3478c721b327da40bb84eb4f48327477d2be278ec8403fbedaf66f88c6f6e1f3

Analysis

max time kernel
298s
max time network
201s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
حل مشاكل/حل مشكله ابيك قيمز.bat
Size 2KB
Sample260824-p5dnhsde33
SHA256 3478c721b327da40bb84eb4f48327477d2be278ec8403fbedaf66f88c6f6e1f3
MD5 a40d831679839adf883b7a5fd42a1d65
SHA1 35a1194bf2ff3b0fb3c89b549ac5167148c5a2bc
SHA512 f88c52c2de3eb8e633f60f4a8e6e4e2ba8fe87f1305bec3cc4eb26055cd96c0a39ba0e01a219d83941b65c790cdbaf2e90435cd6aae2becca25b73e19dc60046
TLSH
T19351D0033D78FC798085CAA09BE7A565ED444E8B00093DE4D4F6327BC568B8B927DD49
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5792	powershell.exe
3116	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5792	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3900	sc.exe
4920	sc.exe
3096	sc.exe
2660	sc.exe
2820	sc.exe
2112	sc.exe
4844	sc.exe
5852	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
404	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5208	ipconfig.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5672	taskkill.exe
5840	taskkill.exe
3040	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\00188018EF17EBF5 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000070e8436a6992174a855f81bde41a5fa50000000002000000000010660000000100002000000053cfdac46c47741a809a55104234f3f55fd6e8a3a470898ff15690e35978ea39000000000e8000000002000020000000969648cd7e4f049e3045c84add8ec6ae8361ce456e5a433554863fb11c1cc53f800000007cae4fa2e8073419da0d9c59d4707233f042ada6c0e5bc2eb1b22bd095cd27280bc22856e7848ae096c7065bccc87eb4c9e0c1ae9ed089051549bb9b0c2a5ab1e713993c6815097918f411abecacbedb7d8c46255e141717b2fe4615f640b125a33dd8f2ba26e5d85e368f15669677202db91e9950203532d635399f2771de8a4000000009aac482319020b616677ed65ea8c0dfe56a9810e5af9b2d82cd176eb1c0955c43dc184ea403b3b1304089b651d269561332579244d7d255f0a567e4969f27bd	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{CA4948B9-35E5-4977-A64A-5C71AA2A26CB}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{CA4948B9-35E5-4977-A64A-5C71AA2A26CB}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000070e8436a6992174a855f81bde41a5fa50000000002000000000010660000000100002000000078c1d682586ef030fdaf3c10dcaf40e6fb09d42d1dda967ab043ff96d14e371a000000000e80000000020000200000001ad0dbf94b97f05bd3b3c3829737a601229137c9514456fffc40e63fb5bf12e7700f0000efa5703cb446dca0d7fed5d6e8797e35c13f54fa6bd1cb068ce5cf998dc9357aa6d6ba3bc9acbef9188126b57486cf4f09b7bbfef9d1a36bd6d3955ac09f6116608c769a184a389f5bc2fe1e5aceed8cb6f839f874f14219d848c4176b615693386a9737acb63b88e66c871298ea9e695f0c1c52ac276820fc1b41feef2d337a9fa74a7e94511b312da7f375306bb364938baec27b0a88aeb97ba40593a534df3d4a6c3201e078625f7b63decebe97c22ad046aa0f67f99f5ec69a3537e7bf518c60b6107ea0b0ff1f061481fabfec1d7aa922566b2bbd8b29e7caeedb0302f90d967134f108fc38a103f2f78d5879bff4139ad2df9e1d92729811f47bc9772ed1c27c8392257c0add84e9ebcfe0dfe3ee3b4dca2208dd9bd97c6893061974593fe03eec8f7a00100220bc51f840d44de49a4cdd7f176722ea6efed231f581efaa6aa3e8a6f68aadbc9a09218e95f3e097948a599a27bbcb209eb26a23979fc