtobler.net:443/agent.ashx
Attributes
-
mesh_id
0xC150274CAAC1BF26178E5B3DC9E0461B54CABBE7530D030CBAB8CE90802A63C2DDF740F1CDEDBA644CDF020567C8DFE8
-
server_id
00ADE40E8879E49A96EAC493C53540CBC5155C0536F4B3C2A9B7FCF227D0DD429FF935B871E4E0EBF8C4F2A332920B0F
-
wss
wss://ctrl.jtobler.net:443/agent.ashx
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b37b-54.dat family_meshagent - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1500 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 1500 powershell.exe 824 powershell.exe 644 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VAPE-injector_service\ImagePath = "\"C:\\Program Files\\VAPE injector\\VAPE-injector_service\\VAPE_injector.exe\" --meshServiceName=\"VAPE-injector_service\"" VAPE_injector.exe - Executes dropped EXE 6 IoCs
pid Process 3828 PINK Theme.tmp 4652 VAPE_injector.exe 2260 VAPE_injector.exe 3440 VAPE_injector.exe 2960 VAPE_injector.exe 4780 VAPE_injector.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\sechost.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\combase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\DLL\imm32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\sechost.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\DLL\dbgcore.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\comctl32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\sechost.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\crypt32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\win32u.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\comctl32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\crypt32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\sechost.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\shell32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\MeshService64.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\DLL\imm32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\user32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\dbghelp.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\kernel32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\combase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\Kernel.Appcore.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb VAPE_injector.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\shell32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\ncrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\ucrtbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\bcryptprimitives.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\user32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\msvcrt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\ncrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\ncrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\gdiplus.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\ncrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\ntasn1.pdb VAPE_injector.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\169DB29EA9AF130F9B16DBF7C8A5A628A39164DE VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\apphelp.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\DLL\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\gdi32full.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\win32u.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\symbols\exe\MeshService64.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\gdi32full.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\msvcp_win.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb VAPE_injector.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\dll\rpcrt4.pdb VAPE_injector.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\advapi32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\msvcrt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ole32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\shcore.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\crypt32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\DLL\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\gdi32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\imm32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\dbghelp.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\sechost.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\rpcrt4.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\shell32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\iphlpapi.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\sechost.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\ole32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\Kernel.Appcore.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\sechost.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\DLL\kernel32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ucrtbase.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ntasn1.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\DLL\imm32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\combase.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\dbghelp.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\ntasn1.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\Kernel.Appcore.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\exe\MeshService64.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dbghelp.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\rpcrt4.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\rpcrt4.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\win32u.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\msvcrt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\shell32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ntasn1.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\bcryptprimitives.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\win32u.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\gdi32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\gdi32full.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\DLL\iphlpapi.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\ntdll.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\kernelbase.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\ws2_32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\rpcrt4.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\win32u.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\shell32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\gdiplus.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\ncrypt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.db VAPE_injector.exe File created C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.msh VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\comctl32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\DLL\dbgcore.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\Kernel.Appcore.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\ntdll.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\crypt32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\dll\advapi32.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\MeshService64.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\symbols\DLL\iphlpapi.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\bcrypt.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\dll\ntdll.pdb VAPE_injector.exe File opened for modification C:\Program Files\VAPE injector\VAPE-injector_service\DLL\iphlpapi.pdb VAPE_injector.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PINK Theme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PINK Theme.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2364-1-0x00000000001A0000-0x00000000002B6000-memory.dmp innosetup behavioral2/memory/2364-86-0x00000000001A0000-0x00000000002B6000-memory.dmp innosetup behavioral2/memory/2364-150-0x00000000001A0000-0x00000000002B6000-memory.dmp innosetup - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3828 PINK Theme.tmp 3828 PINK Theme.tmp 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 824 powershell.exe 824 powershell.exe 644 powershell.exe 644 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1500 powershell.exe Token: SeIncreaseQuotaPrivilege 1500 powershell.exe Token: SeSecurityPrivilege 1500 powershell.exe Token: SeTakeOwnershipPrivilege 1500 powershell.exe Token: SeLoadDriverPrivilege 1500 powershell.exe Token: SeSystemProfilePrivilege 1500 powershell.exe Token: SeSystemtimePrivilege 1500 powershell.exe Token: SeProfSingleProcessPrivilege 1500 powershell.exe Token: SeIncBasePriorityPrivilege 1500 powershell.exe Token: SeCreatePagefilePrivilege 1500 powershell.exe Token: SeBackupPrivilege 1500 powershell.exe Token: SeRestorePrivilege 1500 powershell.exe Token: SeShutdownPrivilege 1500 powershell.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeSystemEnvironmentPrivilege 1500 powershell.exe Token: SeRemoteShutdownPrivilege 1500 powershell.exe Token: SeUndockPrivilege 1500 powershell.exe Token: SeManageVolumePrivilege 1500 powershell.exe Token: 33 1500 powershell.exe Token: 34 1500 powershell.exe Token: 35 1500 powershell.exe Token: 36 1500 powershell.exe Token: SeIncreaseQuotaPrivilege 1500 powershell.exe Token: SeSecurityPrivilege 1500 powershell.exe Token: SeTakeOwnershipPrivilege 1500 powershell.exe Token: SeLoadDriverPrivilege 1500 powershell.exe Token: SeSystemProfilePrivilege 1500 powershell.exe Token: SeSystemtimePrivilege 1500 powershell.exe Token: SeProfSingleProcessPrivilege 1500 powershell.exe Token: SeIncBasePriorityPrivilege 1500 powershell.exe Token: SeCreatePagefilePrivilege 1500 powershell.exe Token: SeBackupPrivilege 1500 powershell.exe Token: SeRestorePrivilege 1500 powershell.exe Token: SeShutdownPrivilege 1500 powershell.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeSystemEnvironmentPrivilege 1500 powershell.exe Token: SeRemoteShutdownPrivilege 1500 powershell.exe Token: SeUndockPrivilege 1500 powershell.exe Token: SeManageVolumePrivilege 1500 powershell.exe Token: 33 1500 powershell.exe Token: 34 1500 powershell.exe Token: 35 1500 powershell.exe Token: 36 1500 powershell.exe Token: SeIncreaseQuotaPrivilege 1500 powershell.exe Token: SeSecurityPrivilege 1500 powershell.exe Token: SeTakeOwnershipPrivilege 1500 powershell.exe Token: SeLoadDriverPrivilege 1500 powershell.exe Token: SeSystemProfilePrivilege 1500 powershell.exe Token: SeSystemtimePrivilege 1500 powershell.exe Token: SeProfSingleProcessPrivilege 1500 powershell.exe Token: SeIncBasePriorityPrivilege 1500 powershell.exe Token: SeCreatePagefilePrivilege 1500 powershell.exe Token: SeBackupPrivilege 1500 powershell.exe Token: SeRestorePrivilege 1500 powershell.exe Token: SeShutdownPrivilege 1500 powershell.