77b82fd3c528fbc17237caa9eb741ff85a6ef159cbdfa7b9cfe2c9f841e87662

Analysis

max time kernel
152s
max time network
30s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoftPlayer6283.exe
Size 164.7MB
Sample260804-a39wlsac48
SHA256 77b82fd3c528fbc17237caa9eb741ff85a6ef159cbdfa7b9cfe2c9f841e87662
MD5 1fc9e3e95deb2f93dbbbe6a44c1cca88
SHA1 b929cb194419a9a7a06bf31f89854c5a76fe7c60
SHA512 553b5adf52b8ba5fdd193753cb67ac38f47c583456522f7d19038442ae6af941c897cd84809fd8437ebc0c5e270268c3cd4821edd3f29dbb8e29080e91ad3b73
SSDEEP 1572864:UmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:qsFWY7ihS4kVP
TLSH
T158888C03F29650E9F05DD1B18B578236EA72B8861738A6DF175417262F7BFE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

Looks for VirtualBox drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxmouse.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxsf.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxvideo.sys	SoftPlayer6283.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe
1932	powershell.exe
6136	powershell.exe
5832	powershell.exe
4908	powershell.exe
4872	powershell.exe
4964	powershell.exe
4280	powershell.exe
4224	powershell.exe
5800	powershell.exe
1344	powershell.exe
1444	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	SoftPlayer6283.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4908	powershell.exe
4964	powershell.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
5800	powershell.exe
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe
2384	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	2076	SoftPlayer6283.exe
Token: SeCreatePagefilePrivilege	2076	SoftPlayer6283.exe
Token: SeIncreaseQuotaPrivilege	2384	powershell.exe
Token: SeSecurityPrivilege	2384	powershell.exe
Token: SeTakeOwnershipPrivilege	2384	powershell.exe
Token: SeLoadDriverPrivilege	2384	powershell.exe
Token: SeSystemProfilePrivilege	2384	powershell.exe
Token: SeSystemtimePrivilege	2384	powershell.exe
Token: SeProfSingleProcessPrivilege	2384	powershell.exe
Token: SeIncBasePriorityPrivilege	2384	powershell.exe
Token: SeCreatePagefilePrivilege	2384	powershell.exe
Token: SeBackupPrivilege	2384	powershell.exe
Token: SeRestorePrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeSystemEnvironmentPrivilege	2384	powershell.exe
Token: SeRemoteShutdownPrivilege	2384	powershell.exe
Token: SeUndockPrivilege	2384	powershell.exe
Token: SeManageVolumePrivilege	2384	powershell.exe
Token: 33	2384	powershell.exe
Token: 34	2384	powershell.exe
Token: 35	2384	powershell.exe
Token: 36	2384	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeIncreaseQuotaPrivilege	2384	powershell.exe
Token: SeSecurityPrivilege	2384	powershell.exe
Token: SeTakeOwnershipPrivilege	2384	powershell.exe
Token: SeLoadDriverPrivilege	2384	powershell.exe
Token: SeSystemProfilePrivilege	2384	powershell.exe
Token: SeSystemtimePrivilege	2384	powershell.exe
Token: SeProfSingleProcessPrivilege	2384	powershell.exe
Token: SeIncBasePriorityPrivilege	2384	powershell.exe
Token: SeCreatePagefilePrivilege	2384	powershell.exe
Token: SeBackupPrivilege	2384	powershell.exe
Token: SeRestorePrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeSystemEnvironmentPrivilege	2384	powershell.exe
Token: SeRemoteShutdownPrivilege	2384	powershell.exe
Token: SeUndockPrivilege	2384	powershell.exe
Token: SeManageVolumePrivilege	2384	powershell.exe
Token: 33	2384	powershell.exe
Token: 34	2384	powershell.exe
Token: 35	2384	powershell.exe
Token: 36	2384	powershell.exe
Token: SeIncreaseQuotaPrivilege	2384	powershell.exe
Token: SeSecurityPrivilege	2384	powershell.exe
Token: SeTakeOwnershipPrivilege	2384	powershell.exe
Token: SeLoadDriverPrivilege	2384	powershell.exe
Token: SeSystemProfilePrivilege	2384	powershell.exe
Token: SeSystemtimePrivilege	2384	powershell.exe
Token: SeProfSingleProcessPrivilege	2384	powershell.exe
Token: SeIncBasePriorityPrivilege	2384	powershell.exe
Token: SeCreatePagefilePrivilege	2384	powershell.exe
Token: SeBackupPrivilege	2384	powershell.exe
Token: SeRestorePrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeSystemEnvironmentPrivilege	2384	powershell.exe
Token: SeRemoteShutdownPrivilege	2384	powershell.exe