403b3e09dd845b6a8daedd0b9fa6b7c1dce0df39fdf1a33929ac4303995c2424d5496b46461d0c43571605bd8c7938799a014534d3deb4cf76daa155b9eddd134c4acd77830b192299453973f8b69b09d8f7de2c0514b00c5d02f353fcdcee109ef0491772428967cb4a9c7c1b254635feb9c269aaaab6701f2a65b371a772c04a1233b76185d8e2422e916d8dc7d57aad24fa838ff6f803fecad35731b7cd6cc6cf4121f8bc90a65c2e2ba4b57bec5999a07d52d7e23383ae5a5f05956bac8d5422301207da56b977b5310a8ffe6dd1bff7c2b2038c01814b1037ea4f25bbb0f9fde0197d7843d92333744096df457c96ca144e93c9087e2319d6620cd72bbed3b46bca6b410c5e95929272cc90f005f28792ec7423b0e4ad1381f1431e03b64cc19260005fa1a4cc705999577b858e9b2e15918b6c6db41d69b2577bf7a4ecc2c523bc5d78ea839865c2c023fadc63163ec0986aec738660bd7cc0a2f3eecc28897eb18d19b31811ab63d0a9af13d44a8535b2dd3c98bc4311de8d252ca93d2b4ec7b079b5a78d0b19f5c884c9555bff33b6d9bba278a568a87d42cd25f5b9d4aa1ed3b4903336cf5a5275b3169cf8f864236cc4831276db8b4fa8506742ac8552f608dcb2fa753b911fa9af387cf80f1d4754adee21fca27670747021d533ddc9eed3820e46911ea3638f903612e8dc2c339dc99a5c0dec826d66fc7160d19e65c6eb87cf8c3a7973e60216602aef8134da89c01a7bc0e9e489445436f566c36efaa7532668a795bf801909f02fcfc6d5b70e2a4244c49eef76983bcadc19dee80b5caa41b5f1537610365777049c5637d62a07b747c035d6f739002f2f13abb7b3573fd245cf5c093162b4c4bf13a9d70b036e0f4b4776f9bc2fa79cd4be23812b692393e4c748cf2712d6796eee3a61e9cb930541d36618cb46043bdce4b4f41caaef7cd001d39c2cf819961e11d40077a116263acc0361f9184f2604efd3eb4f872740a7fcdd58c2ffea6c2ccec27f45ac4d8f3123c13253960459171d59cf5275ddf989e795dc4e04d53f3a317ff9451e511d5382682d84fe9d7dbfd72faec866557a9d42eb03239f5b40cf0b243d0178edbdc90bff65a6f897c1efb6c8f5797c4753637edf3d1777ac1a7244821f61f2e204ea92baf8546298d0a6590b53a3b784f0ccfdc31e84f49fcccec003df839c2158ec2db27205237bab84350cea87565c046951792e272b50100165354e1f36e7a776356d245424a79726bf9a68b22833a605c02901193b7c56905cc1e5fda3c77c9ad1a220d7eb4f43005fb44e728bc9633b6514aa2c6142321861d85b36825939763aec2d8524ca8ea54a3b01c651189ccfa80ff11dda4fafe761ff6ec3ff5e70a37a17557e2be49870fd198fbc18800e5555d5da42e2a978a6c44b7766a4629e9cec62e929c35da6565350ed6bd1e5bd80cc106c3443cdd02f79a84479b3050dcf60679650f72172d865a182512fbee1e2c440c86b2a9fdca86256bca34b785e59306181cd93daf4ac524f59ae02dc457e441e17f4fcc35e7dcb49d943459d4d97a18726d8c01b2c8af35c26ca6d23fb1c6b7cd5ebc69e636fb664e7356ae1ede4603285f25733d143e911eef59afe5e221201f7dcee928141c617991c373dd7efbfae7693d31b3e3cd002e4ef1b6764e86b2635d643961e4f05cd183b8851f1506d138720afea778ccd18add02806e89aea383795b2446f753b67d5e6b78d7a005683404d4244a6726282a220877e7fbf3914289f76d82f22fe3ba7fea1f4952d36a42adb1246cb0e6554f94d87cd0fcfdda8d3d2435789109328ac3be8d5b13497459ccf039160c475bf8ccdfca7735132ef61ea3353313169b6e681336fcb3b32778602cbe84952230fc794e5800ca56f563401307b43cb89390554806708830162996a37b1da31cbfe418208e5c894c6faee954142dd0f8a94fe25c2af565afad2094d1af715030803dcb590e5682f68fe1ef260ca0ca28c791a54e08852079ef2fe0240f6173817e07292145477caaed8db43841bb1d5c80da044a27876aff8c9ee768ea832b92c11dc954f1cddbc0aa9d73e8b54f0cea0d18f4303d9abec44b135c32e7ce43100b85a0b4fb387244907e7ae28fed318b45cd64081190c03