Analysis
- max time kernel
159s - max time network
184s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 08:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe
- Size 7.1MB
- Sample260730-krdddafp4w
- SHA256 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec
- MD5 129010160c5a269b8ab379b6995c4af7
- SHA1 faa1180ac0b898ab811272b2f2b0b87ab02c7a19
- SHA512 cd661431b22e181a2b9e703097645ff9520eedc08799a9acd31b31e68df1b7e055b52391630056dfde27a0fa96d624fdc5e1668a82147ec6a7482e6d915b759e
- SSDEEP 98304:Qzknz/NQTrHcnTDB1bhEoJahjk7mcPwy7T:Q+LNHn/nbixhyYI
- TLSH T16B767D07EC6914E9D1AED13189769163BB717C881B2123D72B50F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4e3-93.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4108 powershell.exe 1164 powershell.exe 5920 powershell.exe 2196 powershell.exe 6080 powershell.exe 1376 powershell.exe 4500 powershell.exe 2916 powershell.exe 5456 powershell.exe 2100 powershell.exe 3808 powershell.exe 5936 powershell.exe 5112 powershell.exe 4436 powershell.exe 1736 powershell.exe 4200 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\QKARDrv.sys Dism.exe - Executes dropped EXE 1 IoCs
pid Process 4804 QKARDrv.sys - Loads dropped DLL 6 IoCs
pid Process 1372 MsiExec.exe 1372 MsiExec.exe 1372 MsiExec.exe 1372 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 15 5364 MsiExec.exe 17 5364 MsiExec.exe 18 5364 MsiExec.exe 19 5364 MsiExec.exe 20 5364 MsiExec.exe 21 5364 MsiExec.exe 22 5364 MsiExec.exe 23 5364 MsiExec.exe 24 5364 MsiExec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5364 set thread context of 408 5364 MsiExec.exe 121 - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2A7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2ABE.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3455.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5a1a7e.msi msiexec.exe File created C:\Windows\Installer\e5a1a7e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2859.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe File created C:\Windows\SystemTemp\~DF9309C19D5540E30C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFEF2ACDBED1BA0713.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI29D1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4407A7748CC1B26A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFAB7AC244434572AB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2F53.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 4500 powershell.exe 4500 powershell.exe 2100 powershell.exe 2100 powershell.exe 5920 powershell.exe 5920 powershell.exe 3808 powershell.exe 1736 powershell.exe 3808 powershell.exe 1736 powershell.exe 4500 powershell.exe 2196 powershell.exe 2196 powershell.exe 1736 powershell.exe 3808 powershell.exe 5920 powershell.exe 2100 powershell.exe 2196 powershell.exe 3208 msiexec.exe 3208 msiexec.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe 4108 powershell.exe 4108 powershell.exe 4200 powershell.exe 4200 powershell.exe 1164 powershell.exe 1164 powershell.exe 5936 powershell.exe 5936 powershell.exe 4108 powershell.exe 5112 powershell.exe 5112 powershell.exe 5936 powershell.exe 4200 powershell.exe 1164 powershell.exe 5112 powershell.exe 6080 powershell.exe 6080 powershell.exe 2916 powershell.exe 2916 powershell.exe 6080 powershell.exe 1376 powershell.exe 1376 powershell.exe 5456 powershell.exe 5456 powershell.exe 2916 powershell.exe 1376 powershell.exe 4436 powershell.exe 4436 powershell.exe 5456 powershell.exe 4436 powershell.