Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/05/2026, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
点击安装中文语言包.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
点击安装中文语言包.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target 点击安装中文语言包.exe
- Size 5.5MB
- Sample260526-ffepvaby2j
- SHA256 4ef56fe1c4c570f02e7248013ab4b44dcdfdeff54ec9792a3bfca7abedbff4b5
- MD5 2f618c9fb28870f29543c04c0d98a16e
- SHA1 d23a42294c9d07f94f537ca5255d97570e696ecb
- SHA512 89ff478d1ff7b264c75787b7bd7c6c4304db865857d367ddde34f78a18cc6605c33bc965defabcfd80c47b4d34d870956bcb31f23ac588a6f416531712560b10
- SSDEEP 98304:rtN/0sO6G+RQ6zAMkREv6L3tZ9jHr8zOXXxEHuW+Xthc/qH1M0feHYcsP7OunAqg:rta6G+qMkREihZ9jHr8zOXh8dqHae9DY
- TLSH T11E4633453BC14572D9A521332462D77227BDADA14F05ABD3B3A87A35E930CC0E739B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral1/files/0x00070000000245f8-249.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 756 powershell.exe 3528 powershell.exe 2608 powershell.exe 1708 powershell.exe 1992 powershell.exe 2484 powershell.exe 3536 powershell.exe 1112 powershell.exe 2288 powershell.exe 1028 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation 点击安装中文语言包.exe - Executes dropped EXE 2 IoCs
pid Process 4132 1.chation_mscate..exe 4400 1.chation_mscate..tmp - Loads dropped DLL 8 IoCs
pid Process 4400 1.chation_mscate..tmp 4400 1.chation_mscate..tmp 3808 MsiExec.exe 3808 MsiExec.exe 3808 MsiExec.exe 3808 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 24 1056 MsiExec.exe 26 1056 MsiExec.exe 29 1056 MsiExec.exe 41 1056 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1056 set thread context of 6012 1056 MsiExec.exe 128 - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Python\is-F291YXF6KN.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-DLNQX9KITQ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-I2V8MIOKX4.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-RSK8YJC262.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-85VR6VYUYE.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-4X9WL5EGB3.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-5U28J7YZDZ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-VH1ZOCZ2G4.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-MIJRBCD6XY.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-FN811LFQE3.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-1UD2AOSIQU.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-KHDQIKR3K2.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-6BTRKT7GD5.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-HQ0CU1XGHO.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-2UZEAM2ERM.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-MOUA70MJ36.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-EOWI4B72X1.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-NK76AHYTU6.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-N27DI22VOJ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-8JE9GROXQQ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-AW1HS8TDX8.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\is-BV2N5IV5HA.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-ICB1CLS22D.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-Z29344EDPA.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-9FKTULZ9HP.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-RIRXW0WYXB.tmp 1.chation_mscate..tmp File opened for modification C:\Program Files\Python\unins000.dat 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-SAD8TZ495X.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-JDAELWLMYY.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-J4EIFZ02UM.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-2O3F4DH6HI.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-ECQ3BD813W.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-PH3BFC0NUX.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-A4N9BNDBYH.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-6HTV6WALSU.