7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

10/09/2026, 01:47

260910-b7n1datcle7

02/09/2026, 16:23

260902-tv7k3aam3y7

02/09/2026, 16:11

260902-tm9qfssvdx7

Analysis

user interaction
yes
max time kernel
87s
max time network
69s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/09/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260902-tm9qfssvdx
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4392	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1976	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1076	powershell.exe
3392	powershell.exe
4480	powershell.exe
3312	powershell.exe
1440	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe
5968	cmd.exe
4220	cmd.exe
4032	cmd.exe
5724	cmd.exe
2780	cmd.exe
1444	cmd.exe
4468	cmd.exe
5660	cmd.exe
5536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\dp0DBlecg.z20:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\Shared.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe
4480	powershell.exe
4480	powershell.exe
3312	powershell.exe
3312	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3392	powershell.exe
Token: SeSecurityPrivilege	3392	powershell.exe
Token: SeTakeOwnershipPrivilege	3392	powershell.exe
Token: SeLoadDriverPrivilege	3392	powershell.exe
Token: SeSystemProfilePrivilege	3392	powershell.exe
Token: SeSystemtimePrivilege	3392	powershell.exe
Token: SeProfSingleProcessPrivilege	3392	powershell.exe
Token: SeIncBasePriorityPrivilege	3392	powershell.exe
Token: SeCreatePagefilePrivilege	3392	powershell.exe
Token: SeBackupPrivilege	3392	powershell.exe
Token: SeRestorePrivilege	3392	powershell.exe
Token: SeShutdownPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	powershell.exe
Token: SeRemoteShutdownPrivilege	3392	powershell.exe
Token: SeUndockPrivilege	3392	powershell.exe
Token: SeManageVolumePrivilege	3392	powershell.exe
Token: 33	3392	powershell.exe
Token: 34	3392	powershell.exe
Token: 35	3392	powershell.exe
Token: 36	3392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3392	powershell.exe
Token: SeSecurityPrivilege	3392	powershell.exe
Token: SeTakeOwnershipPrivilege	3392	powershell.exe
Token: SeLoadDriverPrivilege	3392	powershell.exe
Token: SeSystemProfilePrivilege	3392	powershell.exe
Token: SeSystemtimePrivilege	3392	powershell.exe
Token: SeProfSingleProcessPrivilege	3392	powershell.exe
Token: SeIncBasePriorityPrivilege	3392	powershell.exe
Token: SeCreatePagefilePrivilege	3392	powershell.exe
Token: SeBackupPrivilege	3392	powershell.exe
Token: SeRestorePrivilege	3392	powershell.exe
Token: SeShutdownPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	powershell.exe
Token: SeRemoteShutdownPrivilege	3392	powershell.exe
Token: SeUndockPrivilege	3392	powershell.exe
Token: SeManageVolumePrivilege	3392	powershell.exe
Token: 33	3392	powershell.exe
Token: 34	3392	powershell.exe
Token: 35	3392	powershell.exe
Token: 36	3392	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4380	taskmgr.exe
4728	Setup.exe
4728	Setup.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5724	4728	Setup.exe	89
PID 4728 wrote to memory of 2780	4728	Setup.exe	91
PID 4728 wrote to memory of 1976	4728	Setup.exe	93
PID 4728 wrote to memory of 1444	4728	Setup.exe	95
PID 1444 wrote to memory of 3392	1444	cmd.exe	97
PID 4728 wrote to memory of 4468	4728	Setup.exe	99
PID 4468 wrote to memory of 4480	4468	cmd.exe	101
PID 4728 wrote to memory of 5968	4728	Setup.exe	102
PID 5968 wrote to memory of 3312	5968	cmd.exe	104
PID 4728 wrote to memory of 4220	4728	Setup.exe	105
PID 4220 wrote to memory of 1440	4220	cmd.exe	107
PID 4728 wrote to memory of 4032	4728	Setup.exe	108
