Overview

overview

10

Static

static

3

Exploit_Launcher.exe

windows11-21h2-x64

10

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

4

Windows Up...nt.exe

windows11-21h2-x64

10

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/06/2026, 19:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Windows Update Assistant.exe
  • Size 154.8MB
  • Sample260608-yakb9aev41
  • SHA256 71d03942ac077f0de702df3fd39965b53ca843f5ba08e6db5071e1ac4608d09e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to get system information.

    execution
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.cs""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.cs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DF1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE207FC66AA43475B90C7E2ECC69E95F1.TMP"
          4⤵
            PID:2032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe
          C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe
          3⤵
          • Executes dropped EXE
          PID:2204
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.cs""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6072
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.cs"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5176
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F87.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC840FB2B7B0EC481D8677BDF0B06745E9.TMP"
            4⤵
              PID:1644
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5204
          • C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe
            C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe
            3⤵
            • Executes dropped EXE
            PID:3124
        • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
          "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1816,i,12965073079109274827,205702001658822045,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
            PID:404
          • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
            "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --mojo-platform-channel-handle=2028 --field-trial-handle=1816,i,12965073079109274827,205702001658822045,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            2⤵
              PID:4908
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "getmac /fo csv /nh"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5300
              • C:\Windows\system32\getmac.exe
                getmac /fo csv /nh
                3⤵
                  PID:1704
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv /nh"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1288
                • C:\Windows\system32\tasklist.exe
                  tasklist /fo csv /nh
                  3⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4172
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3464
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1640
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1748
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3844
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\d_87561701.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\d_87561701.cs""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4740
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\d_87561701.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\d_87561701.cs"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1900
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4188.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC581576A4B74437682A888C3EDCB2F54.TMP"
                    4⤵
                      PID:2828
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\d_87561701.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1208
                  • C:\Users\Admin\AppData\Local\Temp\d_87561701.exe
                    C:\Users\Admin\AppData\Local\Temp\d_87561701.exe
                    3⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Modifies Windows Defender TamperProtection settings
                    • Executes dropped EXE
                    • Windows security modification
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4640
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -File C:\Users\Admin\AppData\Local\Temp\loader_1780947487739.ps1
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3732
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2x4t03ii\2x4t03ii.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3916
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4551.tmp" "c:\Users\Admin\AppData\Local\Temp\2x4t03ii\CSCA97CB33645E14DE6BE3E5EF6D8B64218.TMP"
                      4⤵
                        PID:2816
                  • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                    "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --screenwatch
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:4904
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch" dir=in action=allow protocol=TCP localport=3000"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4528
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="ScreenWatch" dir=in action=allow protocol=TCP localport=3000
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:5220
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch" dir=out action=allow protocol=TCP localport=3000"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3720
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="ScreenWatch" dir=out action=allow protocol=TCP localport=3000
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:3900
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=in action=allow protocol=UDP localport=3000"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5624
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=in action=allow protocol=UDP localport=3000
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:900
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=out action=allow protocol=UDP localport=3000"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3332
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="ScreenWatch-UDP" dir=out action=allow protocol=UDP localport=3000
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:5916
                    • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                      "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1944,i,18269121399684595315,12266509594625944368,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                      3⤵
                        PID:5908
                      • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                        "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --mojo-platform-channel-handle=1736 --field-trial-handle=1944,i,18269121399684595315,12266509594625944368,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                        3⤵
                          PID:2564
                        • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                          "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2320 --field-trial-handle=1944,i,18269121399684595315,12266509594625944368,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                          3⤵
                            PID:1092
                          • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                            "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2540 --field-trial-handle=1944,i,18269121399684595315,12266509594625944368,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                            3⤵
                              PID:4200
                            • C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe
                              "C:\Users\Admin\AppData\Local\Temp\Windows Update Assistant.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\windows-update-assistant" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1944,i,18269121399684595315,12266509594625944368,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3984
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_4479f405.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_4479f405.cs""
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1064
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\h_4479f405.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\h_4479f405.cs"
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5588
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42A2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8B40569159464C06964681AB963EB258.TMP"
                                4⤵
                                  PID:4120
                            • C:\Users\Admin\AppData\Local\Temp\h_4479f405.exe
                              C:\Users\Admin\AppData\Local\Temp\h_4479f405.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1156
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\i_92295617.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\i_92295617.cs""
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4744
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"C:\Users\Admin\AppData\Local\Temp\i_92295617.exe" /nologo /optimize+ "C:\Users\Admin\AppData\Local\Temp\i_92295617.cs"
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1372
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44C4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC930DABED18EA48E79265DE7BD82F8BE3.TMP"
                                  4⤵
                                    PID:1284
                              • C:\Users\Admin\AppData\Local\Temp\i_92295617.exe
                                C:\Users\Admin\AppData\Local\Temp\i_92295617.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:428

