Analysis
- max time kernel
124s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe
- Size 7.3MB
- Sample260731-e9fnkacg38
- SHA256 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a
- MD5 7c59fce8b6d4eb4b59ee99b46e9d3097
- SHA1 a583a8964163593ef553aa7c06258214ffc1933f
- SHA512 fd9eb0a57a6a23be9858268a281b40bf7f2b5bf68860551b99824681500176414ad744276896b7be65718207ecfbeca93731a38e82abdc0b2b1098e474285697
- SSDEEP 49152:Jztahl+MkOHojEZrwSbXpQM/5kD/ARj288RFg94XOlKbMWkkwCPKQK1K6D3x1g5O:Jzknz/NQTrHcnTDB1SEobYrECw7lcAwh
- TLSH T184768D47EC6954E9D1AED13089769163BB317C881B2123D72B50F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c531-96.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 236 powershell.exe 1512 powershell.exe 5496 powershell.exe 2416 powershell.exe 3340 powershell.exe 5800 powershell.exe 2928 powershell.exe 4656 powershell.exe 5984 powershell.exe 4760 powershell.exe 2028 powershell.exe 5448 powershell.exe 4080 powershell.exe 5312 powershell.exe 3620 powershell.exe 1528 powershell.exe - Loads dropped DLL 6 IoCs
pid Process 6044 MsiExec.exe 6044 MsiExec.exe 6044 MsiExec.exe 6044 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe - Badlisted process makes network request 14 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 9 2584 MsiExec.exe 10 2584 MsiExec.exe 14 2584 MsiExec.exe 15 2584 MsiExec.exe 17 2584 MsiExec.exe 18 2584 MsiExec.exe 19 2584 MsiExec.exe 20 2584 MsiExec.exe 21 2584 MsiExec.exe 22 2584 MsiExec.exe 23 2584 MsiExec.exe 24 2584 MsiExec.exe 26 2584 MsiExec.exe 27 2584 MsiExec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2584 set thread context of 1948 2584 MsiExec.exe 121 - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7AD3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7C6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7CAB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e596e31.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7BFD.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF55FE5501096E6D85.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8410.tmp msiexec.exe File opened for modification C:\Windows\Installer\e596e31.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8008.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7051FA9DBD433DD5.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe File created C:\Windows\SystemTemp\~DF513E32A252EF107F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF1A90D0BAC2F93DA4.TMP msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe Set value (data) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 3340 powershell.exe 3340 powershell.exe 5312 powershell.exe 5312 powershell.exe 236 powershell.exe 236 powershell.exe 5800 powershell.exe 5800 powershell.exe 4080 powershell.exe 4080 powershell.exe 1512 powershell.exe 1512 powershell.exe 236 powershell.exe 4080 powershell.exe 1512 powershell.exe 3340 powershell.exe 5800 powershell.exe 5312 powershell.exe 5356 msiexec.exe 5356 msiexec.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe 4760 powershell.exe 4760 powershell.exe 2928 powershell.exe 2928 powershell.exe 2028 powershell.exe 2028 powershell.exe 4760 powershell.exe 4656 powershell.exe 4656 powershell.exe 2028 powershell.exe 4656 powershell.exe 5448 powershell.exe 5448 powershell.exe 2928 powershell.exe 5448 powershell.exe 3620 powershell.exe 3620 powershell.exe 3620 powershell.exe 5496 powershell.exe 5496 powershell.exe 5984 powershell.exe 5984 powershell.exe 5496 powershell.exe 1528 powershell.exe 1528 powershell.exe 2416 powershell.exe 2416 powershell.exe 1528 powershell.exe 2416 powershell.exe 5984 powershell.