cerber | 366d6b53483ae1e50213de26593f7f8fd6830cba86f14490d27145658949784b

Analysis

user interaction
yes
max time kernel
24s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
free_perm/spoof.bat
Size 5KB
Sample260802-pg6z6aam41
SHA256 366d6b53483ae1e50213de26593f7f8fd6830cba86f14490d27145658949784b
MD5 d2cddd2fc3930ad76f579492b12e4d86
SHA1 36689cb37ea190f058338a3c10eb47f418fb7ac3
SHA512 80efed14e31642b6cda408eadd4a36e89a14bace48858606db530712a045f3060fc9978f7c494e19a01c26a8cab90b907111c25e4d1ba87bb6fee4f20d6b37aa
SSDEEP 96:Lja84PhZT9kKkC6sMGfSjoMIOz1RkPSNqoiAdIPhHKbmKPjaTLZ4JZczqGq6G+Bq:LvahZT97L6sMGa0MII1RQSjxcRKRPcLm
TLSH
T15DC19226BF8B8C28C5952599E56B9067FB56320B1AB2FBF037C66048E20340C57F8CDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution cerber persistence ransomware

Malware Config

Signatures

Family: Cerber 7 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
		4376	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe

Drops file in Drivers directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\Sawaf_1.exe	cmd.exe
File created	C:\Windows\System32\drivers\sawafio64.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\z.exe	cmd.exe
File created	C:\Windows\System32\drivers\winxsrcsv64.sys	cmd.exe
File created	C:\Windows\System32\drivers\winxsrcsv64.exe	cmd.exe
File created	C:\Windows\System32\drivers\sawaf.exe	cmd.exe
File created	C:\Windows\System32\drivers\SawafV1X64_1.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\9d7513b0a44f.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.exe	cmd.exe
File created	C:\Windows\System32\drivers\rtkiow10x64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rtkiow10x64.sys	cmd.exe
File created	C:\Windows\System32\drivers\sawaf64e.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf64e.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SawafV1X64_1.sys	cmd.exe
File created	C:\Windows\System32\drivers\z.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf.exe	cmd.exe
File created	C:\Windows\System32\drivers\Sawaf_1.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawafio64.dll	cmd.exe
File created	C:\Windows\System32\drivers\spoofer_svc.txt	cmd.exe
File created	C:\Windows\System32\drivers\9d7513b0a44f.sys	cmd.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
420	winxsrcsv64.exe
3980	winxsrcsv64.exe
56	winxsrcsv64.exe
1756	winxsrcsv64.exe
1956	winxsrcsv64.exe
3888	winxsrcsv64.exe
4548	winxsrcsv64.sys