701a96c94bf3828a61c4a950a3624d73942c2a84992ddbe315b20820485bfdbe3aa4e1a414d535430e255b0f6a101ff5a79c3879cdfcd2e9b49e8959777db3fceef15f4d8bda27ad5703b9d1a2b7926c836e0f4715a627206387c5a628b44d046a526c38f9f8795cc72e5680b490e1ae8a5427c819bad5750c14c7ec4d19e8ab43cc8a5e6b5c57696e8f25c7d4bac4c63c7a852fe8fb935f85be61b04112837986c5e6b76aa77e3748a888fb7ad69db01013c71765ca090113ce42eb69b8101804f1296b41b615591a0c3c359996f8671366256b12c4ba74ef5b8dd1e8d945f62ac18b837e1d72ce455f97589e7efde1af815d5c7e678e8c8dd3b43e41d1658a54337826fd92bac76cd9b5206fc69068ecab58616566c0eac283335dc846501c438fa85cf04847445e09e7ef9c9cb0bcdf3e8efb565ff07999fa8d182037b025674295dcd10c153615b4dded78746eedfc4d34a6a2fa4ce168a0234941ac309995bee70f4b17aa3c44a0521498fe5b6f98f171da76f08ef1a62e5a1c09764b301862b0783f744e450ce66596820e36a21a233da45328bd623e078c0dbaa9be2bf6544836ab557878b4f69b95067de74b3d9f871aa0a5e008bb96d52e9f4a5b3b38678da6633df488a01e83e7006937ebe5c5d2d593b8a145a14070ea88e4e390f5fbc4d9a9e461541c424ca6ee46cc223138cce3181935bfbfe729066ba9418fd2f617dc3f2ea721510a37363df042cd49c58d0d85e136e3ae6d1291cbfe117d9ab88f77c2ead2868c1fda99c61ea7c92919f81e30a1e39873412b5aeba7499caa693a8871a512b9e72054dae3f9cb11ad8c5c9edd4c9fde1af5d81fc6afd4b159b16d47013dc8f5f59143ee94a8103915269238e2ff84633ccf85589bad90aae7ccbb4ff5d021946872014590f6b26d83ee90af11bc981c8a6ff677541179772f8093e7bdcf95924e848e281bbbaf6ed9b244d55fd680f8925ba4e49592fb7244a47332376909c6c2b36c830ce54336fc1602ec51db8064c4143b3d5e0413f09edd549f4325e100ea0cdd9fc71b6ce579d27160b4522fa918c3a4a5973c93a19b09717132604b3fdfc55ff1a4ebb3d3a37fe9d5cf4d189f749675666b63c19cbc7d0e69b02084f793f125d7d3986561e5864aee919217129b6cf3df236fd311011fe430c1f7f2cceac4e2055ad3ee656ce2b000dbd5e2d239cb024a42e91c6d4d0b1b365c2abc81b8f8ab15923f3c39aba1fd74e14069068576dde386b19e6a70b09fa4538cbd4dbd6183e73aaa5e59429d259b6598d69cd7358648e5e5dfc1b35cacea918accf93d1a932003e14be1680fe0b3cd4ae03ea3ed6d7026a5b811632a8093977812f58692d6aea5baee6b076fcf2daee337dae85bf79bfc214f1ae2d78bf2d79a5f8a8854b426f1f1190778fa2d90157a24b2739bfe6351e1f73704b9b9b6e8155096d7f897bf9a85aa345907ce3c3299f7a94a61165ccb2c2c5bb4b4fed0489fdbd320836555becbe5d41ecfd4b4b986f496fb1c9b6676023874608065a5a64312626a6cbe6c5c47b191a41e7bd40dd704bfb2faba5839289fc45c638d3a28b9851f457dfa325cdc69c017826edb20c38986bd4cc5290edfc49da828a4a9cfc0182d465252e87bc6f13858d91674bc790f7848fb62878d43a2e6a7254a4f61dd654105ba39aca21074cf397c5b3bac4f7ed4b3588a62ebbd08ecd1924e437e3980ddcd368dcf7ed045962a304196e9a05fb191a10a92ca0a151bd204eacb33f46fcb53cc2d82721b0b0d3e1c4ea7868a14ecaf2f43cb68ccf6bee9fc53cfc981c3380108b0505ba5270004ad2ba34db145898f364b026012330980bc445a62931a472bcbdbc317146fbeeb693b13038ab54b3f7617e42ced2f2ee40a2b3c0a393a2248b7bcd39795013be446d4ef328fcba6b12e29ed6a387729986494c1075c81c9a0889084ff819a6649ceed822826e2ba87c8f403b4ec9e3fd6d30f2cae0760f72c6d591f0389c2f6ea64e9a121409de53a8c76e80e7d1951005ada22fc263bfbc50e4d8832cb25e5a9b138a9fb84e7484a0ac20e0aaa3e4ceb1c20f8fffacc807a850d9ab5d062b84f9821184dbdfac49e7044b9225306d75e73c428b9259179d4662c26d5edf9145845fac5e50d9d14