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  powershell.exe.log
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                  • Size 3KB
                                  • SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 1KB
                                  • SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 1KB
                                  • SHA256 96adeb3175d43371d79a79c45de45925b2117f410350703e2334525d128cc318
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  18309f38-48fc-4f52-a356-39cc2024d49e.tmp.node
                                  • Path C:\Users\Admin\AppData\Local\Temp\18309f38-48fc-4f52-a356-39cc2024d49e.tmp.node
                                  • Size 137KB
                                  • SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2x4t03ii.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\2x4t03ii\2x4t03ii.dll
                                  • Size 3KB
                                  • SHA256 2c7f63abe181fe9fea3c8a835f446ab158b3ca3b717932c661da68c3c2e561b7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES2DF1.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES2DF1.tmp
                                  • Size 1KB
                                  • SHA256 83e61c2e963c77c1775c5862efef15ebcdd045d2ef91390691d990f1addb0412
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES2F87.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES2F87.tmp
                                  • Size 1KB
                                  • SHA256 d60cf3176ad0a732acc5702dc8a64fbb5c7ea78a0bd8b84d988e3d84d57d1f51
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES4188.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES4188.tmp
                                  • Size 1KB
                                  • SHA256 95680af00b6ef510244bbb001a2f93900a6bc310a834bd35e06851e2d9f64d6e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES42A2.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES42A2.tmp
                                  • Size 1KB
                                  • SHA256 0a7ab71bfa80902d4d1e58ab426f2e513a8446c35ff31e7df8bfeb63ceaf27b8
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES44C4.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES44C4.tmp
                                  • Size 1KB
                                  • SHA256 e86676fd7b0813abb3cac338455319d6a9742068e3b3f6d511093c18cd3a9612
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  RES4551.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\RES4551.tmp
                                  • Size 1KB
                                  • SHA256 6042b0924ed3ae5c4e9d3d40c19164fcc639455451b61212410f0719b55c0d0c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  __PSScriptPolicyTest_th230nnb.qp5.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_th230nnb.qp5.ps1
                                  • Size 60B
                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  a_e83e2fa8.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.exe
                                  • Size 4KB
                                  • SHA256 cf6ba83d446c52e7cfd7d000b055d493a42791840cd39a9be50eba384864091a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  d_87561701.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\d_87561701.exe
                                  • Size 6KB
                                  • SHA256 f6ece80296421696f631dfcdc191a157fa809a5e08c00992e0c0a495fb568056
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  e_cb61d7b5.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.exe
                                  • Size 4KB
                                  • SHA256 b771d6f43987e35ea7e812aa359b2fc5d70b76953f4eba24b37f1f035f7e312f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  h_4479f405.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\h_4479f405.exe
                                  • Size 4KB
                                  • SHA256 f52c70dcc3f8314c2ff8993d725d95031199f683fb65bb5f5f0046a4f2b5bfb8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  i_92295617.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\i_92295617.exe
                                  • Size 5KB
                                  • SHA256 27d9358e2fe655bf4c3e0138756fd3273aff51117dcfe9a826a90fa177aaf326
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  loader_1780947487739.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\loader_1780947487739.ps1
                                  • Size 12KB
                                  • SHA256 444f9cc1e0b8269c900fa104207392e1510eac4285b1050dc13ed13b615fead4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  default.dic
                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                  • Size 2B
                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\DawnCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\DawnCache\data_1
                                  • Size 264KB
                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\DawnCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\DawnCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Local State
                                  • Size 389B
                                  • SHA256 9924c4bdfe2f29f17908b778761ddf4e1c404e57d7401a1f4e62bcfd8a30eb24
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Network\Network Persistent State
                                  • Size 300B
                                  • SHA256 a58c0055ca9a5ea8db35719aefbf230a34f8b6cd3f69722ba78127b746021e51
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Network Persistent State~RFe5978d0.TMP
                                  • Path C:\Users\Admin\AppData\Roaming\windows-update-assistant\Network\Network Persistent State~RFe5978d0.TMP
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  2x4t03ii.0.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\2x4t03ii\2x4t03ii.0.cs
                                  • Size 209B
                                  • SHA256 8e989516e25af008eb9ce2645276000b480890e55fa001a50f3eebbddfa23464
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  2x4t03ii.cmdline
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\2x4t03ii\2x4t03ii.cmdline
                                  • Size 369B
                                  • SHA256 a7392041a789a25ced00cc406250e08961b55bd8024c01fac6c4447848de436a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSCA97CB33645E14DE6BE3E5EF6D8B64218.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\2x4t03ii\CSCA97CB33645E14DE6BE3E5EF6D8B64218.TMP
                                  • Size 652B
                                  • SHA256 60a8debe0a73d644386c72fc6986b4ebf71d45b810665fc6142e2d6f95daea78
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSC840FB2B7B0EC481D8677BDF0B06745E9.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC840FB2B7B0EC481D8677BDF0B06745E9.TMP
                                  • Size 1KB
                                  • SHA256 68a897446e9f958bbb4d5a7508871bec2e6126de84bd1fc06ae0730724735c3a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSC8B40569159464C06964681AB963EB258.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8B40569159464C06964681AB963EB258.TMP
                                  • Size 1KB
                                  • SHA256 cdea7ce32cf5f443a922356672798b6cf531e3726ee73a16ed6fc2f827257a8b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSC930DABED18EA48E79265DE7BD82F8BE3.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC930DABED18EA48E79265DE7BD82F8BE3.TMP
                                  • Size 1KB
                                  • SHA256 49aab2a6466ff149369960272e230f0d62f2cae168393b6ba9caf60dac4b78db
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSCC581576A4B74437682A888C3EDCB2F54.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCC581576A4B74437682A888C3EDCB2F54.TMP
                                  • Size 1KB
                                  • SHA256 67b8e5a810574b80ff2ce2b8b13057279b29c5a383e152de578fa3f4a9a15164
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CSCE207FC66AA43475B90C7E2ECC69E95F1.TMP
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCE207FC66AA43475B90C7E2ECC69E95F1.TMP
                                  • Size 1KB
                                  • SHA256 98dc41882aedd3184d3798baaf848111931f8598e9f7ea8f903e9d0628e4ca36
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  a_e83e2fa8.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\a_e83e2fa8.cs
                                  • Size 1KB
                                  • SHA256 766f55f5f78835f2ca4642a0ab488f44d1e262c44f39a74890ed0b50e7c08e5a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  d_87561701.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\d_87561701.cs
                                  • Size 3KB
                                  • SHA256 2a4c4fcbe66d5c3aeb1693588fbfba54452bc03b3e6f2534844a11490a605a5e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  e_cb61d7b5.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\e_cb61d7b5.cs
                                  • Size 621B
                                  • SHA256 4ed760498fc7309777ba7902115992c97e40db653772356452d9421aa3df729e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  h_4479f405.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\h_4479f405.cs
                                  • Size 1KB
                                  • SHA256 399b918baef2139d6336d48ea1f01d0c1a420a4a90404d925cc4b515e5b011cd
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  i_92295617.cs
                                  • Path \??\c:\Users\Admin\AppData\Local\Temp\i_92295617.cs
                                  • Size 2KB
                                  • SHA256 f2416e38a238be537c73ee626e7210e65535941f9e48439a36e5a97421621571
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  memory/428-121-0x0000000000CC0000-0x0000000000CC8000-memory.dmp
                                  Download