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1224	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1228	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
476	sc.exe
2568	sc.exe
4580	sc.exe
5940	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4116	powershell.exe
5772	powershell.exe
5564	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4872	cmd.exe
4488	cmd.exe
5484	cmd.exe
3444	cmd.exe
3464	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4376	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4116	powershell.exe
4116	powershell.exe
5772	powershell.exe
5772	powershell.exe
1228	powershell.exe
1228	powershell.exe
5564	powershell.exe
5564	powershell.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1228	powershell.exe
Token: SeSecurityPrivilege	1228	powershell.exe
Token: SeTakeOwnershipPrivilege	1228	powershell.exe
Token: SeLoadDriverPrivilege	1228	powershell.exe
Token: SeSystemProfilePrivilege	1228	powershell.exe
Token: SeSystemtimePrivilege	1228	powershell.exe
Token: SeProfSingleProcessPrivilege	1228	powershell.exe
Token: SeIncBasePriorityPrivilege	1228	powershell.exe
Token: SeCreatePagefilePrivilege	1228	powershell.exe
Token: SeBackupPrivilege	1228	powershell.exe
Token: SeRestorePrivilege	1228	powershell.exe
Token: SeShutdownPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeSystemEnvironmentPrivilege	1228	powershell.exe
Token: SeRemoteShutdownPrivilege	1228	powershell.exe
Token: SeUndockPrivilege	1228	powershell.exe
Token: SeManageVolumePrivilege	1228	powershell.exe
Token: 33	1228	powershell.exe
Token: 34	1228	powershell.exe
Token: 35	1228	powershell.exe
Token: 36	1228	powershell.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeShutdownPrivilege	1224	powercfg.exe
Token: SeCreatePagefilePrivilege	1224	powercfg.exe
Token: SeShutdownPrivilege	1224	powercfg.exe
Token: SeCreatePagefilePrivilege	1224	powercfg.exe
Token: SeShutdownPrivilege	3596	shutdown.exe
Token: SeRemoteShutdownPrivilege	3596	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3900	LogonUI.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3240	4872	cmd.exe	90
PID 3240 wrote to memory of 1496	3240	net.exe	91
PID 4872 wrote to memory of 4488	4872	cmd.exe	92
PID 4488 wrote to memory of 4116	4488	cmd.exe	93
PID 4872 wrote to memory of 5736	4872	cmd.exe	94
PID 4872 wrote to memory of 1520	4872	cmd.exe	95
PID 4872 wrote to memory of 696	4872	cmd.exe	96
PID 4872 wrote to memory of 2544	4872	cmd.exe	97
PID 4872 wrote to memory of 2568	4872	cmd.exe	98
PID 4872 wrote to memory of 6084	4872	cmd.exe	99
PID 4872 wrote to memory of 4580	4872	cmd.exe	100
PID 4872 wrote to memory of 5940	4872	cmd.exe	101
PID 4872 wrote to memory of 476	4872	cmd.exe	102
PID 4872 wrote to memory of 4376	4872	cmd.exe	103
PID 4872 wrote to memory of 5484	4872	cmd.exe	105
PID 5484 wrote to memory of 5772	5484	cmd.exe	106
PID 4872 wrote to memory of 420	4872	cmd.exe	107
PID 4872 wrote to memory of 3980	4872	cmd.exe	108
PID 4872 wrote to memory of 56	4872	cmd.exe	109
PID 4872 wrote to memory of 1756	4872	cmd.exe	110
PID 4872 wrote to memory of 1956	4872	cmd.exe	111
PID 4872 wrote to memory of 3888	4872	cmd.exe	112
PID 4872 wrote to memory of 3444	4872	cmd.exe	113
PID 3444 wrote to memory of 1228	3444	cmd.exe	114
PID 4872 wrote to memory of 2656	4872	cmd.exe	118
PID 4872 wrote to memory of 2636	4872	cmd.exe	119
PID 4872 wrote to memory of 5564	4872	cmd.exe	120
PID 5564 wrote to memory of 3464	5564	powershell.exe	121
PID 3464 wrote to memory of 6116	3464	cmd.exe	122
PID 4872 wrote to memory of 5292	4872	cmd.exe	123
PID 4872 wrote to memory of 2876	4872	cmd.exe	124
PID 4872 wrote to memory of 1224	4872	cmd.exe	125
PID 4872 wrote to memory of 2596	4872	cmd.exe	126
PID 4872 wrote to memory of 3596	4872	cmd.exe	127

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\free_perm\spoof.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Spoofer" /v ServiceName /t REG_SZ /d 9d7513b0a44f /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Valid /t REG_DWORD /d 0 /f
  2⤵
  PID:1520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Efi /t REG_DWORD /d 0 /f
  2⤵
  PID:696
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Load /t REG_DWORD /d 0 /f
  2⤵
  PID:2544
- C:\Windows\system32\sc.exe
  sc create 9d7513b0a44f type= kernel start= boot error= normal group= "System Bus Extender" binpath= "C:\Windows\System32\drivers\9d7513b0a44f.sys"
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\9d7513b0a44f" /v Tag /t REG_DWORD /d 1 /f
  2⤵
  PID:6084
- C:\Windows\system32\sc.exe
  sc query winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:4580
- C:\Windows\system32\sc.exe
  sc create winxsrcsv64 type= kernel start= demand error= normal binpath= "\SystemRoot\System32\drivers\winxsrcsv64.sys"
  2⤵
  - Launches sc.exe
  PID:5940
- C:\Windows\system32\sc.exe
  sc start winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM WmiPrvSE.exe
  2⤵
  - Family: Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /OS 8
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:420
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /SF "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:3980
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PAT "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:56
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PPN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1756
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PSN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1956
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /BT "Default string"
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Unknown "
  2⤵
  PID:2656
- C:\Windows\system32\findstr.exe
  findstr /I /C:"Hewlett-Packard" /C:"HP"
  2⤵
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$c='0123456789ABCDEF';$g={-join (1..5|ForEach-Object{$c[(Get-Random -Maximum 16)]})};$v=(& $g)+'-'+(& $g)+'-'+(& $g)+'-00AEM';cmd /c reg add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v ProductId /t REG_SZ /d \"$v\" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d D7AED-31308-755B1-00AEM /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d D7AED-31308-755B1-00AEM /f
      4⤵
      PID:6116
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier /t REG_SZ /d 27904-15414 /f
  2⤵
  PID:5292
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v SerialNumber /t REG_SZ /d 20425-16287 /f
  2⤵
  PID:2876
- C:\Windows\system32\powercfg.exe
  powercfg /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PowerdownAfterShutdown /t REG_SZ /d 1 /f
  2⤵
  PID:2596
- C:\Windows\system32\shutdown.exe
  shutdown /r /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3596