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe 5364 MsiExec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 808 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 5920 powershell.exe Token: SeDebugPrivilege 1736 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 2196 powershell.exe Token: SeIncreaseQuotaPrivilege 3808 powershell.exe Token: SeSecurityPrivilege 3808 powershell.exe Token: SeTakeOwnershipPrivilege 3808 powershell.exe Token: SeLoadDriverPrivilege 3808 powershell.exe Token: SeSystemProfilePrivilege 3808 powershell.exe Token: SeSystemtimePrivilege 3808 powershell.exe Token: SeProfSingleProcessPrivilege 3808 powershell.exe Token: SeIncBasePriorityPrivilege 3808 powershell.exe Token: SeCreatePagefilePrivilege 3808 powershell.exe Token: SeBackupPrivilege 3808 powershell.exe Token: SeRestorePrivilege 3808 powershell.exe Token: SeShutdownPrivilege 3808 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeSystemEnvironmentPrivilege 3808 powershell.exe Token: SeRemoteShutdownPrivilege 3808 powershell.exe Token: SeUndockPrivilege 3808 powershell.exe Token: SeManageVolumePrivilege 3808 powershell.exe Token: 33 3808 powershell.exe Token: 34 3808 powershell.exe Token: 35 3808 powershell.exe Token: 36 3808 powershell.exe Token: SeIncreaseQuotaPrivilege 1736 powershell.exe Token: SeSecurityPrivilege 1736 powershell.exe Token: SeTakeOwnershipPrivilege 1736 powershell.exe Token: SeLoadDriverPrivilege 1736 powershell.exe Token: SeSystemProfilePrivilege 1736 powershell.exe Token: SeSystemtimePrivilege 1736 powershell.exe Token: SeProfSingleProcessPrivilege 1736 powershell.exe Token: SeIncBasePriorityPrivilege 1736 powershell.exe Token: SeCreatePagefilePrivilege 1736 powershell.exe Token: SeBackupPrivilege 1736 powershell.exe Token: SeRestorePrivilege 1736 powershell.exe Token: SeShutdownPrivilege 1736 powershell.exe Token: SeDebugPrivilege 1736 powershell.exe Token: SeSystemEnvironmentPrivilege 1736 powershell.exe Token: SeRemoteShutdownPrivilege 1736 powershell.exe Token: SeUndockPrivilege 1736 powershell.exe Token: SeManageVolumePrivilege 1736 powershell.exe Token: 33 1736 powershell.exe Token: 34 1736 powershell.exe Token: 35 1736 powershell.exe Token: 36 1736 powershell.exe Token: SeIncreaseQuotaPrivilege 4500 powershell.exe Token: SeSecurityPrivilege 4500 powershell.exe Token: SeTakeOwnershipPrivilege 4500 powershell.exe Token: SeLoadDriverPrivilege 4500 powershell.exe Token: SeSystemProfilePrivilege 4500 powershell.exe Token: SeSystemtimePrivilege 4500 powershell.exe Token: SeProfSingleProcessPrivilege 4500 powershell.exe Token: SeIncBasePriorityPrivilege 4500 powershell.exe Token: SeCreatePagefilePrivilege 4500 powershell.exe Token: SeBackupPrivilege 4500 powershell.exe Token: SeRestorePrivilege 4500 powershell.exe Token: SeShutdownPrivilege 4500 powershell.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeSystemEnvironmentPrivilege 4500 powershell.exe Token: SeRemoteShutdownPrivilege 4500 powershell.exe Token: SeUndockPrivilege 4500 powershell.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3208 msiexec.exe 1372 MsiExec.exe 5364 MsiExec.exe 408 Dism.