Token: SeUndockPrivilege	2384	powershell.exe
Token: SeManageVolumePrivilege	2384	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4176	2076	SoftPlayer6283.exe	89
PID 2076 wrote to memory of 4176	2076	SoftPlayer6283.exe	89
PID 2076 wrote to memory of 1940	2076	SoftPlayer6283.exe	90
PID 2076 wrote to memory of 2384	2076	SoftPlayer6283.exe	91
PID 2076 wrote to memory of 5800	2076	SoftPlayer6283.exe	92
PID 2076 wrote to memory of 1344	2076	SoftPlayer6283.exe	95
PID 2076 wrote to memory of 1932	2076	SoftPlayer6283.exe	98
PID 2076 wrote to memory of 6136	2076	SoftPlayer6283.exe	100
PID 2076 wrote to memory of 5832	2076	SoftPlayer6283.exe	103
PID 2076 wrote to memory of 1444	2076	SoftPlayer6283.exe	105
PID 2076 wrote to memory of 4908	2076	SoftPlayer6283.exe	107
PID 2076 wrote to memory of 4872	2076	SoftPlayer6283.exe	109
PID 4872 wrote to memory of 5944	4872	powershell.exe	111
PID 5944 wrote to memory of 1600	5944	csc.exe	112
PID 2076 wrote to memory of 4280	2076	SoftPlayer6283.exe	113
PID 2076 wrote to memory of 4456	2076	SoftPlayer6283.exe	115
PID 2076 wrote to memory of 4964	2076	SoftPlayer6283.exe	117
PID 2076 wrote to memory of 4224	2076	SoftPlayer6283.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
"C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
  "C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher-build" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1656,i,4493798785394984661,3779636438652615449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
  "C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher-build" --mojo-platform-channel-handle=2076 --field-trial-handle=1656,i,4493798785394984661,3779636438652615449,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $cs=Get-CimInstance Win32_ComputerSystem;$bios=Get-CimInstance Win32_BIOS;$bb=Get-CimInstance Win32_BaseBoard $mem=Get-CimInstance Win32_PhysicalMemory;$disk=Get-CimInstance Win32_DiskDrive;$vid=Get-CimInstance Win32_VideoController $net=Get-CimInstance Win32_NetworkAdapter -Filter \"PhysicalAdapter=True\";$enc=Get-CimInstance Win32_SystemEnclosure $os=Get-CimInstance Win32_OperatingSystem;$proc=(Get-Process).Name;$tz=0;$tp=0 try{$tz=@(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA SilentlyContinue).Count}catch{} try{$tp=@(Get-CimInstance Win32_PerfFormattedData_Counters_ThermalZoneInformation -EA SilentlyContinue).Count}catch{} $bat=@(Get-CimInstance Win32_Battery -EA SilentlyContinue|Select Name,BatteryStatus,EstimatedChargeRemaining,Chemistry) [pscustomobject]@{CS=$cs|Select Manufacturer,Model,HypervisorPresent;BIOS=$bios|Select Manufacturer,SerialNumber,Version,SMBIOSBIOSVersion Board=$bb|Select Manufacturer,Product,SerialNumber;Mem=$mem|Select Manufacturer,PartNumber,SerialNumber,Capacity Disk=$disk|Select Model,InterfaceType,SerialNumber,Size;Video=$vid|Select Name,AdapterCompatibility,AdapterRAM,VideoProcessor,PNPDeviceID Net=$net|Select Name,MACAddress,Manufacturer;Enc=$enc|Select Manufacturer,Model,ChassisTypes,SerialNumber OS=$os|Select Caption,Version,RegisteredUser,InstallDate;Proc=$proc;Thermal=@{Zones=$tz;Perf=$tp};Battery=$bat }|ConvertTo-Json -Depth 5 -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\""
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VBoxGuest\""
  2⤵
  - Enumerates VirtualBox registry keys
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmci\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmhgfs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $n=0 $paths=@( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' ) foreach($p in $paths){ Get-ItemProperty $p -ErrorAction SilentlyContinue | ForEach-Object { if($_.DisplayName -and ($_.DisplayName.ToString().Trim())){$n++} } } Write-Output $n "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; public class KanziSmbios { [DllImport(\"kernel32.dll\", SetLastError=true)] public static extern uint GetSystemFirmwareTable(uint sig, uint id, IntPtr buf, uint size); } \"@ $sig = 0x52534D42 $size = [KanziSmbios]::GetSystemFirmwareTable($sig, 0, [IntPtr]::Zero, 0) if ($size -lt 8) { Write-Output \"\"; exit } $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([int]$size) try { $got = [KanziSmbios]::GetSystemFirmwareTable($sig, 0, $ptr, $size) if ($got -lt 8) { Write-Output \"\"; exit } $bytes = New-Object byte[] $got [System.Runtime.InteropServices.Marshal]::Copy($ptr, $bytes, 0, [int]$got) $data = $bytes[8..