037ab06202cdf6de205b529a449df71e27ae6008e962ab9e38027c06df1d4353d2c62698ba52345650a6d59554034682f201554f82708d06aed0da667899179e146e00a6bed7c3b10087f0a3ae012e56068a73907e6a400f6d587a1e033c2ac9882eaf4bc7464245571d8abf2960f80c3f673e35178664f6190bf345e3c6ba686c020a153aefab3295ca9e9538f9c08442ec52fa45e520712b62db9a208ff6ba01ae469aea880172f68b738b52c61d966fc88b859803af46fc3db6cd58656e7c40d7c8eed3cad453a6090b1865a882ce5c54be8fac264a51a16647e1566a6b0d7ac6a660ced57292797362424a57704de59fc3b5177743a0465c8db2b29ccddea46f78390dd9b62dc44e0b0c49a8f2941b11c046a892b7542456b523b3c08f32943c31c7f3fe4f2aba23c63d80b199b8d2f190ffaf05b31243031f94de4f87b96ffc0b93b531e5ba89eceb9c94331849f8c7fb9e32516e90ffffad4a60975285c480c9b256b4d548e1239f50fbbdec1e70275c1d7bfbb7ce0ff950611879d3ba37cc7b69a219426af0f7da537cb1596b421c9e800a63066d004a1285515ff3bdff22cdfdce4e404d89b29509ceade5bf50a9f053d5bee1e99de44dcddf3a053ceb24d0bed82621ef52febff5c57b70ea4534c39e4970b2b1f4f6c12718403014f68876104e62287b5af14d6c5fa7e0fff8fd3deb6e1284b8aec7d745e0944a9f0f102bbed4cb4374d9f8f910b332640d4c5f0d9bdd4d4679fd5f98fa215e9444aa040000000a29e62e5966fe50cd5458b419777c97914f29161251ce29469b92b010a698292e4a690ad3d9afbe0c2fcf68c93f1d365253f75ee119d788409ed97db34f3516c	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{CA4948B9-35E5-4977-A64A-5C71AA2A26CB}\DeviceId = "00188018EF17EBF5"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{CA4948B9-35E5-4977-A64A-5C71AA2A26CB}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	3116	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	OpenWith.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 940	404	cmd.exe	90
PID 940 wrote to memory of 6048	940	net.exe	91
PID 404 wrote to memory of 4920	404	cmd.exe	92
PID 404 wrote to memory of 4304	404	cmd.exe	93
PID 4304 wrote to memory of 3292	4304	net.exe	94
PID 404 wrote to memory of 3096	404	cmd.exe	95
PID 404 wrote to memory of 3440	404	cmd.exe	96
PID 3440 wrote to memory of 5088	3440	net.exe	97
PID 404 wrote to memory of 2660	404	cmd.exe	98
PID 404 wrote to memory of 4688	404	cmd.exe	99
PID 4688 wrote to memory of 3308	4688	net.exe	100
PID 404 wrote to memory of 2820	404	cmd.exe	103
PID 404 wrote to memory of 5292	404	cmd.exe	104
PID 5292 wrote to memory of 4816	5292	net.exe	105
PID 404 wrote to memory of 2112	404	cmd.exe	107
PID 404 wrote to memory of 616	404	cmd.exe	108
PID 616 wrote to memory of 3960	616	net.exe	109
PID 404 wrote to memory of 4844	404	cmd.exe	111
PID 404 wrote to memory of 5944	404	cmd.exe	112
PID 5944 wrote to memory of 1104	5944	net.exe	113
PID 404 wrote to memory of 5852	404	cmd.exe	114
PID 404 wrote to memory of 3900	404	cmd.exe	115
PID 404 wrote to memory of 5792	404	cmd.exe	116
PID 404 wrote to memory of 3040	404	cmd.exe	117
PID 404 wrote to memory of 5672	404	cmd.exe	119
PID 404 wrote to memory of 5840	404	cmd.exe	120
PID 404 wrote to memory of 5208	404	cmd.exe	121
PID 404 wrote to memory of 4820	404	cmd.exe	122
PID 404 wrote to memory of 3116	404	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله ابيك قيمز.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6048
- C:\Windows\system32\sc.exe
  sc config EpicGamesUpdater start= auto
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\system32\net.exe
  net start EpicGamesUpdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start EpicGamesUpdater
    3⤵
    PID:3292
- C:\Windows\system32\sc.exe
  sc config EpicOnlineServices start= auto
  2⤵
  - Launches sc.exe
  PID:3096
- C:\Windows\system32\net.exe
  net start EpicOnlineServices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start EpicOnlineServices
    3⤵
    PID:5088
- C:\Windows\system32\sc.exe
  sc config BITS start= auto
  2⤵
  - Launches sc.exe
  PID:2660
- C:\Windows\system32\net.exe
  net start BITS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start BITS
    3⤵
    PID:3308
- C:\Windows\system32\sc.exe
  sc config InstallService start= auto
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\system32\net.exe
  net start InstallService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start InstallService
    3⤵
    PID:4816
- C:\Windows\system32\sc.exe
  sc config PushToInstall start= auto
  2⤵
  - Launches sc.exe
  PID:2112
- C:\Windows\system32\net.exe
  net start PushToInstall
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start PushToInstall
    3⤵
    PID:3960
- C:\Windows\system32\sc.exe
  sc config DoSvc start= auto
  2⤵
  - Launches sc.exe
  PID:4844
- C:\Windows\system32\net.exe
  net start DoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start DoSvc
    3⤵
    PID:1104
- C:\Windows\system32\sc.exe
  sc config EasyAntiCheat start= demand
  2⤵
  - Launches sc.exe
  PID:5852
- C:\Windows\system32\sc.exe
  sc config EasyAntiCheat_EOS start= demand
  2⤵
  - Launches sc.exe
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Service -Name '*Epic*' -ErrorAction SilentlyContinue | Set-Service -StartupType Automatic -Status Running"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicOnlineServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:5208
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "if (Test-Path 'C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe') { Start-Process 'C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe' } elseif (Test-Path 'C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe') { Start-Process 'C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe' } else { Start-Process 'com.epicgames.launcher://' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s PushToInstall
1⤵
- Modifies data under HKEY_USERS
PID:4252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 124123e5f5deae1f5deaafc9edc8aa4c1d2bcdc2be10edcdfda2910ed68bc489
MD5 10c32c4eda61ea0599d4a10ebcce006e
SHA1 4b32dbdc5abd18c13e4c5c6f6c17a2bc05d2d69c
SHA512 0823e27af408d7c12dc5a925188ea55ddc5db92a8b08c4c371eba38a0a708616df87cac67b345bdd6b55e9260755e8db64f40d642a80ad9a39c904913d7433ee
TLSH
T128218633F3CC8620C88A403650CEAC1036B687CB408EDF6BBB84D044B42F598DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5792-2-0x000001D8B81F0000-0x000001D8B8212000-memory.dmp

Download