25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe
Size 6.1MB
Sample260916-2e7j5afa84
SHA256 25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151
MD5 f54357a7d6eeb2ba66b237c9f1669090
SHA1 42e06c599907c74ac3c3c9ec1d11ea75840afb67
SHA512 efd6d9d63018fc88013d9605e9245934f58fe27f2c3d1e37aed2c0af62793f11d10f6ceeea0372244c5d45f4a06129b56b2311894fc88e4942e498333c880458
SSDEEP 196608:M+hBtOkv/ByQyVG/uzGNVyAl3K8fCGnbP3JzD:btOmNSG/lVrl3KExL3JzD
TLSH
T1AE56F12BB26901E8D1BFD17CC9165907EBB2780543A0A7CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
2960	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe

Executes dropped EXE 2 IoCs

pid	Process
2396	PeerService.exe
5696	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5884	tasklist.exe
448	tasklist.exe
1460	tasklist.exe
3024	tasklist.exe
868	tasklist.exe
2400	tasklist.exe
4676	tasklist.exe
2108	tasklist.exe
3584	tasklist.exe
1804	tasklist.exe
5228	tasklist.exe
3468	tasklist.exe
1460	tasklist.exe
4176	tasklist.exe
3512	tasklist.exe
5408	tasklist.exe
5540	tasklist.exe
1716	tasklist.exe
6044	tasklist.exe
308	tasklist.exe
3916	tasklist.exe
4412	tasklist.exe
3096	tasklist.exe
5112	tasklist.exe
2256	tasklist.exe
5816	tasklist.exe
4392	tasklist.exe
3636	tasklist.exe
2752	tasklist.exe
1668	tasklist.exe
2732	tasklist.exe
3052	tasklist.exe
2080	tasklist.exe
3988	tasklist.exe
3124	tasklist.exe
624	tasklist.exe
5224	tasklist.exe
3884	tasklist.exe
5816	tasklist.exe
5784	tasklist.exe
3804	tasklist.exe
5364	tasklist.exe
808	tasklist.exe
3188	tasklist.exe
4796	tasklist.exe
5152	tasklist.exe
5776	tasklist.exe
3960	tasklist.exe
2816	tasklist.exe
2416	tasklist.exe
4332	tasklist.exe
5240	tasklist.exe
5272	tasklist.exe
1080	tasklist.exe
4416	tasklist.exe
3588	tasklist.exe
464	tasklist.exe
4216	tasklist.exe
5228	tasklist.exe
4424	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5180	cmd.exe
5244	cmd.exe
884	cmd.exe
5448	cmd.exe
5004	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
3236	timeout.exe
5596	timeout.exe
4300	timeout.exe
2896	timeout.exe
2496	timeout.exe
3700	timeout.exe
1528	timeout.exe
1612	timeout.exe
4388	timeout.exe
3312	timeout.exe
5444	timeout.exe
3892	timeout.exe
2252	timeout.exe
4296	timeout.exe
4192	timeout.exe
5032	timeout.exe
3988	timeout.exe
4716	timeout.exe
5268	timeout.exe
1028	timeout.exe
5164	timeout.exe
4276	timeout.exe
1056	timeout.exe
3500	timeout.exe
1160	timeout.exe
3532	timeout.exe
5528	timeout.exe
4904	timeout.exe
6048	timeout.exe
5588	timeout.exe
4604	timeout.exe
4608	timeout.exe
3320	timeout.exe
3396	timeout.exe
5684	timeout.exe
1776	timeout.exe
5216	timeout.exe
6124	timeout.exe
3984	timeout.exe
368	timeout.exe
5224	timeout.exe
4772	timeout.exe
4280	timeout.exe
2884	timeout.exe
5332	timeout.exe
1496	timeout.exe
4160	timeout.exe
2988	timeout.exe
6016	timeout.exe
5232	timeout.exe
5780	timeout.exe
1280	timeout.exe
3500	timeout.exe
3232	timeout.exe
2332	timeout.exe
4088	timeout.exe
3780	timeout.exe
1352	timeout.exe
4240	timeout.exe
5100	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2944	powershell.exe
2944	powershell.exe
2960	powershell.exe
2960	powershell.exe
2944	powershell.exe
2960	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	tasklist.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	3468	tasklist.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	5240	tasklist.exe
Token: SeDebugPrivilege	5816	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	5272	tasklist.exe
Token: SeDebugPrivilege	308	tasklist.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	4392	tasklist.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe
Token: SeDebugPrivilege	3188	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	5228	tasklist.exe
Token: SeDebugPrivilege	624	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	2732	tasklist.exe
Token: SeDebugPrivilege	3096	tasklist.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	5816	tasklist.exe
Token: SeDebugPrivilege	3636	tasklist.exe
Token: SeDebugPrivilege	5784	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	5152	tasklist.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	3052	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	5540	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	868	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	5776	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	4416	tasklist.exe
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	464	tasklist.exe
Token: SeDebugPrivilege	3960	tasklist.exe
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4332	tasklist.exe
Token: SeDebugPrivilege	6044	tasklist.exe
Token: SeDebugPrivilege	5228	tasklist.exe
Token: SeDebugPrivilege	4676	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	5408	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	5364	tasklist.exe
Token: SeDebugPrivilege	3884	tasklist.exe
Token: SeDebugPrivilege	2108	tasklist.exe
Token: SeDebugPrivilege	3588	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 5180	4552	25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe	87
PID 5180 wrote to memory of 3496	5180	cmd.exe	89
PID 4552 wrote to memory of 2396	4552	25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe	92
PID 2396 wrote to memory of 5244	2396	PeerService.exe	97
PID 5696 wrote to memory of 884	5696	PeerService.exe	96