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-PVI7PVZL7S.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\is-N5T5JL640D.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\unins000.dat 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-BSU8FMXCAZ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-9KYMCTDRUX.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-R3GKX4A6KJ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-F01D1HG358.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-TPN1YSG3Z2.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-P57BMM6275.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-3UFFHHQ9FV.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-20LSVD0ITR.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-UEX29SZ1PZ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-BA30NZOPDA.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-LKE3MF7FIN.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-VBCHHYSDQJ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-PRGPJQWR23.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-NMKR2LH9U6.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-172KHJKHUW.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-MG8996LTUV.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-AZMZWDFJOS.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-WU72ZSN9KL.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-D4ZMMOTQQX.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-69ZHQASNTS.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-AL0321Y85Z.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-L2EGLMK8CO.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-KOTRIPV764.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-KS5EBN01GF.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-3863HAU4BZ.tmp 1.chation_mscate..tmp File created C:\Program Files\Python\7_files\is-NYOIQS02ZH.tmp 1.chation_mscate..tmp - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e586099.msi msiexec.exe File opened for modification C:\Windows\Installer\e586099.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI63F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6463.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI64A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI64F2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe File opened for modification C:\Windows\Installer\MSI685E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B0E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 点击安装中文语言包.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.chation_mscate..exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.chation_mscate..tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x002100000002438b-6.dat innosetup behavioral1/memory/4132-16-0x0000000000C00000-0x0000000000CED000-memory.dmp innosetup behavioral1/memory/4132-337-0x0000000000C00000-0x0000000000CED000-memory.dmp innosetup - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings cmd.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 3680 msiexec.exe 3680 msiexec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 3528 powershell.exe 3528 powershell.exe 756 powershell.exe 756 powershell.exe 1992 powershell.exe 1992 powershell.exe 2484 powershell.exe 2484 powershell.exe 3536 powershell.exe 3536 powershell.exe 3536 powershell.exe 3528 powershell.exe 756 powershell.exe 2484 powershell.exe 1992 powershell.exe 1708 powershell.exe 1708 powershell.exe 1112 powershell.exe 1112 powershell.exe 1028 powershell.exe 1028 powershell.exe 2288 powershell.exe 2288 powershell.exe 2288 powershell.exe 1708 powershell.exe 1112 powershell.exe 1028 powershell.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 1056 MsiExec.