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2100 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 90 PID 3464 wrote to memory of 5920 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 92 PID 3464 wrote to memory of 3808 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 93 PID 3464 wrote to memory of 4500 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 96 PID 3464 wrote to memory of 1736 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 97 PID 3464 wrote to memory of 2196 3464 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe 98 PID 3208 wrote to memory of 1372 3208 msiexec.exe 104 PID 3208 wrote to memory of 5364 3208 msiexec.exe 105 PID 5364 wrote to memory of 4200 5364 MsiExec.exe 106 PID 5364 wrote to memory of 4108 5364 MsiExec.exe 108 PID 5364 wrote to memory of 1164 5364 MsiExec.exe 110 PID 5364 wrote to memory of 5936 5364 MsiExec.exe 112 PID 5364 wrote to memory of 5112 5364 MsiExec.exe 114 PID 4108 wrote to memory of 6080 4108 powershell.exe 116 PID 5936 wrote to memory of 2916 5936 powershell.exe 117 PID 4200 wrote to memory of 1376 4200 powershell.exe 118 PID 1164 wrote to memory of 5456 1164 powershell.exe 119 PID 5112 wrote to memory of 4436 5112 powershell.exe 120 PID 5364 wrote to memory of 408 5364 MsiExec.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe"C:\Users\Admin\AppData\Local\Temp\f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E1D399F1D61A2F5BAE2CC8F054A50972⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9D9ED45E29912E57BDC537C4BBDE48D72⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1376
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6080
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5456
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:408
-
-
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵
- Executes dropped EXE
PID:4804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a1a81.rbs
- Size 3KB
- SHA256 2374bcb1fa22316b222fa336559739adeeb0ed0cd2656d5b79db51536f69db0e
- MD5 e863343925697b32afdff8cdf7404aa6
- SHA1 51f0ec31b6be340ca8b6539c6d8110e05107727d
- SHA512 340e1bf1b59604daf165a6e387a32b2142ea0989411470406fa1f5e064d6e3fae721c2b591d90c78d775a26ddf6715e1daa5fd4e94cd9ddbb4121ea424c2d931
- TLSH T1E261B27486D3C2CCD491E8F087E2A0BC9FD89D6A6E66F468DE0F4D6D6963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 dd34e374f9833c7f2094b6e4ba5738b43eb997205a1f6e32fd611243f70b0526
- MD5 f45f293959cae35dd0a1eac3a1e6a8b6
- SHA1 0140e45a1840106951eab7b3e9ea987aab4d2d2d
- SHA512 a0492b61bcb2d0c7ae6ad4e70f394746fddfc185702db1b06b2bb2dad175f58a7ca28203a2843b96fc62d0267b669ee0e3df9dc002edde5a920007bd902897c5
- TLSH T10C216837B3DD8614C89E413A10CEAD1036B6CBDB40DECE5B7B84E655A43F699CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9a3fdfbf3246d78ebf22f628637e235934912c5d65dfdd6f5a0d4e3bc73a6a5d
- MD5 08fe4068f6a9ad5d829495fdd2f57205
- SHA1 e1f784c2ccd46a68a29e3cfd5e9aefc3fb396df7
- SHA512 e46f72187cbe9be00157e63be5a99cd4fad15c811f341df0563c451c420cdd012fb40a2b1ca6356f0ce82a301a010a9280cb318b94781506375530dfd3c57a6d
- TLSH T15D219833B3CC8614C89A013A10CEAC0036B6CBCB40DECE5B7B80E655A43F698CE60060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0645dc88ca0ba201e28d72e68cbfcfabcf5bd1983c3858174fe2f4ba6250d807
- MD5 b507d9ba89a24ab61c40bf8476ce329a
- SHA1 960afd70581eb07d8a34ace0a6180c279e375e0e
- SHA512 fc893e56b1aa3984a5b03b3bf82821ba92f03a9a486619cf0aa479d018dc54c69b9e8d43aca6646ee1fda8299f916bdbdbfabe268b6266768f8c777211085654
- TLSH T11D216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 f8075b7e8bcf8c19d040597531ba07f4c588fd6b561b22a5bd95954aad28a7cb
- MD5 530604c32993a23c23f8251b132d4cdb
- SHA1 f3a27f8e956e355ff23c4e123aca46b6286b9349
- SHA512 35790fccca0d439c4a0a2546c74fadb5b26e0ef9fe7c49ae90c7facfa4477caed72bf66a967c5b3348684313ba618d200993dd3590aadef1a35d4f8f187b003b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 73dc023915d7160cc171e058f34942f626636247c8101666058bec17d7028b55
- MD5 4de456ea7d31a4be8d5b6c26e0edc2a4
- SHA1 fbbd86869b085b47dc151094b234856e9ab77609
- SHA512 368c866a82e1ca89f29d41a6fe6a23efa6a99c348b2265a96f1a9afb10a7cd29aad7992ba8bff1ccafc523319e67a259d1ee0d1adfe6b4f7593b8381c68e3ec4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 6a79530cbc17f836ff081c26eb7be4b77b4347adc952ab345193e901d0f89383
- MD5 506d15f6f3a6d2658622ed0659d8a643
- SHA1 5cddd278b14d58e3ae50d4db73cc6597d56a1d8a
- SHA512 5e432db9de2aaf7dc12b818505bdec7e4dc8bc14a42e429f00582d6e6c24cf271743cc46886fd8519d4f629fa30d01e9545c55a86eee24b50bd21bdadf21bb51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1f96efcec9fa31e3ace21796d899d94c4b3469eadedcc5017decdcc6aa34196c
- MD5 35378e6d3b3ba0d7cbec4aed89f4b716
- SHA1 77e6f54d19640651dfb4a079b2ed8afbb7563270
- SHA512 0a91d12b5fe1faa75e1ed613b5eab275e4ac3cb9017cea08c4f8d4f9c432442bec7883459da2c2095b7c6f1b143bc7063b61797f93ff81d60a57045244a51241
- TLSH T12B216833B3DD8624CC9A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
- MD5 66f9b690d4e5313231bc173ce7b2c029
- SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
- SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
- TLSH T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5yzlzxa.dcp.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 402KB
- SHA256 32152dca66b2bbc820a7ad6f92a2dbacde690f35ac01ba134f83cb00fec9dc3a
- MD5 031422a95fc10e5cd6483a7c6c9b3aec
- SHA1 45552601ddbc2aab77dcbe3b3537fffdf0fe2efd
- SHA512 ed4213b291282d4fd8eb0ceb8b01935ecbe4ca7fb2205cc769185726f1460877cf25e509de4adae3f2f5c7d7b16eea8f1079cb78b5f8ca0c67c113f55332e655
- SSDEEP 6144:1Yl3Dhe4nIMpUwCo+660ybbLjtA1uVwYqWyvAWHDELXAfE1beQgnJrsX3IsOugXR:1wE4xpUwCoFyjVC5A0EcsZexsH1Ji/F
- TLSH T1A49423DA58B0F4D34AB2B099FD457FBBEBD5342F49B1731A20B30B9A4DB24647A18134
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 464KB
- SHA256 6a0a8df1ab1f4fbefe0959b7ef2a1adac61b401992c9959cee2a0f8c42b51ca6
- MD5 791ca7ad050f6cacad253902b2f4662f
- SHA1 54ab0f7b357c79e84aaedac8b2a6cbafc1ad73ce
- SHA512 0d57bd6f031bc1adc624d96fc44bcfed4771a5630abf9620c4b22370fbc754a9d560c18153386fae4ef862d01c6cb6128178122a865570ad79f41409032f5fae
- SSDEEP 12288:ai0ThSjctHtf9eo79RIj/xHeKOiVQIo08+tv+ic:a3Vtf9RoheKOm8ATc
- TLSH T1B1A4BCDC920076442EA5BEFC7F8AD7A20547373A4A8DA647C0179791CAB1CC64F07ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2859.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3455.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 44KB
- SHA256 67fa1b21947b9e89022794afd7ada8fec6615a2de4b6ac4994b45f3d12fd5573
- MD5 b3d2ee44b1906db25ea572cb1d6dbc91
- SHA1 2d2ced069894f8ef114256aa746a1350da9b0e29
- SHA512 ceedcebc67b28c74e04ea2b5cc8fd266c1bb553ee99b54509731d9306db617824a7b9b85b891beb552265da385e39ae66411e586f53e8e3485a9a0e4e84871c8
- SSDEEP 768:UmO1aQiveP0LKn3RS3/QwBoLI21YpdpTxOLk5Q:BO1aQiveMLKn3RS3/QSdc
- TLSH T1F8136C4360C427B4EA22847581C2DC1AE0B578D557B389CF4695F861AAE7BF0EF369C3
- MD5 SHA1 SHA512 SSDEEP TLSH