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe 2584 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3340 powershell.exe Token: SeDebugPrivilege 5312 powershell.exe Token: SeDebugPrivilege 4080 powershell.exe Token: SeDebugPrivilege 236 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 5800 powershell.exe Token: SeIncreaseQuotaPrivilege 4080 powershell.exe Token: SeSecurityPrivilege 4080 powershell.exe Token: SeTakeOwnershipPrivilege 4080 powershell.exe Token: SeLoadDriverPrivilege 4080 powershell.exe Token: SeSystemProfilePrivilege 4080 powershell.exe Token: SeSystemtimePrivilege 4080 powershell.exe Token: SeProfSingleProcessPrivilege 4080 powershell.exe Token: SeIncBasePriorityPrivilege 4080 powershell.exe Token: SeCreatePagefilePrivilege 4080 powershell.exe Token: SeBackupPrivilege 4080 powershell.exe Token: SeRestorePrivilege 4080 powershell.exe Token: SeShutdownPrivilege 4080 powershell.exe Token: SeDebugPrivilege 4080 powershell.exe Token: SeSystemEnvironmentPrivilege 4080 powershell.exe Token: SeRemoteShutdownPrivilege 4080 powershell.exe Token: SeUndockPrivilege 4080 powershell.exe Token: SeManageVolumePrivilege 4080 powershell.exe Token: 33 4080 powershell.exe Token: 34 4080 powershell.exe Token: 35 4080 powershell.exe Token: 36 4080 powershell.exe Token: SeIncreaseQuotaPrivilege 236 powershell.exe Token: SeSecurityPrivilege 236 powershell.exe Token: SeTakeOwnershipPrivilege 236 powershell.exe Token: SeLoadDriverPrivilege 236 powershell.exe Token: SeSystemProfilePrivilege 236 powershell.exe Token: SeSystemtimePrivilege 236 powershell.exe Token: SeProfSingleProcessPrivilege 236 powershell.exe Token: SeIncBasePriorityPrivilege 236 powershell.exe Token: SeCreatePagefilePrivilege 236 powershell.exe Token: SeBackupPrivilege 236 powershell.exe Token: SeRestorePrivilege 236 powershell.exe Token: SeShutdownPrivilege 236 powershell.exe Token: SeDebugPrivilege 236 powershell.exe Token: SeSystemEnvironmentPrivilege 236 powershell.exe Token: SeRemoteShutdownPrivilege 236 powershell.exe Token: SeUndockPrivilege 236 powershell.exe Token: SeManageVolumePrivilege 236 powershell.exe Token: 33 236 powershell.exe Token: 34 236 powershell.exe Token: 35 236 powershell.exe Token: 36 236 powershell.exe Token: SeIncreaseQuotaPrivilege 1512 powershell.exe Token: SeSecurityPrivilege 1512 powershell.exe Token: SeTakeOwnershipPrivilege 1512 powershell.exe Token: SeLoadDriverPrivilege 1512 powershell.exe Token: SeSystemProfilePrivilege 1512 powershell.exe Token: SeSystemtimePrivilege 1512 powershell.exe Token: SeProfSingleProcessPrivilege 1512 powershell.exe Token: SeIncBasePriorityPrivilege 1512 powershell.exe Token: SeCreatePagefilePrivilege 1512 powershell.exe Token: SeBackupPrivilege 1512 powershell.exe Token: SeRestorePrivilege 1512 powershell.exe Token: SeShutdownPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeSystemEnvironmentPrivilege 1512 powershell.exe Token: SeRemoteShutdownPrivilege 1512 powershell.exe Token: SeUndockPrivilege 1512 powershell.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5356 msiexec.exe 6044 MsiExec.exe 2584 MsiExec.exe 1948 Dism.