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe 6012 Dism.exe - Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeShutdownPrivilege 3900 msiexec.exe Token: SeIncreaseQuotaPrivilege 3900 msiexec.exe Token: SeSecurityPrivilege 3680 msiexec.exe Token: SeCreateTokenPrivilege 3900 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3900 msiexec.exe Token: SeLockMemoryPrivilege 3900 msiexec.exe Token: SeIncreaseQuotaPrivilege 3900 msiexec.exe Token: SeMachineAccountPrivilege 3900 msiexec.exe Token: SeTcbPrivilege 3900 msiexec.exe Token: SeSecurityPrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeLoadDriverPrivilege 3900 msiexec.exe Token: SeSystemProfilePrivilege 3900 msiexec.exe Token: SeSystemtimePrivilege 3900 msiexec.exe Token: SeProfSingleProcessPrivilege 3900 msiexec.exe Token: SeIncBasePriorityPrivilege 3900 msiexec.exe Token: SeCreatePagefilePrivilege 3900 msiexec.exe Token: SeCreatePermanentPrivilege 3900 msiexec.exe Token: SeBackupPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeShutdownPrivilege 3900 msiexec.exe Token: SeDebugPrivilege 3900 msiexec.exe Token: SeAuditPrivilege 3900 msiexec.exe Token: SeSystemEnvironmentPrivilege 3900 msiexec.exe Token: SeChangeNotifyPrivilege 3900 msiexec.exe Token: SeRemoteShutdownPrivilege 3900 msiexec.exe Token: SeUndockPrivilege 3900 msiexec.exe Token: SeSyncAgentPrivilege 3900 msiexec.exe Token: SeEnableDelegationPrivilege 3900 msiexec.exe Token: SeManageVolumePrivilege 3900 msiexec.exe Token: SeImpersonatePrivilege 3900 msiexec.exe Token: SeCreateGlobalPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeDebugPrivilege 3528 powershell.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeDebugPrivilege 2484 powershell.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 1708 powershell.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe Token: SeRestorePrivilege 3680 msiexec.exe Token: SeTakeOwnershipPrivilege 3680 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4400 1.chation_mscate..tmp - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2524 OpenWith.exe 6012 Dism.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3368 wrote to memory of 4132 3368 点击安装中文语言包.exe 90 PID 3368 wrote to memory of 2240 3368 点击安装中文语言包.exe 92 PID 4132 wrote to memory of 4400 4132 1.chation_mscate..exe 94 PID 4400 wrote to memory of 3900 4400 1.chation_mscate..tmp 100 PID 3680 wrote to memory of 3808 3680 msiexec.exe 102 PID 3680 wrote to memory of 1056 3680 msiexec.exe 106 PID 1056 wrote to memory of 1992 1056 MsiExec.exe 107 PID 1056 wrote to memory of 756 1056 MsiExec.exe 108 PID 1056 wrote to memory of 3528 1056 MsiExec.exe 110 PID 1056 wrote to memory of 2484 1056 MsiExec.exe 113 PID 1056 wrote to memory of 3536 1056 MsiExec.exe 115 PID 3536 wrote to memory of 2608 3536 powershell.exe 117 PID 3528 wrote to memory of 1708 3528 powershell.exe 118 PID 756 wrote to memory of 1112 756 powershell.exe 119 PID 1992 wrote to memory of 2288 1992 powershell.exe 120 PID 2484 wrote to memory of 1028 2484 powershell.exe 121 PID 1056 wrote to memory of 6012 1056 MsiExec.exe 128 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\点击安装中文语言包.exe"C:\Users\Admin\AppData\Local\Temp\点击安装中文语言包.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe"C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\is-T7O13Y6ZPA.tmp\1.chation_mscate..tmp"C:\Users\Admin\AppData\Local\Temp\is-T7O13Y6ZPA.tmp\1.chation_mscate..tmp" /SL5="$E002C,4289231,909312,C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\msiexec.exe"msiexec.exe" /i "C:\Program Files\Python\unlyric.msi" /qn4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\com2masta.bat" "2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2240
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2524
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9AD2B0F5FB4A3431C4FE370CE978B4342⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3808
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding EE0E76F4E4E8129E1C92196EF8493FE12⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
PID:2608
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6012
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58609c.rbs
- Size 3KB