($got-1)] $count = 0; $i = 0 while ($i + 4 -le $data.Length) { $length = $data[$i+1] if ($length -lt 4 -or $data[$i] -eq 127) { break } $count++ $i += $length while ($i + 1 -lt $data.Length) { if ($data[$i] -eq 0 -and $data[$i+1] -eq 0) { $i += 2; break } $i++ } } Write-Output $count } finally { [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ptr) } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ci52fdny\ci52fdny.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB79.tmp" "c:\Users\Admin\AppData\Local\Temp\ci52fdny\CSC20061CABB278402E8C4B49E27C6BAC1.TMP"
      4⤵
      PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference='SilentlyContinue';$ts=(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate;Write-Output $ts"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\system32\schtasks.exe
  schtasks /Query /FO CSV /NH
  2⤵
  PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $ignore=@('securityhealth','ctfmon','sidebar','windowsdefender','rthdcpl','igfxtray','hotkeyscmds','nvbackend','electron') $n=0 $paths=@( 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run' ) foreach($p in $paths){ $item=Get-ItemProperty $p -ErrorAction SilentlyContinue if($null -eq $item){continue} $item.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object { $low=$_.Name.Trim().ToLower() if($low -and ($ignore -notcontains $low) -and -not $low.StartsWith('microsoft')){$n++} } } Write-Output $n "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 39f288065d8ae0b8db3500cd7747a25fa78fabc1fb809c3033c4764591c9df78
MD5 082b114247560ce23fc3a21853587b8c
SHA1 468627d335d6e65509aeaff9c37fc06e97c15966
SHA512 e6ebb07ec40f6db7bf7c17eb3cdb718c4cecbf85db7eb230b18930c396b706a5aa44a4857cb8b48bd71dc291ddd264e2b3139a395a0a4578633f98ce79f87656
TLSH
T173215733F3CC8624C89A403650CEAC1036B687DB419EDF6BBB84D154A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5138634addb304031f37a2cc003ecd712607b5a912fdb61da12976fb330b775c
MD5 9c204924178e9ad7aa1417e84a2ec08b
SHA1 7665c01cc6c82649a33a145f552d291266362401
SHA512 d89cdb67d961524696502636430b44c375f210b9bdee1c8887acecd2a5d17fb657a1e80c5e085e8bc87df11ebe94096089b0a259e93c0dfc1a7f01f370a4ec82
TLSH
T15E215733F3CC8624C89A403650CEAC1036B697DB419ECF6BBB84D154B53F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
MD5 0773347dabec51061ea4a74589125e12
SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
TLSH
T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d41faff8a8d5300df04a99d3b9305e520e1f96cc2f667935cf69b74eb0691b0
MD5 fdafc6b42da93184e7311b68654989b8
SHA1 e4a849eac078f587d814d4074d1c7cecf9d229d1
SHA512 45b3884ffc14cc02459196eb425df3350ad83ea36586016c43d828def636517118aa163f25888a41a164261c3f1afa8371a8fe65eca2a0be06fd4f5392924dc6
TLSH
T1E4215733F3CC86A4D89A413650CEAC1136B787DB409FDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d4d2592314329039add617ed2e6effa5b3292602674432b700fb198ae2be7d57
MD5 b23869be3268dbb945f1809332ca3604
SHA1 e27a4d7f95a4b4d3bd164aed03f4888d00eece87
SHA512 2371d841a87dea5b312d0ad8b0e556da5e2e0ff32dfa86e17fd4e3b3754caa92885d3f4bfabb0cf020fffe12864e6140fb78ec8c251e5e92f348281322c86932
TLSH
T161215937B3DC8624DC9A413A50CEAC1036B6C7DB419ECFABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESAB79.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB79.tmp
Size 1KB
SHA256 5ebeeb5c4ff25de0c55ff01f05c827d20c0b7b1934b6dcfc253cd78c7bb8564b
MD5 a308b11a8006e1b9d7392f72d56fb17d
SHA1 661e69e17837c41d3ad2c736776f09daea936fca
SHA512 ee902ea8ca4324d26b89201c01f1cb220ee629d365f6cc5fbb97199bb007f018cf09c66057ada6d0f4b372f07fc1e8fa695dc36dbed8c06b6d4a4213a1960763
TLSH
T17D218C0593E8470FF0B7473269F6432BA674FD64EFA2975A9980421C2C51604EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vbdrenla.rla.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbdrenla.rla.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ci52fdny.dll