                                  memory/1156-104-0x00000000001B0000-0x00000000001B8000-memory.dmp
                                  Download

                                  memory/1640-49-0x00000203FC760000-0x00000203FC78A000-memory.dmp
                                  Download

                                  memory/1640-50-0x00000203FC760000-0x00000203FC784000-memory.dmp
                                  Download

                                  memory/1640-46-0x00000203FC650000-0x00000203FC66C000-memory.dmp
                                  Download

                                  memory/1640-33-0x00000203FC4A0000-0x00000203FC4C2000-memory.dmp
                                  Download

                                  memory/1640-47-0x00000203FC670000-0x00000203FC723000-memory.dmp
                                  Download

                                  memory/1640-48-0x00000203FC640000-0x00000203FC64A000-memory.dmp
                                  Download

                                  memory/2204-16-0x0000000000250000-0x0000000000258000-memory.dmp
                                  Download

                                  memory/3124-29-0x0000000000530000-0x0000000000538000-memory.dmp
                                  Download

                                  memory/3732-133-0x00000276DC500000-0x00000276DC508000-memory.dmp
                                  Download

                                  memory/3984-228-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-229-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-230-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-234-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-237-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-240-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-239-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-238-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-235-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/3984-236-0x00000282FF1E0000-0x00000282FF1E1000-memory.dmp
                                  Download

                                  memory/4640-79-0x0000000000DB0000-0x0000000000DB8000-memory.dmp
                                  Download