C:\Windows\System32\drivers\winxsrcsv64.sys
C:\Windows\System32\drivers\winxsrcsv64.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a37055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
MD5 8ac3b3d1e522c27c6356583a6fe08ab7
SHA1 843f0de63fe13cc218d2671d5ca98bf1fd8e3dcc
SHA512 7491597d98da352fd86897832f1e3d01e14fec90f54625a275063124a6f419bb053029cf1482e65aae0e3b2769e9d7c6ff30d2e5c6a08412d6e55e0d14dd4408
TLSH
T13E116673F3CC8624DC5A403650CEAD1137B687CB449EDE6B7B84D155B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mmpesw4f.aij.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmpesw4f.aij.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

winxsrcsv64.exe

Path C:\Windows\System32\drivers\winxsrcsv64.exe
Size 377KB
SHA256 5e66ba6e5dc98c65fb5d6a0c4bef4a090aad01386ef44643c416b613bdb70a38
MD5 7ecdca11caff02f9c463bed663740788
SHA1 def46a8b7f168bdb0ca8e25dd8d02cf3f77b226e
SHA512 4d97b57a99a80617e829994a756fac4e14ee7b9f205d1cd25dfe0268255417f673f9887e862f75425a5b5c0cd2529c3c79391938f9c6fe5c2251529397660d62
SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr94ZRecY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5Bfu
TLSH
T1E084F62AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winxsrcsv64.sys

Path C:\Windows\System32\drivers\winxsrcsv64.sys
Size 25KB
SHA256 692afddcd14a26a38da1150dbc0df9486999d9bc3efee51695f9f9eb2eb00952
MD5 1249bd33f387ed0571624e1de9d24419
SHA1 2d28dc65658d4894f0924e1e9248ac6c4646b94b
SHA512 2fcb607ed43599153070a250b2582947d4221bb896372e11ae47a9ca32d3a0f6200b8c70857591e114275ca6a1cdb215ccee11856f0a18570ee6975858fb344b
SSDEEP 384:qrzqfCQlZluZfnktrQsHGh1jlyh3gkELRPR9zhTeiHU:KdCluVG0G37Q9zi
TLSH
T1DFC26C82A3781096F49E957083E9DAB37D7CB7863711A7DB12A0D0101E63BC9A23436E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-41-0x000001B3F4E90000-0x000001B3F4EB4000-memory.dmp

Download

memory/1228-40-0x000001B3F4E90000-0x000001B3F4EBA000-memory.dmp

Download

memory/1228-39-0x000001B3F4D00000-0x000001B3F4D0A000-memory.dmp

Download

memory/1228-38-0x000001B3F4C40000-0x000001B3F4CF2000-memory.dmp

Download

memory/1228-37-0x000001B3F4C20000-0x000001B3F4C3E000-memory.dmp

Download

memory/4116-9-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-10-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-15-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-16-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-17-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-19-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-13-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-12-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-11-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-14-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-0-0x00007FFB6A85F000-0x00007FFB6A860000-memory.dmp

Download

memory/4116-8-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-7-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-6-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-2-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

memory/4116-5-0x000001284C840000-0x000001284C862000-memory.dmp

Download

memory/4116-1-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads