b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fakemas.ps1
Size 3KB
Sample260913-3khnmashla
SHA256 b2bdb2a4e93fb7d4e2d6f87fc27e8016f64b31a53d373bf34c1ceeec02875041
MD5 388636d04a2e5f85c93f67db34fd7722
SHA1 18347b54073f7d63bd85553d29e3751918c61ea3
SHA512 d7fa38ac092b1ecb642f9c15462479b8e3b73fae78fb1654ee0b3794947c7eac8eb929038af3e720251b4dddc92172e3f0643216f976123030880bbfad91e8de
TLSH
T1C461A85AB7D0E2B18AB31919CCC5A795643B407221135610B2BD87547F9CD9FC7A33CA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3392	PowerShell.exe
4	3392	PowerShell.exe
5	3392	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer\__main__.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\_ssl.pyd	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\SysMon.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests\packages.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\psutil\tests\test_connections.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\charset_normalizer-3.3.2.dist-info\INSTALLER	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests-2.31.0.dist-info\RECORD	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\requests\cookies.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\psutil\_psosx.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\idna-3.6.dist-info\WHEEL	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\idna-3.6.dist-info\LICENSE.md	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\idna\package_data.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\certifi-2024.2.2.dist-info\WHEEL	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\_asyncio.pyd	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3-2.2.1.dist-info\WHEEL	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3\contrib\emscripten\connection.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3\exceptions.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\pyarmor_runtime_000000\__init__.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\psutil\tests\test_linux.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\psutil\_psbsd.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\charset_normalizer\md.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\LICENSE.txt	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3\contrib\socks.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\idna-3.6.dist-info\METADATA	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer-3.3.2.dist-info\RECORD	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\libffi-8.dll	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3\contrib\emscripten\response.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3\_collections.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests\compat.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\_decimal.pyd	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\sqlite3.dll	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests-2.31.0.dist-info\LICENSE	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\certifi-2024.2.2.dist-info\LICENSE	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\winsound.pyd	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\unicodedata.pyd	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3-2.2.1.dist-info\licenses\LICENSE.txt	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3\util\url.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3\contrib\emscripten\emscripten_fetch_worker.js	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3\_request_methods.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests-2.31.0.dist-info\INSTALLER	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\requests\structures.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests\help.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\requests\exceptions.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\urllib3\util\util.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\requests\utils.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\idna\__init__.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer-3.3.2.dist-info\WHEEL	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer\legacy.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\_ssl.pyd	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\_lzma.pyd	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\_decimal.pyd	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\psutil\tests\test_misc.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\psutil\tests\test_connections.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\psutil\_psposix.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\certifi\__init__.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\_ctypes.pyd	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\python311.zip	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\python.exe	PowerShell.exe
File created	C:\Windows\SystemHealth\Update.zip	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\urllib3\exceptions.py	PowerShell.exe
File created	C:\Windows\SystemHealth\Update\requests\packages.py	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\psutil-5.9.8.dist-info\WHEEL	PowerShell.exe
File opened for modification	C:\Windows\SystemHealth\Update\charset_normalizer-3.3.2.dist-info\entry_points.txt	PowerShell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5364	sc.exe
252	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3392	PowerShell.exe

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2284	cmd.exe
3424	cmd.exe
4536	cmd.exe
5732	cmd.exe
4820	cmd.exe
1416	cmd.exe
1540	cmd.exe
3412	cmd.exe
2788	cmd.exe
4948	cmd.exe
564	cmd.exe
1892	cmd.exe
4980	cmd.exe
2804	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2804	cmd.exe
1600	PING.EXE
4820	cmd.exe
3092	PING.EXE

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3824	reg.exe
1104	reg.exe
5060	reg.exe
5552	reg.exe
2588	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1600	PING.EXE
3092	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3392	PowerShell.exe
3392	PowerShell.exe
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3392	PowerShell.exe
Token: SeSecurityPrivilege	3392	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3392	PowerShell.exe
Token: SeLoadDriverPrivilege	3392	PowerShell.exe
Token: SeSystemProfilePrivilege	3392	PowerShell.exe
Token: SeSystemtimePrivilege	3392	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3392	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3392	PowerShell.exe
Token: SeCreatePagefilePrivilege	3392	PowerShell.exe
Token: SeBackupPrivilege	3392	PowerShell.exe
Token: SeRestorePrivilege	3392	PowerShell.exe
Token: SeShutdownPrivilege	3392	PowerShell.exe
Token: SeDebugPrivilege	3392	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3392	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3392	PowerShell.exe
Token: SeUndockPrivilege	3392	PowerShell.exe
Token: SeManageVolumePrivilege	3392	PowerShell.exe
Token: 33	3392	PowerShell.exe
Token: 34	3392	PowerShell.exe
Token: 35	3392	PowerShell.exe
Token: 36	3392	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3392	PowerShell.exe
Token: SeSecurityPrivilege	3392	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3392	PowerShell.exe
Token: SeLoadDriverPrivilege	3392	PowerShell.exe
Token: SeSystemProfilePrivilege	3392	PowerShell.exe
Token: SeSystemtimePrivilege	3392	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3392	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3392	PowerShell.exe
Token: SeCreatePagefilePrivilege	3392	PowerShell.exe
Token: SeBackupPrivilege	3392	PowerShell.exe
Token: SeRestorePrivilege	3392	PowerShell.exe
Token: SeShutdownPrivilege	3392	PowerShell.exe
Token: SeDebugPrivilege	3392	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3392	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3392	PowerShell.exe
Token: SeUndockPrivilege	3392	PowerShell.exe
Token: SeManageVolumePrivilege	3392	PowerShell.exe
Token: 33	3392	PowerShell.exe
Token: 34	3392	PowerShell.exe
Token: 35	3392	PowerShell.exe
Token: 36	3392	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3392	PowerShell.exe
Token: SeSecurityPrivilege	3392	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3392	PowerShell.exe
Token: SeLoadDriverPrivilege	3392	PowerShell.exe
Token: SeSystemProfilePrivilege	3392	PowerShell.exe
Token: SeSystemtimePrivilege	3392	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3392	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3392	PowerShell.exe
Token: SeCreatePagefilePrivilege	3392	PowerShell.exe
Token: SeBackupPrivilege	3392	PowerShell.exe
Token: SeRestorePrivilege	3392	PowerShell.exe
Token: SeShutdownPrivilege	3392	PowerShell.exe
Token: SeDebugPrivilege	3392	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3392	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3392	PowerShell.exe
Token: SeUndockPrivilege	3392	PowerShell.exe
Token: SeManageVolumePrivilege	3392	PowerShell.exe
Token: 33	3392	PowerShell.exe
Token: 34	3392	PowerShell.exe
Token: 35	3392	PowerShell.exe
Token: 36	3392	PowerShell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4672	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4660	3392	PowerShell.exe	88
PID 4660 wrote to memory of 1520	4660	csc.exe	89
PID 3392 wrote to memory of 2884	3392	PowerShell.exe	90
PID 4672 wrote to memory of 3296	4672	conhost.exe	93
PID 3392 wrote to memory of 1540	3392	PowerShell.exe	95
PID 3392 wrote to memory of 3412	3392	PowerShell.exe	96
PID 3412 wrote to memory of 5364	3412	cmd.exe	98
PID 3412 wrote to memory of 5392	3412	cmd.exe	99
PID 3412 wrote to memory of 5040	3412	cmd.exe	100
PID 3412 wrote to memory of 1948	3412	cmd.exe	101
PID 3412 wrote to memory of 2332	3412	cmd.exe	102
PID 3412 wrote to memory of 2284	3412	cmd.exe	103
PID 3412 wrote to memory of 5100	3412	cmd.exe	104
PID 3412 wrote to memory of 4852	3412	cmd.exe	105
PID 3412 wrote to memory of 4984	3412	cmd.exe	106
PID 3412 wrote to memory of 1100	3412	cmd.exe	107
PID 3412 wrote to memory of 2788	3412	cmd.exe	108
PID 2788 wrote to memory of 2672	2788	cmd.exe	109
PID 2788 wrote to memory of 2448	2788	cmd.exe	110
PID 3412 wrote to memory of 4252	3412	cmd.exe	111
PID 3412 wrote to memory of 2000	3412	cmd.exe	112
PID 3412 wrote to memory of 1844	3412	cmd.exe	113
PID 3412 wrote to memory of 4948	3412	cmd.exe	114
PID 4948 wrote to memory of 5064	4948	cmd.exe	115
PID 3412 wrote to memory of 3424	3412	cmd.exe	116
PID 3424 wrote to memory of 2808	3424	cmd.exe	117
PID 3412 wrote to memory of 3824	3412	cmd.exe	118
PID 3412 wrote to memory of 2128	3412	cmd.exe	119
PID 3412 wrote to memory of 1104	3412	cmd.exe	120
PID 3412 wrote to memory of 564	3412	cmd.exe	121
PID 3412 wrote to memory of 5060	3412	cmd.exe	122
PID 564 wrote to memory of 252	564	cmd.exe	125
PID 564 wrote to memory of 248	564	cmd.exe	126
PID 564 wrote to memory of 3696	564	cmd.exe	127
PID 564 wrote to memory of 5680	564	cmd.exe	128
PID 564 wrote to memory of 4944	564	cmd.exe	129
PID 564 wrote to memory of 1892	564	cmd.exe	130
PID 564 wrote to memory of 2676	564	cmd.exe	131
PID 564 wrote to memory of 1228	564	cmd.exe	132
PID 564 wrote to memory of 6036	564	cmd.exe	133
PID 564 wrote to memory of 3260	564	cmd.exe	134
PID 564 wrote to memory of 4536	564	cmd.exe	135
PID 4536 wrote to memory of 2044	4536	cmd.exe	136
PID 4536 wrote to memory of 2152	4536	cmd.exe	137
PID 564 wrote to memory of 2492	564	cmd.exe	138
PID 564 wrote to memory of 2648	564	cmd.exe	139
PID 564 wrote to memory of 3848	564	cmd.exe	140
PID 564 wrote to memory of 5732	564	cmd.exe	141
PID 5732 wrote to memory of 1308	5732	cmd.exe	142
PID 564 wrote to memory of 4980	564	cmd.exe	143
PID 4980 wrote to memory of 5976	4980	cmd.exe	144
PID 564 wrote to memory of 2804	564	cmd.exe	145
PID 2804 wrote to memory of 1600	2804	cmd.exe	146
PID 564 wrote to memory of 4820	564	cmd.exe	147
PID 4820 wrote to memory of 3092	4820	cmd.exe	148
PID 564 wrote to memory of 4700	564	cmd.exe	149
PID 564 wrote to memory of 5900	564	cmd.exe	150
PID 564 wrote to memory of 988	564	cmd.exe	151
PID 564 wrote to memory of 1388	564	cmd.exe	152
PID 564 wrote to memory of 1416	564	cmd.exe	153
PID 1416 wrote to memory of 4804	1416	cmd.exe	154
PID 564 wrote to memory of 1544	564	cmd.exe	155
PID 564 wrote to memory of 5552	564	cmd.exe	156
PID 564 wrote to memory of 6064	564	cmd.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fakemas.ps1
1⤵
- Badlisted process makes network request
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqxanmim\xqxanmim.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2939.tmp" "c:\Users\Admin\AppData\Local\Temp\xqxanmim\CSC81E34B62E333444081C83EEC62BAA39.TMP"
    3⤵
    PID:1520
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn SysCheck2 /tr "conhost.exe --headless cmd /c cd /d C:\Windows\SystemHealth\Update && python.exe SysMon.py" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2884
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  - Executes a command shell one-liner
  PID:1540
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd" -el "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:5364
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5392
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd"
    3⤵
    PID:5040
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:1948
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:2332
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2284
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5100
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4852
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4984
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:1100
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:2672
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:2448
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd" "
    3⤵
    PID:4252
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2000
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:1844
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5064
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:2808
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:3824
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:2128
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:1104
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd" -el -qedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:252
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:248
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd"
      4⤵
      PID:3696
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:5680
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:4944
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:1892
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:2676
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:1228
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:6036
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:3260
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:2044
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:2152
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd" "
      4⤵
      PID:2492
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:2648
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:3848
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1308
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:5976
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3092
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4700
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:5900
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:988
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:1388
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:4804
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:1544
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5552
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:6064
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:2588
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5956
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:5048
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5060

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES2939.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2939.tmp
Size 1KB
SHA256 bb611ef2f677bb160708a3a7e5d0651ae6453f93a7ecfcc1528ad81ffe5e2188
MD5 01fb676f74344e57f3563a232d80d0e1
SHA1 517be5d98af6cb58c1e5d5e52f8f35396d6389b5
SHA512 e8733720a3cdc4f06396a39fccf16a356d27ebfe19380db95a9fc7665e70dd31dc44b26181b7a2dc74a887f3aa8936fc12d3fd35b592c4fb7b6b4a5ed7938b8d
TLSH
T10C21890593ED871EF0774B32A9F6572FA279FE54EFA2A75A8440022D2C41144EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t5h5ibrs.x34.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t5h5ibrs.x34.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xqxanmim.dll

Path C:\Users\Admin\AppData\Local\Temp\xqxanmim\xqxanmim.dll
Size 3KB
SHA256 07e1d0f8d2837b308301b0d55f4360c133ff4f34d72ea05ad5d54cda838a6460
MD5 73e89bbbd629ffec2c35b663ea5e73e3
SHA1 b9430708660e7c5ab8a21353aa2ffdaca94f4d85
SHA512 6bddbcf15ffc73c60f605bc9ba89943c2350eade312b49a6bbff72c4cffcb1ee45b012c7c68d821ec2cef61df9079144be6f7e6cd5cd787599705c70a0b148db
TLSH
T18451C916A7F94A6BE4770B35ADF3471737B8FC509B72632E58800218ACA53645E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Windows\SystemHealth\Update\psutil-5.9.8.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd

Path C:\Windows\Temp\MAS_e28e9f1a-4586-4923-b7bf-3d15246f2c28.cmd
Size 744KB
SHA256 84fd86d83f37d0243c679d52c254a8b7d11a5986e716ed3f426fc70336f099f8
MD5 8f561656fe2fef2625dc4af8df3b40fc
SHA1 1b9ef8711fd8d17e18d95546276d5384c60b3c1a
SHA512 82bd4b43313299b6e168788b073dbcd981cc1cf98fbd8f4abcd7430982bea3c344697c9e9d4bb41ac3ef400fe0b7503ffd08664e35edbccc9894df4c159f6cd9
SSDEEP 6144:m3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Au2:m3IuuhcEvTGGOEmcAXz0ykw7g
TLSH
T11AF41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC81E34B62E333444081C83EEC62BAA39.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xqxanmim\CSC81E34B62E333444081C83EEC62BAA39.TMP
Size 652B
SHA256 ead8c0c941bd8a8b93bbbe0db2629d484c705dfbf409ea2f06299dd1eea07e7c
MD5 11ad4d4b58efb50a087a8bed4f4870d9
SHA1 36e2c257cccc96f186a1627387b69cb9b79648cb
SHA512 7a2247552479fd37d47fbf3c8d92f5a7515b578fb5ec451cba324ae7e1ac3ed26a209e812ff25aaf1a9bb8dd248f75c26feb44350427bc7bb8f21fba0f8853d1
TLSH
T158F09A0A67FC520EF0F34B30B9F2836790A9BC60DE7293ED1450031D28215109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xqxanmim.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xqxanmim\xqxanmim.0.cs
Size 291B
SHA256 f474479ebe51c16859553b4f871f2ac58012d6ddcdbb6593fbc9a6be3345fa76
MD5 8e748907be602c9282ec791eb1029847
SHA1 8b5930eaf7d3fee3eff5aea3125122f8a3f7be49
SHA512 ca5915d6eb1101947978afc9921d74a2994db2dc0854ed4e848ca18c84b4f5abec572fb89124480cf14ed8c5380b82dfff0e54d17f0e57f6d3d0e9c74e2d66ef
TLSH
T1C2D0C214AAB2EAB04033841A8C8BD0BEB70BA467266A19007AA51310EF8B00A8225A56
MD5 SHA1 SHA512 TLSH

Submit Download

xqxanmim.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xqxanmim\xqxanmim.cmdline
Size 369B
SHA256 512a2a276cc6199a08683cad1b83cb46faf880fbb10402aa58bed4a9502e2916
MD5 310c54358a75706ad45bffd9b38bd1f7
SHA1 9299a310280e99e5a3ba13dbcd80fbdf5b8a54dd
SHA512 d7ee07a62fc9a67d5f73c1fa0ec039cf376cec6bf58e44acfb44eabb17c9b4bac21444a05282ee3c72a17c6f74f8804e1b8096068c63d01343bc0de5eed86799
TLSH
T140E0202A6257CA7D15DD111F217BD5AEC2720BC72E817F8471A0485ED02B30477D1795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3392-32-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-56-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-21-0x0000022F99360000-0x0000022F99368000-memory.dmp

Download

memory/3392-22-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-7-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-23-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-27-0x0000022FB1890000-0x0000022FB18AE000-memory.dmp

Download

memory/3392-28-0x0000022FB1D30000-0x0000022FB1DE2000-memory.dmp

Download

memory/3392-29-0x0000022FB18B0000-0x0000022FB18BA000-memory.dmp

Download

memory/3392-30-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-31-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-0-0x00007FFB2F65F000-0x00007FFB2F660000-memory.dmp

Download

memory/3392-33-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-35-0x0000022FB1890000-0x0000022FB189A000-memory.dmp

Download

memory/3392-34-0x0000022FB18A0000-0x0000022FB18B2000-memory.dmp

Download

memory/3392-8-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-57-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-80-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-81-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-6-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-289-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-314-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-347-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-5-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-414-0x0000022FB1E10000-0x0000022FB1E2E000-memory.dmp

Download

memory/3392-413-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-415-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-417-0x0000022FB23E0000-0x0000022FB25A2000-memory.dmp

Download

memory/3392-2-0x0000022F99370000-0x0000022F99392000-memory.dmp

Download

memory/3392-1-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-427-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/3392-428-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download