4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe
Size 5.1MB
Sample260910-v5xdhstanf
SHA256 4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c
MD5 358e71a7fb29986ee8a8cce29fafe45b
SHA1 983cd19d05143bf744ba17fa27d64ba16d2e5560
SHA512 b9b1cf671d3f8f6fa689bc1bd6924ef455420645ed1f60dcd4381999f883ad3705b39bb414421535e593879325e9f11f26302c3f6d66371d8da44def7c7a8590
SSDEEP 98304:++hxpLJlKkhoWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQd:++hx9ekhByQyVG/uzGNVyAl3K8fCGd
TLSH
T12D36E16B726901E8E1BFD17CC9065907EBB2780543A0A7CF12E056A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
928	powershell.exe
4836	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe

Executes dropped EXE 2 IoCs

pid	Process
1224	PeerService.exe
4464	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1852	tasklist.exe
4864	tasklist.exe
1120	tasklist.exe
3572	tasklist.exe
3944	tasklist.exe
792	tasklist.exe
3244	tasklist.exe
4648	tasklist.exe
928	tasklist.exe
3448	tasklist.exe
4492	tasklist.exe
2032	tasklist.exe
1180	tasklist.exe
1144	tasklist.exe
5076	tasklist.exe
4648	tasklist.exe
4632	tasklist.exe
2816	tasklist.exe
2424	tasklist.exe
3860	tasklist.exe
2564	tasklist.exe
2496	tasklist.exe
3412	tasklist.exe
740	tasklist.exe
3744	tasklist.exe
1920	tasklist.exe
2728	tasklist.exe
2260	tasklist.exe
2836	tasklist.exe
1780	tasklist.exe
1860	tasklist.exe
2372	tasklist.exe
3796	tasklist.exe
4184	tasklist.exe
2064	tasklist.exe
1912	tasklist.exe
2420	tasklist.exe
2260	tasklist.exe
3964	tasklist.exe
3724	tasklist.exe
1676	tasklist.exe
3156	tasklist.exe
4148	tasklist.exe
3684	tasklist.exe
2648	tasklist.exe
4356	tasklist.exe
452	tasklist.exe
4744	tasklist.exe
2972	tasklist.exe
3120	tasklist.exe
976	tasklist.exe
3212	tasklist.exe
2732	tasklist.exe
2284	tasklist.exe
2288	tasklist.exe
1648	tasklist.exe
4304	tasklist.exe
2284	tasklist.exe
4360	tasklist.exe
624	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3548	cmd.exe
3040	cmd.exe
3916	cmd.exe
4976	cmd.exe
3644	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
1992	timeout.exe
4876	timeout.exe
2016	timeout.exe
1700	timeout.exe
3424	timeout.exe
3100	timeout.exe
4208	timeout.exe
208	timeout.exe
4656	timeout.exe
4984	timeout.exe
2544	timeout.exe
1744	timeout.exe
100	timeout.exe
3892	timeout.exe
852	timeout.exe
972	timeout.exe
1680	timeout.exe
3052	timeout.exe
1860	timeout.exe
4456	timeout.exe
3452	timeout.exe
3592	timeout.exe
1232	timeout.exe
4260	timeout.exe
4048	timeout.exe
988	timeout.exe
4284	timeout.exe
4272	timeout.exe
3212	timeout.exe
4412	timeout.exe
3856	timeout.exe
4100	timeout.exe
216	timeout.exe
2404	timeout.exe
2276	timeout.exe
3468	timeout.exe
4260	timeout.exe
3768	timeout.exe
1280	timeout.exe
4856	timeout.exe
3572	timeout.exe
792	timeout.exe
2736	timeout.exe
3476	timeout.exe
3212	timeout.exe
1788	timeout.exe
5084	timeout.exe
832	timeout.exe
4364	timeout.exe
1748	timeout.exe
4356	timeout.exe
436	timeout.exe
4456	timeout.exe
1636	timeout.exe
1968	timeout.exe
2636	timeout.exe
4624	timeout.exe
2764	timeout.exe
4588	timeout.exe
3024	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
928	powershell.exe
928	powershell.exe
928	powershell.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	2648	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	740	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	3744	tasklist.exe
Token: SeDebugPrivilege	3860	tasklist.exe
Token: SeDebugPrivilege	1920	tasklist.exe
Token: SeDebugPrivilege	2728	tasklist.exe
Token: SeDebugPrivilege	3120	tasklist.exe
Token: SeDebugPrivilege	1912	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	2732	tasklist.exe
Token: SeDebugPrivilege	3724	tasklist.exe
Token: SeDebugPrivilege	4360	tasklist.exe
Token: SeDebugPrivilege	3796	tasklist.exe
Token: SeDebugPrivilege	3244	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	928	tasklist.exe
Token: SeDebugPrivilege	1676	tasklist.exe
Token: SeDebugPrivilege	2420	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	3156	tasklist.exe
Token: SeDebugPrivilege	4148	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	2372	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	4184	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	624	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	3572	tasklist.exe
Token: SeDebugPrivilege	452	tasklist.exe
Token: SeDebugPrivilege	1780	tasklist.exe
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	4492	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	2564	tasklist.exe
Token: SeDebugPrivilege	792	tasklist.exe
Token: SeDebugPrivilege	2496	tasklist.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	3684	tasklist.exe
Token: SeDebugPrivilege	1648	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3548	4244	4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe	85
PID 3548 wrote to memory of 2912	3548	cmd.exe	87
PID 4244 wrote to memory of 1224	4244	4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe	88
PID 1224 wrote to memory of 3916	1224	PeerService.exe	91
PID 1224 wrote to memory of 3040	1224	PeerService.exe	92
PID 3916 wrote to memory of 928	3916	cmd.exe	96
PID 3040 wrote to memory of 4864	3040	cmd.exe	97
PID 3040 wrote to memory of 4404	3040	cmd.exe	98
PID 4464 wrote to memory of 3644	4464	PeerService.exe	100
PID 4464 wrote to memory of 4976	4464	PeerService.exe	101
PID 4976 wrote to memory of 1180	4976	cmd.exe	105
PID 4976 wrote to memory of 3160	4976	cmd.exe	106
PID 3644 wrote to memory of 4836	3644	cmd.exe	107
PID 3040 wrote to memory of 2276	3040	cmd.exe	108
PID 4976 wrote to memory of 1788	4976	cmd.exe	109
PID 4976 wrote to memory of 2648	4976	cmd.exe	115
PID 4976 wrote to memory of 3156	4976	cmd.exe	116
PID 3040 wrote to memory of 1144	3040	cmd.exe	117
PID 3040 wrote to memory of 4900	3040	cmd.exe	118
PID 4976 wrote to memory of 4208	4976	cmd.exe	119
PID 3040 wrote to memory of 4856	3040	cmd.exe	120
PID 3040 wrote to memory of 740	3040	cmd.exe	126
PID 3040 wrote to memory of 2064	3040	cmd.exe	127
PID 4976 wrote to memory of 4632	4976	cmd.exe	128
PID 4976 wrote to memory of 4148	4976	cmd.exe	129
PID 3040 wrote to memory of 4356	3040	cmd.exe	130
PID 4976 wrote to memory of 208	4976	cmd.exe	131
PID 4976 wrote to memory of 2816	4976	cmd.exe	134
PID 3040 wrote to memory of 1860	3040	cmd.exe	135
PID 4976 wrote to memory of 2832	4976	cmd.exe	136
PID 3040 wrote to memory of 3116	3040	cmd.exe	137
PID 3040 wrote to memory of 4284	3040	cmd.exe	138
PID 4976 wrote to memory of 3572	4976	cmd.exe	139
PID 3040 wrote to memory of 3860	3040	cmd.exe	146
PID 4976 wrote to memory of 3744	4976	cmd.exe	147
PID 3040 wrote to memory of 644	3040	cmd.exe	148
PID 4976 wrote to memory of 3764	4976	cmd.exe	149
PID 3040 wrote to memory of 4100	3040	cmd.exe	150
PID 4976 wrote to memory of 1636	4976	cmd.exe	151
PID 4976 wrote to memory of 1920	4976	cmd.exe	152
PID 4976 wrote to memory of 2344	4976	cmd.exe	153
PID 3040 wrote to memory of 2728	3040	cmd.exe	154
PID 3040 wrote to memory of 3468	3040	cmd.exe	155
PID 4976 wrote to memory of 4272	4976	cmd.exe	156
PID 3040 wrote to memory of 5084	3040	cmd.exe	157
PID 4976 wrote to memory of 3120	4976	cmd.exe	161
PID 4976 wrote to memory of 2676	4976	cmd.exe	162
PID 3040 wrote to memory of 1912	3040	cmd.exe	163
PID 3040 wrote to memory of 216	3040	cmd.exe	164
PID 4976 wrote to memory of 3452	4976	cmd.exe	165
PID 3040 wrote to memory of 1968	3040	cmd.exe	166
PID 4976 wrote to memory of 2284	4976	cmd.exe	167
PID 4976 wrote to memory of 1700	4976	cmd.exe	168
PID 3040 wrote to memory of 2260	3040	cmd.exe	169
PID 3040 wrote to memory of 3060	3040	cmd.exe	170
PID 4976 wrote to memory of 1992	4976	cmd.exe	171
PID 3040 wrote to memory of 792	3040	cmd.exe	172
PID 4976 wrote to memory of 2836	4976	cmd.exe	173
PID 4976 wrote to memory of 2408	4976	cmd.exe	174
PID 3040 wrote to memory of 2732	3040	cmd.exe	175
PID 3040 wrote to memory of 4144	3040	cmd.exe	176
PID 3040 wrote to memory of 4656	3040	cmd.exe	177
PID 4976 wrote to memory of 2636	4976	cmd.exe	178
PID 3040 wrote to memory of 3724	3040	cmd.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe
"C:\Users\Admin\AppData\Local\Temp\4e6d689371ab0c746f81074f121a0eb2573f038e94b8af9d0b2345f8a378d17c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2912
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4864
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4404
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1144
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:740
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2064
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3116
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:644
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2728
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3468
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:216