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeSystemEnvironmentPrivilege 1500 powershell.exe Token: SeRemoteShutdownPrivilege 1500 powershell.exe Token: SeUndockPrivilege 1500 powershell.exe Token: SeManageVolumePrivilege 1500 powershell.exe Token: 33 1500 powershell.exe Token: 34 1500 powershell.exe Token: 35 1500 powershell.exe Token: 36 1500 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3828 PINK Theme.tmp - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3828 PINK Theme.tmp - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2364 wrote to memory of 3828 2364 PINK Theme.exe 80 PID 3828 wrote to memory of 1500 3828 PINK Theme.tmp 81 PID 1500 wrote to memory of 4652 1500 powershell.exe 84 PID 2260 wrote to memory of 824 2260 VAPE_injector.exe 88 PID 2260 wrote to memory of 2960 2260 VAPE_injector.exe 91 PID 2260 wrote to memory of 644 2260 VAPE_injector.exe 93 PID 2260 wrote to memory of 4780 2260 VAPE_injector.exe 95 PID 2260 wrote to memory of 4620 2260 VAPE_injector.exe 98 PID 4620 wrote to memory of 1856 4620 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\is-HOZENPHY0P.tmp\PINK Theme.tmp"C:\Users\Admin\AppData\Local\Temp\is-HOZENPHY0P.tmp\PINK Theme.tmp" /SL5="$50214,2538853,1080320,C:\Users\Admin\AppData\Local\Temp\PINK Theme.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\Windows\install.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\ProgramData\Windows\VAPE_injector.exe"C:\ProgramData\Windows\VAPE_injector.exe" -fullinstall4⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in System32 directory
PID:4652
-
-
-
-
C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exe"C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exe" --meshServiceName="VAPE-injector_service"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:824
-
-
C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exeVAPE_injector.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:644
-
-
C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exeVAPE_injector.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4780
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵PID:1856
-
-
-
C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exe"C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3440
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\VAPE injector\VAPE-injector_service\VAPE_injector.db.tmp
- Size 160KB
- SHA256 45adafba196d5c0ade1639c6e3d87942e5f52787136c2389a0a86243c13be2f4
- MD5 d703a5dc83da2289a3f8469daad58abc
- SHA1 4d5a47805c53a4120a5956fc4d14753df2f4c110
- SHA512 deebe90c23058ffd167eb807f993b8cd84c4b73875306102be73b70def5182578cb0a2cc8925024637ffea3850928ff87fbe6e54e04995ab45f3fa312a5f3f7f
- SSDEEP 3072:e9f8mV9nVMSTiEN5ziAEieHhuUxZO/NWjDpRPJa3+t1uGCFGu4wY3Q6R:Y8A9nVFTN5ziDiOUsOQjD5puGexc
- TLSH T1A1F3F129CF6E613E2F9713512C0B8DB27BE80770874705522EDF582DC2BD799A5AF0A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows\VAPE_injector.exe
- Size 3.3MB
- SHA256 f79e34331dda1c74c099aa13ed2b86f12b5e379d69bcdca6d4bf093e533fff91
- MD5 2f53f6c5af24115272024930bd4df6a7
- SHA1 39d2844bc77e27375d4836b600da8602b9cf1f73
- SHA512 55ce42945d2da560edafa44f325590251be70c9e38d3f3123b0036ff74d16f63ed32e5116dfb517513f738e2391180478da1684caa38b5c05106cd8028de6afc
- SSDEEP 49152:EdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bH:gHvfGfZvZj1/N/z/owJH
- TLSH T159F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows\install.ps1
- Size 19KB
- SHA256 6894bf435c19d5e4884be933aa3051f02aa96cb4db142d2d2a05146a8028f0c4
- MD5 d73d69a92d17f90d3694a606db72138a
- SHA1 f689bc2fee0f574a0d42b44c49541cac892901a0
- SHA512 9439c9165aa45bac58f9fa9b5dccbf7013dd344c8457cf502c2c7731205b7ced50b3af1b1cbc0b3135fb542b2bd1e16bf41134e93477f0a14484617fc35c47db
- SSDEEP 192:BKR7gGNnoR/jqYsLfyimkvzkytiAeNZNArCWggpR/ByRiRs/TzSlfwiUSCChio:ppqoj+vl82
- TLSH T1F792EB3515C0017D7682D7AC69CB60423D3AB0ABB1686A15F2CDB280EFDE09D87F5AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows\l.psm1
- Size 4KB
- SHA256 37a93fdd655608d44ca886e1f089e38d771309c62a3bb1f6cc4d542df691f73b
- MD5 d4e622bdc13accb1de74837da620c741
- SHA1 b62c3fb8c43f1a3f73ad64e0756c9f123d35fc1e
- SHA512 6b712c07e35023a430167380a9d35dd63bf25320b0db75686f9a3b86862e11f35370cb7aa6f57f08b135cad8ccd23de6731eebbf416dd61e6a6d821e1ec08d22
- SSDEEP 96:gGLsuu9prPB9DaifaUtjG2ZCW8IQ2gNq4oOlQDnz3eagy:gTT9prPB4xUQ2ZCJI5gN7oOSDzRgy
- TLSH T1B89195743E664634324BD61D68D3B1A101B2718F3A186AA9B0ECF7C42FCD92C91F27B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Windows\pre.ps1
- Size 8KB
- SHA256 a0599a7c546351af366869be868ccc9c63207b73618c59b50ee3987b351640e8
- MD5 40fef01fa240a4cf5ed5f266d73e7bd6
- SHA1 2f937971dca63782aef773438d12ce0e24f31178
- SHA512 35883195fb28c91914525f97bcaf6a06fbb5427ee806d5e1130169c3b2356fb159b46284f9e97a8226420ec362d1d3c3ce8963a53d4850c1be4149b16e6771af
- SSDEEP 96:SJFg8rQYvUX/2GJCCyJYnOtoLQ5KVYITadzCHhMUkipA:IFg8rQYk/2GJCCyJYnOt8Q2FT5qjipA
- TLSH T1BC02DA750490052DB19ACA8D30C224527D3FF0ABB2681936F2DDB3809FDD1D887B8BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3klhlddl.cnd.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-HOZENPHY0P.tmp\PINK Theme.tmp
- Size 5.9MB
- SHA256 ada6c88865597b0e76e6f79336e26b8a01d634e904795de6f5ddc13565c6f8c2
- MD5 fddc7ed61f04e5293349a896c7c6264a
- SHA1 e5bd6bb3982bdfeb7ff87beb8c24694161b6f501
- SHA512 b6779094439cc02dd172e90efe9dad0383487e71a658dc275b0858007f4f3b3f42b6296ddb837dc5b0d26952259f45fe6b971b3d8136db14ca5ef665f048248b
- SSDEEP 98304:mvdHRh7cGM90sD72C77bK3UnzU0dgmopmG0dXqF333p333Mu:UHnsDqif/zU0dwz0d6Uu
- TLSH T13556AF23F384A53ED4671B3A687BA645583FBA302A158C476BFC3D5C4E396402D3A787
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
- MD5 22e796539d05c5390c21787da1fb4c2b
- SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
- SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
- TLSH T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 def555a750c3c7d8e7f1d09a3d36ab4021f5bd220e7541c70795e4c5a25cd471
- MD5 f8a3b943beca7eaed7f6e6610849dd34
- SHA1 e411adcfffafb5caeb449eb529c23ac7ce8c25d8
- SHA512 81210006549693afd8665aa52764858a51d7d26b2531576238db0182cd98a6bea43fa212b89e8a944c75b7d0b008095e6ac1f5f4435d82ee097565f91f6a8f30
- TLSH T1D0316637B39CC7A5C88951BE10D8AC01B1A7C3C7809E8EDB6A8CC518957F5ABCB641A4
- MD5 SHA1 SHA512 TLSH