Path C:\Users\Admin\AppData\Local\Temp\ci52fdny\ci52fdny.dll
Size 3KB
SHA256 a72b1609e3850d7adbf3294231f218d64e9b7e6bec4cf3f68f7b444b269da9f1
MD5 6534df6f45e3761d36173282dec92de2
SHA1 101076ad42cc04db686db132b414d1a41f8ecbae
SHA512 d540e3239873945a3feb2959a00823164c0a8fccf9c4f9a6f7c6ccb0ca5f831db5b15591420f9e9ebb708bb76fedd4864db0c533cb930df53b816a9a9f1dae06
TLSH
T12551BC1AA3E8462BE4B747356EF3431727B4F8209F72A76D08D00229AC607681E71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

CSC20061CABB278402E8C4B49E27C6BAC1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ci52fdny\CSC20061CABB278402E8C4B49E27C6BAC1.TMP
Size 652B
SHA256 9362c3e293e12f179ee7a13cb3452e0853accbc509aa7296f510031322c6ad59
MD5 df7db9dfa72c5564042b2d67a3aa8eb8
SHA1 ee00b54c445a99866744727b78fca3954407408e
SHA512 7bfc9ecae957e93c8c5060c713c9a7338a4fdbedb2b62307a3ac03bdf2e0a045ab878ef30c74b4cdf33358d7aa34b56a60a1739cabf8efb617cd9f33345ca391
TLSH
T146F05E0963F8020EF0F34B31BDF6436395A8BC65DE3293ED188013192C64A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ci52fdny.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ci52fdny\ci52fdny.0.cs
Size 226B
SHA256 557ab1b5120f4dfb46b21503fbd9814df57b5fb71df988070c26e2d5e298e798
MD5 e0ff79f719703b75f5a44f7df89866ad
SHA1 84459e291f17030f85dbcce02dfff78e223eb5f5
SHA512 b7178e36c24709b7687bb8158899ea8bf124b7fa38b92f531dc7892037d1490c032c81f8e873017704ff24c8fdf0563e3d8defa6ec19bb2c1cf13c0601cf1bc1
TLSH
T1CDD0972837A7A2B69006801A0E05F58CFB13C21002B42800CAEC0212CC822085A70E36
MD5 SHA1 SHA512 TLSH

Submit Download

ci52fdny.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ci52fdny\ci52fdny.cmdline
Size 369B
SHA256 ffb1525eddc403efd53c8e390283d568aaaca7f2ad9ee70844bfe619b7e033f5
MD5 1618ad72d14936cacd8fe33396b29237
SHA1 a81e87f0d1d081ed69f28b20d0ba678c2bcaaeba
SHA512 0fa9c03df1c78954c8cbbcd129b5fb5b76d9e70f169eff186c0b287cc1ebc69ba40ab7006551d6d113f63b41fbeffb9a126e0221d27689c647aa22659171ba8c
TLSH
T149E0202B5356C67D15DE250B23EDD6ACC37207472D81BF849971445DD027044F7E17D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2384-42-0x0000025961100000-0x0000025961124000-memory.dmp

Download

memory/2384-38-0x0000025960EC0000-0x0000025960F72000-memory.dmp

Download

memory/2384-37-0x0000025960C90000-0x0000025960CAE000-memory.dmp

Download

memory/2384-39-0x0000025960CB0000-0x0000025960CBA000-memory.dmp

Download

memory/2384-41-0x0000025961100000-0x000002596112A000-memory.dmp

Download

memory/4872-82-0x000001EBDF550000-0x000001EBDF558000-memory.dmp

Download

memory/5800-34-0x0000026747A40000-0x0000026747A62000-memory.dmp

Download