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 120 wrote to memory of 236 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 89 PID 120 wrote to memory of 5800 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 90 PID 120 wrote to memory of 4080 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 91 PID 120 wrote to memory of 3340 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 92 PID 120 wrote to memory of 1512 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 96 PID 120 wrote to memory of 5312 120 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe 97 PID 5356 wrote to memory of 6044 5356 msiexec.exe 103 PID 5356 wrote to memory of 2584 5356 msiexec.exe 104 PID 2584 wrote to memory of 4760 2584 MsiExec.exe 105 PID 2584 wrote to memory of 2928 2584 MsiExec.exe 107 PID 2584 wrote to memory of 2028 2584 MsiExec.exe 109 PID 2584 wrote to memory of 4656 2584 MsiExec.exe 111 PID 2584 wrote to memory of 5448 2584 MsiExec.exe 113 PID 4760 wrote to memory of 3620 4760 powershell.exe 115 PID 2028 wrote to memory of 5984 2028 powershell.exe 116 PID 4656 wrote to memory of 5496 4656 powershell.exe 117 PID 2928 wrote to memory of 1528 2928 powershell.exe 118 PID 5448 wrote to memory of 2416 5448 powershell.exe 119 PID 2584 wrote to memory of 1948 2584 MsiExec.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe"C:\Users\Admin\AppData\Local\Temp\0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 63A7F4018C88BF38E7B502E9CFBA63D82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6044
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 141F41BC783EC5847A9CC416828906EB2⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3620
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1528
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5984
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5496
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵PID:4588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e596e34.rbs
- Size 3KB
- SHA256 7cd0e648541f18a4b10bfdfcf9c41af2f008dbcecc39887686eafbc907c56014
- MD5 1b0436b6d80b80a06bc918f4c25073d2
- SHA1 12ce6053ebde56904c4c475ee437c897c30f335f
- SHA512 453c28440c1455a10d303f897320891bc27e3d5a67b92394badc127014c67f27e423de7fd0bc06882b4b3b1a7115ec6d7855479a14c78964447b83bd60554280
- TLSH T15561A17586D3C2CCD491E8F087E2A0BC9FD89D6A6E66E468DE0F4D6D6963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7554798c747c4d7272da555d1b3fdfa362c64e2f2aec0adc4a7f75a09f26a940
- MD5 4e0a3a7e67c50a2f5bce6976f4f83e4e
- SHA1 516db2e7de7b34d174aee9c9f448ab5b697b80c7
- SHA512 cd39805bf93cc1e3f523d1a7c956b656f1310ac3758513bff7560a693745db35a7a19f0bdbdd4a6199b46b31ec806c4c2a227e9639b2625389d6e8657fa1939c
- TLSH T140216837F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 f93e67a731482f65b99d642eb1c1d3ca7b2d86d9ce0007a208c227d48b52dde9
- MD5 54c1697f60222ccff72d07b08d913a0e
- SHA1 9cc56c0c619efa27fcae017c47e012c0bc7df70e
- SHA512 68bf33b45cea52d0d07502671ad5dab4d16b0edc1545a8d63b4401953f6148ba470c0eb33d1989b7daebcade0ed301f36437f1d5c96de6a72287454760d8913d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 05a3138d9f2e0a01d89abfd90e281dc68c59b37f3240c9b376819dde06600d1c
- MD5 22c5905f4afad44fdf583d80d32813f9
- SHA1 2746963e649ab54757b4c96264a9113820b2a418
- SHA512 e3bac9e825bc6668aa4ab6858d1ebbad43f8f85025c79529acf7db31ddb8cbe7c47bec8b818e75efaf156e4872aa5737c6b42d97a4df42ddb826a5c7603b4f1f