PID 2396 wrote to memory of 5448	2396	PeerService.exe	98
PID 5696 wrote to memory of 5004	5696	PeerService.exe	100
PID 5448 wrote to memory of 3584	5448	cmd.exe	106
PID 5244 wrote to memory of 2960	5244	cmd.exe	104
PID 884 wrote to memory of 2944	884	cmd.exe	105
PID 5004 wrote to memory of 3468	5004	cmd.exe	108
PID 5448 wrote to memory of 1752	5448	cmd.exe	109
PID 5004 wrote to memory of 1136	5004	cmd.exe	110
PID 5004 wrote to memory of 5032	5004	cmd.exe	113
PID 5448 wrote to memory of 3320	5448	cmd.exe	114
PID 5004 wrote to memory of 5240	5004	cmd.exe	115
PID 5004 wrote to memory of 2184	5004	cmd.exe	116
PID 5448 wrote to memory of 5816	5448	cmd.exe	117
PID 5448 wrote to memory of 3376	5448	cmd.exe	118
PID 5004 wrote to memory of 3780	5004	cmd.exe	119
PID 5448 wrote to memory of 2252	5448	cmd.exe	120
PID 5004 wrote to memory of 3988	5004	cmd.exe	121
PID 5004 wrote to memory of 2768	5004	cmd.exe	122
PID 5448 wrote to memory of 5112	5448	cmd.exe	123
PID 5448 wrote to memory of 2740	5448	cmd.exe	124
PID 5004 wrote to memory of 368	5004	cmd.exe	125
PID 5448 wrote to memory of 5596	5448	cmd.exe	126
PID 5004 wrote to memory of 5272	5004	cmd.exe	127
PID 5004 wrote to memory of 5152	5004	cmd.exe	128
PID 5448 wrote to memory of 308	5448	cmd.exe	129
PID 5448 wrote to memory of 212	5448	cmd.exe	130
PID 5004 wrote to memory of 3312	5004	cmd.exe	131
PID 5448 wrote to memory of 3532	5448	cmd.exe	132
PID 5004 wrote to memory of 3916	5004	cmd.exe	133
PID 5004 wrote to memory of 4560	5004	cmd.exe	134
PID 5448 wrote to memory of 1460	5448	cmd.exe	135
PID 5448 wrote to memory of 1244	5448	cmd.exe	136
PID 5004 wrote to memory of 3236	5004	cmd.exe	137
PID 5448 wrote to memory of 5232	5448	cmd.exe	138
PID 5004 wrote to memory of 808	5004	cmd.exe	140
PID 5004 wrote to memory of 1152	5004	cmd.exe	141
PID 5448 wrote to memory of 5884	5448	cmd.exe	142
PID 5448 wrote to memory of 5036	5448	cmd.exe	143
PID 5004 wrote to memory of 5332	5004	cmd.exe	144
PID 5448 wrote to memory of 5528	5448	cmd.exe	145
PID 5004 wrote to memory of 3124	5004	cmd.exe	146
PID 5004 wrote to memory of 1044	5004	cmd.exe	147
PID 5448 wrote to memory of 4176	5448	cmd.exe	148
PID 5448 wrote to memory of 4420	5448	cmd.exe	149
PID 5004 wrote to memory of 5224	5004	cmd.exe	150
PID 5448 wrote to memory of 4608	5448	cmd.exe	151
PID 5448 wrote to memory of 4392	5448	cmd.exe	152
PID 5448 wrote to memory of 4616	5448	cmd.exe	153
PID 5004 wrote to memory of 4412	5004	cmd.exe	154
PID 5004 wrote to memory of 4240	5004	cmd.exe	155
PID 5004 wrote to memory of 1496	5004	cmd.exe	156
PID 5448 wrote to memory of 4716	5448	cmd.exe	157
PID 5004 wrote to memory of 2256	5004	cmd.exe	158
PID 5004 wrote to memory of 1716	5004	cmd.exe	159
PID 5448 wrote to memory of 1804	5448	cmd.exe	160
PID 5448 wrote to memory of 4576	5448	cmd.exe	161
PID 5448 wrote to memory of 4904	5448	cmd.exe	162
PID 5004 wrote to memory of 5780	5004	cmd.exe	163
PID 5448 wrote to memory of 448	5448	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe
"C:\Users\Admin\AppData\Local\Temp\25a79a38b1a25ac7bb2678865f628fb2bb9984449674781cbbce4ea7c4fa6151.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3496
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3584
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1752
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5112
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2740
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1244
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4616
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1804
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4576
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:448
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2308
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:628
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3096
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5576
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1080
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:980
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3892
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5816
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3396
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5784
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:904
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5152
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:320
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5540
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1132
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:464
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3960
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3520
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2400
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5900
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5228
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5044
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1668
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2380
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5372
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1556
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3500

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1136
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2184
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2768
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:368
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4560
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1152
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5332
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:4412
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1716
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5072
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3700
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:6044
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5692
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5268
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2512
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5384
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2904
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2468
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:976
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:5160
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2496
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:548
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4140
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1036
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2884
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5364
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4888
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4972
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 4211b5503de68413f5605cbeec4a49fb46fbec44c58df95be892f0dc308a39cf
MD5 a15743cd087226baafa094c9aed07dc4
SHA1 2124cf2ac13da80b2e3cd37d3eab477261771423
SHA512 301e82e45c3e190bdbc1316cda1cd735434c5aa873a57322e807c7cf4c23e006e11a7347ebb0f8afed181d3a4d860202cbd6fc721b9970296c7a4b1a367805a7
TLSH
T11E112223F38C8920CC96163A509DAC6172B586CB81AEDF9F7FC0C210A5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t424ymgc.jbb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t424ymgc.jbb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 11.0MB
SHA256 5e5c125297492a717bd93582cb984f7259ddb14f3815a0d7912a4a251f8a7178
MD5 767d742e63294534c54eeaf6f9eeb48a
SHA1 c31af6e55ab4a3b347b972aa735eb022d0265001
SHA512 9fc71bb37ddabf9bc2df4e550ebe9715396d87580037502d516770c22714eba071c63dec140501c18e652da73e54965558b098e8dfaf194b06354fc7a9ee009b
SSDEEP 196608:M+hBtOkv/ByQyVG/uzGNVyAl3K8fCGnbP3JzTByQyVG/uzGNVyAl3K8fCGnbP3Jf:btOmNSG/lVrl3KExL3JzVNSG/lVrl3KS
TLSH
T17AC6126BB26901E8E1BFD17CC9065907FBB2780543A096DF12E046A62F73BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-31-0x000001D6CA020000-0x000001D6CA042000-memory.dmp

Download

memory/2944-43-0x000001D6E4BE0000-0x000001D6E4DFC000-memory.dmp

Download

memory/2960-39-0x000001D33A5E0000-0x000001D33A7FC000-memory.dmp

Download