PID 4032 wrote to memory of 1076	4032	cmd.exe	110
PID 4728 wrote to memory of 4392	4728	Setup.exe	112
PID 4392 wrote to memory of 3228	4392	forfiles.exe	113
PID 3228 wrote to memory of 1284	3228	cmd.exe	115
PID 3228 wrote to memory of 3196	3228	cmd.exe	116
PID 3228 wrote to memory of 5660	3228	cmd.exe	117
PID 5660 wrote to memory of 4544	5660	cmd.exe	118
PID 5660 wrote to memory of 1808	5660	cmd.exe	119
PID 3228 wrote to memory of 1108	3228	cmd.exe	120
PID 1108 wrote to memory of 5536	1108	conhost.exe	121
PID 5536 wrote to memory of 420	5536	cmd.exe	122
PID 5536 wrote to memory of 1976	5536	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1076
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0 /m dp0DBlecg.z20 /c "cmd /c ren @file dp0DBlecg.bat && call dp0DBlecg.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "dp0DBlecg.z20" dp0DBlecg.bat && call dp0DBlecg.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1284
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:3196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5660
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4544
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:1808
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\dp0DBlecg.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\dp0DBlecg.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5536
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc2792f062d276c3a6c95202b5d40b7db678fc5e67e7be45890b62eccbdd2b33
MD5 2b5b9a7e9f9855dc264a676d2dce0c4e
SHA1 2dcd1444e248fee74a0c176cfbdbb80d20efaaa2
SHA512 ffbcf4624dd138466dffc151f9f4d1b5c21e5a5d23efd6c25fa11b9f6ad72a68a9cf5371469443747898cae7929e915dfce891e52321708f11fa57c8b5bb0535
TLSH
T19A317437F3DC8611CC9A013A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bac79e074e1dede4f44d14116fd07211ebc9ec5e9058a13408c4fc8d29db71f2
MD5 2ec40dacdfbcc8cecdd0e0ef6eed0f01
SHA1 ad36c9cda9206f6e5576e0460a5f9097b9d1660c
SHA512 b8cfc61ba845512e0a5a8ac69ed7c788b83c49e02bfdf1b6707ab2cdac27a0fa266bc2bacfbf410b90d6da13bffa467e3e6909f1613ab3f124b288afeb345826
TLSH
T156217633B3DD8224DC99403A10DDAC1036B6C7CB40DECF9B6B81E169A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a4a7b2093430fdb8691afd6daaad55f6173188c68c5d07ff85bf6e57beca7a7e
MD5 31dc1ec3d78cf4d3047782478f32eeca
SHA1 b11dc76e0922ad2e7c6377ad4d6ad1ae5760d52f
SHA512 d1144098194223c9da1903325a27955d73b5c65ea9367e692af0c1c7e1887a4d2206a43b0ea79f58935577963126171b3a2d910a18fabe29b3d821d93c3f7ca5
TLSH
T1D2219837F3DC8214CCA9003A10DDAD0036B6CBCB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1c46507f8461b24b2c9e0e58e12cdbf19c0c9f176e43dcb0b6d58b603a813821
MD5 a7658a9bcf36d33aac308996bd3d029f
SHA1 322f674bfce6140b3460b2a7fe69af23b7f35505
SHA512 6c71505af7c34e941f51861f01a2e7526d09127831d39bf84cd94a16685d074521809b5c2b5643085130f4c5a0d6ff72295151f78e6135b6cfa92a9c6eacd623
TLSH
T1F8216837F3DD8614DCA9403A10DDAD1036B6C7DB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1klbvnfj.rjx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1klbvnfj.rjx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1788365769.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1788365769.tmp
Size 1KB
SHA256 14acb005d5814753f8fc51a3cd78dc5040d5f8d429e5f035e7bf5022fe9a2565
MD5 da6c9765920df3d5ff9743243554d18e
SHA1 0915c4d37463424591a8ad5def617eeb3b238dbd
SHA512 c3ead86404ed4dfa7d7c32d1369b2a139b9ac04f01b9fb1fad772638572dfe98d1419d6d5f3759a1aa30d01e5b0372ee880b662ae988667c5f159e70b4308eed
TLSH
T12231E8DA755307307420F798B2AD13D053027DD2E801C0B56ACC1DBE5B30EA8BA9587C
MD5 SHA1 SHA512 TLSH