- SHA256 0fe3366920e9a1cd7cb7c057e0b007dc2e56f3ec9d2e126e528d0f1d13aa3ce2
- MD5 c441fa1d4c759ccbcfac4e50c39867ef
- SHA1 6649e01cc3910a21967f414d32a9c5e8b1d3b8c3
- SHA512 b922ead26b602eb75e82f02d1d66fa433be16cc4263e05d32ea7e31efa8450633b1c86d5129655124ab60807d5aa7e0acd9ad2713133086de9d6e8372a5cb547
- TLSH T1EE61917496D3C2CCD491E8F087E2A0BC9F999D6A6E66E468EE0F4D6D2963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Python\7_files\is-7EQP6JAKSI.tmp
- Size 149B
- SHA256 97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
- MD5 3c2ccda97c47ede0b1c91b11efd575ea
- SHA1 0a348c4b61c961aba7618f909beb87f740a81983
- SHA512 31afbe911abfda33a2948d14578ba290b604920983118ca5a6268a9906120ef365416e5e776ea685d648eef7a2ee2245f424829fdd4c7150d944f4bf673aee28
- TLSH T150C08CB52412200BA220AAA2DADDE56408408010A04A8C82A04039AC65CC35CE8A3690
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Python\7_files\is-ECQ3BD813W.tmp
- Size 53KB
- SHA256 4728844ab037049a6396b5528dbd628808f7bc8156b344ebc740db90e3863b42
- MD5 266d724cdd4db30b51b69c6e7bf97aef
- SHA1 9449939fc138488b86febacce175f37952b74634
- SHA512 3e38019a44c09d1afd7a036d3a2bbb2a8a68c698338ac3fefb4e1922c631596f7cf7fdd9855c6ebf2e6866c742ac9be5dbb4cb653c87a7e03b538f9b9c776854
- SSDEEP 768:uq3CZDHop9bxcrIMHsiENgv/LinEF0P408TXw3Pk7GlCBWILJTBqdvXYU:D3YKxcrT/pHiP3gw3PtvILtBqlX1
- TLSH T18D3302EBF2570B88F4A185F6F9F0CC4A6ACFA47DEB05454E19C6210B4A21794E10D63F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
- MD5 b594c0a5591fab95a43185dd9944a231
- SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
- SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
- TLSH T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 859f5c5c9054687b8fc6ba18c040f7d5f873f7eaf046783af6cb72899df12138
- MD5 3065dd47568cd0b46c3ad559511677fc
- SHA1 a1b058eb45302fe30bd2fee4fca6d0bc731d5a20
- SHA512 c782182d59c43964241c77a86f2ab35183c124cea6d57ab3b86a96c1d846250b7fd25c72ddcee9f63aedb73cf2efd897a61fbe196b8df189a09b94d5b948bf23
- TLSH T1E4112223F38C8921CC96163A509DAC5172B586CB81AEDF9F7FC0C210A5BF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 16fc218001c9f1417f3e82a4e2cc818bce3a1e22ccb9fb825b225409e1d97279
- MD5 813012435e647ae38e94fad90184beaf
- SHA1 ad6afa38f9542d84aa7e3984d15021e1b0480e7e
- SHA512 9c00cf4b12d03f4bff575bec02023f51372220a5450c52d1d5c5c458331be7edf75a788f6b995e5afda5ff5414fef9e147169ebc59b2eaf83d2a20c1b8cf7404
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 cf77286210311a652589bb48e0cbfe6de01326edcbe375398c83193394d54c8c
- MD5 23cad9debfe9d4f21a16023c91eb033a
- SHA1 2b31c11f27d704405389c3a84b1a4c882ff7450a
- SHA512 756d50212a70d5f864d243ecdbb75a4fbf4c7bae48ede8c2bd75769c31c0ecbb4e3ba54b8a5bcfe518a1dc594ac2db1cba2f547373d5fd780aa45d12b22a2a1d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 5e8d5a2ee09fa1add19e29fee9a64f2b8c34565196c1ed68a9d37b3b832af614
- MD5 b6941bfff8c35a464c1494a91086aafb
- SHA1 8546302dd22897fcd7cb199197051ebc90b0e553
- SHA512 0a0d1662e06dccd801ec634467b933c8179c1182b84fa782f69893ce9be2b7cd60cc3c02ea64478f67bc33db5925963a367c92957ddef68e4fa29e48544d1d1f
- TLSH T160112223F38C8961CC86153A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 1dacefb2ade03000735a2f8380f08e4ad8f33db4206b371925a2b4fc49ade92d
- MD5 314d9742f714bff464b89aab1607a086
- SHA1 d7ab824de1dd2944d71e5a02ef54e954e3145704
- SHA512 6ba60d9d1c0fca1d7c48391984803975aa440eb503cc345b7586aa1f2f14fdf8d6501edb127446c045b2c6c92cbbf607f717291798625f19c888946f57c7f8f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 e16b609fe7c363d0e3c34fb198c7b2b25005f2355c1e80109714387afa8649d2
- MD5 b2033592f07f7172c24b32e280bfd309
- SHA1 0c03919800b01482b642262a16f4b08e46e01f56
- SHA512 5592fcf913a98d740de9ef7396615afbc6562d105214d7a27d22c6dcb086b6f78e1f88229101243c94c573243b551dae5e0770fde36a529f4dc1a3209e9e0369
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1.chation_mscate..exe
- Size 5.7MB
- SHA256 c4816bb8da4bbf85074a84ea440345c96fa6ed1dd28420fa7077b129986f85a4
- MD5 0d48c381b482a1e3d786b5896415448f