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2732
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4144
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1360
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:928
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2856
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3480
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3444
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:976
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:972
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4148
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2344
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2372
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4184
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4968
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1176
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:624
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4284
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:260
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3944
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2356
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3504
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2436
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4744
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3988
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2564
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3480
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3964
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1648
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3100

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3160
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1788
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3156
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4148
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2832
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2344
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4544
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2772
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4876
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2936
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4624
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4676
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4964
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1280
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1112
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3052
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3060
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2404
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4900
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3764
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4752
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3804
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1268
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3892
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1968
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4728
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3236
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3000
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1848
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26
MD5 029fbf628b046653ab7ff10b31deeeb2
SHA1 93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c
SHA512 d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c
TLSH
T192112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r5ukvswd.fo0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5ukvswd.fo0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.1MB
SHA256 e5e910f260790f6ce55cd06e1c60f908855e43884bffe42d776f4c0e77182f9c
MD5 a337294413ae1150fc78f2aa58c87fc9
SHA1 c0ec665a8833579090e32911126503e13d227b8d
SHA512 5e3f0895bab1c3cefac940dde54d2cf71fce9116ba2ddac12957969937da2fd03a3b09425589d3ff42c3558fb6d8c608cd4f26db92e08811c220a1cb054ad0fc
SSDEEP 196608:++hx9ekhByQyVG/uzGNVyAl3K8fCGhByQyVG/S:h9eENSG/lVrl3KEJNSG/S
TLSH
T10756F16B726901E8D1BFD17CCA065907EBB2780543A0A7DF12E046A62F77AE14F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-29-0x000001A5DA1A0000-0x000001A5DA1C2000-memory.dmp

Download