- TLSH T14E219833B3CC8624CC9A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f09567c4b25bf735fb567d2f025c467a20730ae25a865169db22787f804ffea2
- MD5 b2e726093adf26f53764f41b5be3b439
- SHA1 523245fa01d950947fdab08fc225073f7d9becda
- SHA512 dcb78eec580dc0beb6874282f453af759a4974737b83505d9256974b3b575f1a11c318488c58adbb4f5a9d5df6ea8819e41f99c580a3a5fb4e77f2c6a59466b8
- TLSH T14A216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 1b83c6126a940302a5d6bd5d71a3a45e1a7b4a5aab5561d26921c49c536c1551
- MD5 ffa7c79cdb7292d688a1114e193da205
- SHA1 732d86c2c2b429be99984a7803194994d4698711
- SHA512 74af6b47c738179bc37b33d1f6a4706b421e653981b61a5d3a0dd52d9023e74f3da5c83e1adf6c90aaf3734f48648bd4982b6fd853a8aba335a22619d07b10ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 73dc023915d7160cc171e058f34942f626636247c8101666058bec17d7028b55
- MD5 4de456ea7d31a4be8d5b6c26e0edc2a4
- SHA1 fbbd86869b085b47dc151094b234856e9ab77609
- SHA512 368c866a82e1ca89f29d41a6fe6a23efa6a99c348b2265a96f1a9afb10a7cd29aad7992ba8bff1ccafc523319e67a259d1ee0d1adfe6b4f7593b8381c68e3ec4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 6d81eff48bbc7da5ca448b7424723ebce9d25de5b9a3b3943b025712fc17cc20
- MD5 ee6653bef9f5e18871c86285978b9a48
- SHA1 8186776bdff548b419269290c42f42a35b35eea1
- SHA512 20047b725532caf9a9b93dc2a551035fad3dbbf009e0f24ab6bf2cf6b8e3166df2c19b5383e8e1b1fb0603dc6d079cb519e519d7d98b6b23155e01192815cbab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
- MD5 78b9021e0576c01ec958b87ec52832c1
- SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
- SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
- TLSH T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0kgmtgdm.wey.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 402KB
- SHA256 32152dca66b2bbc820a7ad6f92a2dbacde690f35ac01ba134f83cb00fec9dc3a
- MD5 031422a95fc10e5cd6483a7c6c9b3aec
- SHA1 45552601ddbc2aab77dcbe3b3537fffdf0fe2efd
- SHA512 ed4213b291282d4fd8eb0ceb8b01935ecbe4ca7fb2205cc769185726f1460877cf25e509de4adae3f2f5c7d7b16eea8f1079cb78b5f8ca0c67c113f55332e655
- SSDEEP 6144:1Yl3Dhe4nIMpUwCo+660ybbLjtA1uVwYqWyvAWHDELXAfE1beQgnJrsX3IsOugXR:1wE4xpUwCoFyjVC5A0EcsZexsH1Ji/F
- TLSH T1A49423DA58B0F4D34AB2B099FD457FBBEBD5342F49B1731A20B30B9A4DB24647A18134
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 464KB
- SHA256 6a0a8df1ab1f4fbefe0959b7ef2a1adac61b401992c9959cee2a0f8c42b51ca6
- MD5 791ca7ad050f6cacad253902b2f4662f
- SHA1 54ab0f7b357c79e84aaedac8b2a6cbafc1ad73ce
- SHA512 0d57bd6f031bc1adc624d96fc44bcfed4771a5630abf9620c4b22370fbc754a9d560c18153386fae4ef862d01c6cb6128178122a865570ad79f41409032f5fae
- SSDEEP 12288:ai0ThSjctHtf9eo79RIj/xHeKOiVQIo08+tv+ic:a3Vtf9RoheKOm8ATc
- TLSH T1B1A4BCDC920076442EA5BEFC7F8AD7A20547373A4A8DA647C0179791CAB1CC64F07ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7AD3.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8410.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 44KB
- SHA256 67fa1b21947b9e89022794afd7ada8fec6615a2de4b6ac4994b45f3d12fd5573
- MD5 b3d2ee44b1906db25ea572cb1d6dbc91
- SHA1 2d2ced069894f8ef114256aa746a1350da9b0e29
- SHA512 ceedcebc67b28c74e04ea2b5cc8fd266c1bb553ee99b54509731d9306db617824a7b9b85b891beb552265da385e39ae66411e586f53e8e3485a9a0e4e84871c8
- SSDEEP 768:UmO1aQiveP0LKn3RS3/QwBoLI21YpdpTxOLk5Q:BO1aQiveMLKn3RS3/QSdc
- TLSH T1F8136C4360C427B4EA22847581C2DC1AE0B578D557B389CF4695F861AAE7BF0EF369C3
- MD5 SHA1 SHA512 SSDEEP TLSH