Submit Download

NodaTime.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.csproj
Size 15.9MB
SHA256 1fdd14b2565d05621dbfd374affb928942a35e640611cdbf15b377c95466964d
MD5 f7af6cf5cf9f35a19fd6ab1d0ae96355
SHA1 84d71fba40b2c7d147d9acb1f190d8478b470e19
SHA512 e99a10b162cdabbf882889b6f4705d8b57ad0d09847d140ce9b7d9b6850e9b7e0fcf0a5e27fcaee37a649ea68a528a0b8ae7c7b5c62424956f3b9d314e3945f8
SSDEEP 1536:T3BswhWpBgBJ7SmfC5kCWrTWZ0KJqGBvOjr/wF06VWQrQma/j+SAP+9Qr/16QW9b:7
TLSH
T15FF6BF36038087E6E2CC67C4446B299E22B9F66639252784FF732BFEDC55AC79834147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NodaTime.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.csproj.user
Size 312KB
SHA256 f819f43e560b64d9d93e824307b5da2a33f5a49756fe38bf33ac1b432e30a87d
MD5 e112c60bdced9bc661f8e3c9b798ad83
SHA1 967de535e97f6ea6009cf2f2b393d5a46e03da24
SHA512 5e87278c32c5418574c87807e7f078c1f75e46d515e293254e15174db8b16bbc05914a25c76f2ff7005464d5edb066715fc1cd5e54d84af599760d266d2cf8ad
SSDEEP 6144:djCzZN4tU4gUNqEBZszgZ+49N4klalaF1JaPaLHHkN6QhUOyIsf:zhbf
TLSH
T1B56400F494FF61A2E34B89052AECFE5442B231D79FCB395863AEA3518F987167B4400D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NodaTime.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.targets
Size 545KB
SHA256 98b3d08c8475948de22887e1972f69bee5d45e3f2969c229879a4b3dfef25d2d
MD5 1f418a5d47c936a1f230cb6e321667a0
SHA1 66f182f5e82ca001a96d51bb060198000a0fdfb8
SHA512 a73fcf9f1d9e83ed5dabab47786455de9425b3783d4da93d6c2d3ab467b6b88f089cb618612b5b31a732a5ea9d84753d7402b4fec94f0d2bf96ff97e1e702b5e
SSDEEP 3072:cYDDcDcDDDabOsHLhQfDUWG2r+4EjY9wS+YLsf/17Gq1K3y0/aIPHcXze:eisrGfDUFaFEE97Lsf/L0/aIvcXze
TLSH
T123C4437895CF54B5F6AF812979EC7EA601B331CB97C62E60436CE0504BE8F963E4588C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NodaTime.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\NodaTime.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\Shared.props
Size 144KB
SHA256 c687209c04f837006e4821132bd4a9be6ea8959049a76bf253fe456c2140c2bf
MD5 725025a7fd48f7cbef82db24dc0034db
SHA1 4a05f3db9c50c3012661a72dc3eb7f8c8163dec2
SHA512 03b55bda71055d5ee2adbf89f2d5a30ff1a84a5d2bbb943b519d3251e937a75aa33fe8421e63ff73c609cbc9efc749863cd6bc6787973caacb59b987a917a678
SSDEEP 1536:ofb/OmdRyRGby3awR5fZ2WWW2WWW2WWW2WWWDWZ7ebD0tLiM0hp:oWqRyQbgUOh
TLSH
T192E3B9643C28645E811DE2EDF14546F761D36BCFE0AA0BB9144BA0D13E5AEDEE78342C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dp0DBlecg.z20

Path C:\Users\Admin\AppData\Local\Temp\tmp-07614-HeIcdxoP1tC0\dp0DBlecg.z20
Size 1KB
SHA256 d2dba83cd0c29d497a5cbdc4e10e5ce778a919185e8462995dae52b4bda5f9ae
MD5 644b348dce3cdb407d24cd25797256fd
SHA1 08d6084a031b65b6b8ba113b1a024aae4c1744ab
SHA512 a7784430dd6699b13ca6e8f7ff3f0132af14250e11a4d527823906f02194b74fa009ed9203c09cda59bef35de8c0c854c979c81d3995b6a41d08623ffcb32c03
TLSH
T1FB31BB9675210449C4E1B2BB27B54333235EA2D33884F5BC70C8DDAC749F16FA6951E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1076-312-0x000001611B760000-0x000001611B850000-memory.dmp

Download

memory/1440-305-0x0000021519EB0000-0x0000021519FA0000-memory.dmp

Download

memory/1976-359-0x0000000000290000-0x00000000002D0000-memory.dmp

Download

memory/1976-360-0x00000000029B0000-0x00000000029CA000-memory.dmp

Download

memory/1976-361-0x0000000004EA0000-0x0000000004FFA000-memory.dmp

Download

memory/1976-362-0x0000000004DD0000-0x0000000004E00000-memory.dmp

Download

memory/1976-381-0x00000000079D0000-0x0000000007A52000-memory.dmp

Download

memory/1976-383-0x000000000F0B0000-0x000000000F5E2000-memory.dmp

Download

memory/3312-298-0x0000028E60540000-0x0000028E60630000-memory.dmp

Download

memory/3392-276-0x000002A45A790000-0x000002A45A842000-memory.dmp

Download

memory/3392-269-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-261-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-283-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-282-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-281-0x000002A45AAA0000-0x000002A45AB90000-memory.dmp

Download

memory/3392-278-0x000002A45AAD0000-0x000002A45AAFA000-memory.dmp

Download

memory/3392-264-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-265-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-266-0x000002A45A3A0000-0x000002A45A3C2000-memory.dmp

Download

memory/3392-267-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-268-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-270-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-271-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-272-0x00007FF8E7420000-0x00007FF8E7DC4000-memory.dmp

Download

memory/3392-279-0x000002A45AAD0000-0x000002A45AAF4000-memory.dmp

Download

memory/3392-277-0x000002A45A550000-0x000002A45A55A000-memory.dmp

Download

memory/3392-260-0x00007FF8E75AF000-0x00007FF8E75B0000-memory.dmp

Download

memory/3392-275-0x000002A45A770000-0x000002A45A78E000-memory.dmp

Download

memory/4380-319-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-320-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-321-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-323-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-324-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-322-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-315-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4380-313-0x000001D4B6020000-0x000001D4B6021000-memory.dmp

Download

memory/4480-291-0x000001D072350000-0x000001D072440000-memory.dmp

Download

memory/4480-289-0x000001D072140000-0x000001D0721F2000-memory.dmp

Download