- SHA1 7b5dfd4684d0c8395af1047be8c20537b1193ecd
- SHA512 86694cd01ebf8e404844703e8df1a281e83c53bce806cd8c6c98a2d8a60740ad825fb82bec097889e7c91ae15f68bbf2a78c8c78002520375821dc22062e174c
- SSDEEP 98304:VL8Nchwr9ehRQn2dgTQXJJZvtHbepOY7VEX2UCNNpOsKx/w01eHocmVf+uVAqN/j:09rGjdg8DZvtHbepOY66KxIIXDVmupVj
- TLSH T12B561223B28A653DE07A5A361B73D3A0563F6E516D03CD0AA7F4146CCF395A03E3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3tti2du0.rr0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\com2masta.bat
- Size 64B
- SHA256 0a51e589f434d6c5f381c4ff8411e6a7eea8eac0db450a63d7d3e714f5c3afd1
- MD5 4da568396fabb417466bd5720425e0e7
- SHA1 59d7fdf8ad5c305018e30b79daaafa2a456bd579
- SHA512 2d102eea58d3c6a5af031c13c1eb01f583f0f31bbc8392abf01870fbc4272eca2a03db4a9bc900c5c535c828a089bdb0247576491278304775a47fa845530542
- TLSH T143A022280000082330030C3028C82C0EF0030CCAC208BC0003000E0B8883800BCF0300
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-KCY7QIQEV4.tmp\_isetup\_is7z.dll
- Size 973KB
- SHA256 5fbe8b388573ac086a9374ea466977b543e33c839f00ef6471e584c2cb0690e4
- MD5 4433df94db7dedee7e2e30f3dc0e8d9e
- SHA1 feca7d4e766ef9388b734adae6bd7fe71cd0683b
- SHA512 689f66da4da5e78b5e67451eb883cdcb7ca4176f0ae023f081b25abfa7afde3eadf2e1a2a973d9dcb1be1435c29ce1ed38fe838314259f728cfc52587301cc5f
- SSDEEP 24576:mgsDtokU9Y3ka4R42Qlo6vWjIDRw+KVNwoRGVE:zJk+6EQlbDRzKTwoz
- TLSH T1E325AF02BBEEC1F4DA4E15B04A39AB791379E3148711A9C7A3D02E6E5E30ED1D736E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-KCY7QIQEV4.tmp\_isetup\_isdecmp.dll
- Size 31KB
- SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
- MD5 3d2871f010ab3c038c6df5df11245f86
- SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
- SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
- SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
- TLSH T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-T7O13Y6ZPA.tmp\1.chation_mscate..tmp
- Size 4.2MB
- SHA256 be785978df77e79c13fca468f8eb61a17e13b403e11b1343f85194886c662343
- MD5 3d3912e81fdea94be548641ef07da039
- SHA1 48e11dcaecf6a497d2a1b0e86eb3663a89be5ea1
- SHA512 2cb3899c43e5e281f3dbf0f4f69dd26eb5186656c4b7a31162b25a34681450f5466a3bff836263afd1493c07b76661a38dbcff6fc888a9b1e97bbba33a5b3205
- SSDEEP 98304:/icG2nYJWxvmv99qfccaTY8TXfJjc2UV333Z:9nYJWZWzfJjA
- TLSH T132166D13B788753AE4B71A3A893BA794593F7A213A12CC477BF40D4C4E39640BD2A747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 399KB
- SHA256 22bcc2a44d06769877706fa4c6dac71d99d4e9948512a39cf51f285638807880
- MD5 cfe09fdd1c2ae32423087ac8dcad08b0
- SHA1 5a2b2ea7e26a7e1693c15fee2a2d3b29464c220e
- SHA512 08298afb0b58683b5944cc1563b79eb993092c16dd8d09a307e8578ed12bca56003c50859e5451d4bca9228499e495539e39c5ab5d3a7222ded1a26e0932f24e
- SSDEEP 12288:Cnny0szRubYQSJHc17xP+iAlYb7MStThZ6fMsZai:Cyt0YOlZis4StSfl3
- TLSH T1FE9423E173B5F0539572E4CE7EA29F319D30B0FB1A2D12B31505D63149FA43972AAB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 675KB
- SHA256 30e9d277166471f576ee5d445fa10af5086a757d6d9a019f063e5cf2b31d1b08
- MD5 69149df6ef13e5bbfb576e22e02937d2
- SHA1 9e69b079f0593559cab51714edad1f28efcb4818
- SHA512 a3c2bd72d65b08be4f461a1ba7828a29c2495c02983dd4f138a88ad2d2a2c1474308b4180c973f50b93fe6639cb84ca3d826546961cdb18e2ddfa2413a767402
- SSDEEP 12288:V7D5k9RIj/xHeKOikGlOL1+yNOyFpHVatNHd40wahZtv+ic:dO9RoheKOCOh+ysQ1anHRXfTc
- TLSH T157E4227BC345038CDFE145DC6C8EABE22141412E3ACA4C88E0A55EC5F1AB9F796C5B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Adobe\h16472861748525632546.ini
- Size 26B
- SHA256 27f33275a806ff10d4980fd0ec02e205184a6bf75439c9cc406a1f84d443742f
- MD5 8ccb5bdc19ad3ab8b55ba1dc3cb9ea97
- SHA1 b0838fe50dc75426ea8a7820de975ddf79da9011
- SHA512 2c35c43ecee11c97c79c3b6938773655669d1babdcdb5b236674121ab1a139b49aa9707127156ac9fae3173b8c803c9d6f6b776d2cb1b1c01dc635928a60d672
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI63F5.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6B0E.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH