72b7a703f948913f8ad8ef8156c47cc242134e965d6ea623ec376d6036fa4a73

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SignedShippingDetails220926_PDF.js
Size 954KB
Sample260922-ryptbasv7n
SHA256 72b7a703f948913f8ad8ef8156c47cc242134e965d6ea623ec376d6036fa4a73
MD5 2bf25aec4a8bf7dc43238f0900c84692
SHA1 ccf9cb199123284d0d15b729610b20474df44bb3
SHA512 63692ef5c40ed1896912750385e56e92bbacd9858659f80d8ba6f816d70511b64e34c2c5611c8ae7961bbc03f722f33eef1d69d1dec7170c5e03f2579d73ca09
SSDEEP 24576:kqCLR/0VSnn1wm0Csg5QncLHNtfBPXtxGs:DC99nxvt9
TLSH
T1BB25F1B8F91E65B542BFFB3EAB1BAD65177636E2120DE51D80981FA9C3813C4D9E4C00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence

Malware Config

Signatures

Detected Nirsoft tools 6 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3624-116-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4608-118-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/5980-120-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3692-149-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/5428-154-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/5304-150-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5980-120-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/5304-150-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3624-116-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3692-149-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	choice.exe

Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompatCatalog_LYMB = "C:\\Windows\\System32\\conhost.exe --headless -- C:\\Windows\\System32\\cmd.exe /c call \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\iconcache_idx\\iconcache_idx_KHJAQVGYh.cmd\""	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4332	cmd.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 3624	1372	choice.exe	104
PID 1372 set thread context of 5980	1372	choice.exe	105
PID 1372 set thread context of 4608	1372	choice.exe	106
PID 1372 set thread context of 3580	1372	choice.exe	110
PID 1372 set thread context of 5252	1372	choice.exe	111
PID 1372 set thread context of 4780	1372	choice.exe	112
PID 1372 set thread context of 3828	1372	choice.exe	115
PID 1372 set thread context of 2860	1372	choice.exe	116
PID 1372 set thread context of 3396	1372	choice.exe	117
PID 1372 set thread context of 3692	1372	choice.exe	123
PID 1372 set thread context of 5304	1372	choice.exe	125
PID 1372 set thread context of 5428	1372	choice.exe	126

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6056	powershell.exe
3048	powershell.exe
2652	powershell.exe
4328	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5552	3624	WerFault.exe	104
3596	3580	WerFault.exe	110
1684	3828	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4196	wscript.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
6056	powershell.exe
6056	powershell.exe
3048	powershell.exe
3048	powershell.exe
2652	powershell.exe
2652	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
3624	choice.exe
3624	choice.exe
4608	choice.exe
4608	choice.exe
3580	choice.exe
3580	choice.exe
4780	choice.exe
4780	choice.exe
3828	choice.exe
3828	choice.exe
3396	choice.exe
3396	choice.exe
4328	powershell.exe
3692	choice.exe
3692	choice.exe
5428	choice.exe
5428	choice.exe
3692	choice.exe
3692	choice.exe

Suspicious behavior: MapViewOfSection 17 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe
1372	choice.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4608	choice.exe
Token: SeDebugPrivilege	4780	choice.exe
Token: SeDebugPrivilege	3396	choice.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe
Token: SeUndockPrivilege	4328	powershell.exe
Token: SeManageVolumePrivilege	4328	powershell.exe
Token: 33	4328	powershell.exe
Token: 34	4328	powershell.exe
Token: 35	4328	powershell.exe
Token: 36	4328	powershell.exe
Token: SeIncreaseQuotaPrivilege	4328	powershell.exe
Token: SeSecurityPrivilege	4328	powershell.exe
Token: SeTakeOwnershipPrivilege	4328	powershell.exe
Token: SeLoadDriverPrivilege	4328	powershell.exe
Token: SeSystemProfilePrivilege	4328	powershell.exe
Token: SeSystemtimePrivilege	4328	powershell.exe
Token: SeProfSingleProcessPrivilege	4328	powershell.exe
Token: SeIncBasePriorityPrivilege	4328	powershell.exe
Token: SeCreatePagefilePrivilege	4328	powershell.exe
Token: SeBackupPrivilege	4328	powershell.exe
Token: SeRestorePrivilege	4328	powershell.exe
Token: SeShutdownPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeSystemEnvironmentPrivilege	4328	powershell.exe
Token: SeRemoteShutdownPrivilege	4328	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 6056	4196	wscript.exe	89
PID 4196 wrote to memory of 4332	4196	wscript.exe	91
PID 4332 wrote to memory of 3820	4332	cmd.exe	93
PID 3820 wrote to memory of 1316	3820	cmd.exe	94
PID 4332 wrote to memory of 3048	4332	cmd.exe	95
PID 4332 wrote to memory of 2652	4332	cmd.exe	96
PID 2652 wrote to memory of 4328	2652	powershell.exe	97
PID 4332 wrote to memory of 4940	4332	cmd.exe	99
PID 4328 wrote to memory of 1372	4328	powershell.exe	101
PID 1372 wrote to memory of 5868	1372	choice.exe	103
PID 1372 wrote to memory of 3624	1372	choice.exe	104
PID 1372 wrote to memory of 5980	1372	choice.exe	105
PID 1372 wrote to memory of 4608	1372	choice.exe	106
PID 1372 wrote to memory of 3580	1372	choice.exe	110
PID 1372 wrote to memory of 5252	1372	choice.exe	111
PID 1372 wrote to memory of 4780	1372	choice.exe	112
PID 1372 wrote to memory of 3828	1372	choice.exe	115
PID 1372 wrote to memory of 2860	1372	choice.exe	116
PID 1372 wrote to memory of 3396	1372	choice.exe	117
PID 1372 wrote to memory of 5804	1372	choice.exe	122
PID 1372 wrote to memory of 3692	1372	choice.exe	123
PID 1372 wrote to memory of 1412	1372	choice.exe	124
PID 1372 wrote to memory of 5304	1372	choice.exe	125
PID 1372 wrote to memory of 5428	1372	choice.exe	126

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4940	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	choice.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SignedShippingDetails220926_PDF.js
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JERUQC))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem AUNLEVXQSMT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem AUNLEVXQSMT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd"
      4⤵
      PID:1316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:LYHWQH));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:AXZCWBZD))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:LYHWQH));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:AXZCWBZD))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:LYHWQH));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:AXZCWBZD))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\SysWOW64\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\apljqxpkkbqzxpx"
        6⤵
        
        PID:5868
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\apljqxpkkbqzxpx"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 520
        7⤵
        Program crash
        
        PID:5552
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\ljrcrpadyjiezvlfbou"
        6⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\vlwmralfmrajkbhjkyhlfk"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\psseohxqao"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 600
        7⤵
        Program crash
        
        PID:3596
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\suxwozikwwxpyq"
        6⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:5252
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\cocppsslkepuiwoxm"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\xdyglq"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 604
        7⤵
        Program crash
        
        PID:1684
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\hgezmjxrl"
        6⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2860
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\kajknbiszrdf"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\epfbjacenohylthzhswhcewtmzjqnrwq"
        6⤵
        
        PID:5804
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\epfbjacenohylthzhswhcewtmzjqnrwq"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3692
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojku"
        6⤵
        
        PID:1412
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojku"
        6⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        
        PID:5304
      - C:\Windows\SysWOW64\choice.exe
        
        C:\Windows\SysWOW64\choice.exe /stext "C:\Users\Admin\AppData\Local\Temp\zlpmlly"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5428
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3624 -ip 3624
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3580 -ip 3580
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3828 -ip 3828
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

97175912771970.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\97175912771970.cmd
Size 930KB
SHA256 23f8a3dcc1037981b3f5e0808865004e4b3cc516621e80b430b8a53a7be979c4
MD5 e04ba16c03f212918061ee22a4d93381
SHA1 beb37eea547ef3b4c90af25f3d24abf4c40449da
SHA512 8da5c37280ac72e35eae7d9b9cacc3eee27613f910d7d48f7fe33f645a8aa2f77cf9a6930454668f80b4456e450362ade3f5c02f8b4963bec103488a38cd2e44
SSDEEP 24576:eqCLR/0VSnn1wm0Csg5QncLHNtfBPXtxm:JC99nxvtk
TLSH
T1BE1512B8FE2E69B582FAFE17E35EBDA5177612C30246756D009D17EA47813C8DEE9000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 58cd2c595130475c87e95989e2cc8470eb8f2611523f472b67fe26cd17ec7c5d
MD5 b94ae10339c2e8d38d5551b9a027afcb
SHA1 d95affe26079f477e2fca2696176b861eb9aff40
SHA512 5d8d68bedd078dfc176329dd3f094cf89894f809606a36ed40d067f14c257bba52b26842a69ac763b41f3c36c77b93e56f4aa09085fe253b0b2f5c64e94e3031
TLSH
T1D7112633F3CD8624DC59403650DEAD1136B687CB40DECE6B7B84D155B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8222d986ab45aebab2b88c8adb2f64f48ca0c37a904a7f209b0b2b1cdbf373b5
MD5 58dca106c7356d9164a77db52d500af0
SHA1 8b4033af19da312091c5dcdb833ea11d2b572633
SHA512 8ef17fee49887350567ad11041b6afda8dba604e4e334fdd7ca3e6ea1501a74f6c09147e04a0ca716d33daee3c6e5ad9da75f6f07e05d33690beb67b4ab728c8
TLSH
T12E215937B3DC8614DC9A413A50CEAC1036B687DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xglqqrdm.nfi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xglqqrdm.nfi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bhvBE55.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvBE55.tmp
Size 14.0MB
SHA256 cbe344e0ec4ebc4075fc8576fba251910eb6680cbe5025717275a6a124de7a6a
MD5 3d6c396818882769d9271b4dbf30eaf1
SHA1 b85b08a63aa4a70f418b16a66be334628f06a57d
SHA512 d1dd589fe35b875a4685bf43346e1584744e4d04686f961ae45a8a81f67bec8ff2b5613c8d7a99335f635a4e5652ca247b6c29c90ab0a02d951c450cadc89c95
SSDEEP 3072:FbKS+MCHDvOHpFwmAtJp/NBBy40ACSh0c7M0/PvpVbKS+MCHDvOHpFdpZyF157WS:bFPFT4pFfFn4h4SMFsoknvkPFTI
TLSH
T131E606CF4AE30E03FA321A31B0E297532B77D5D2524287975979F5A75E0A393BB12309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epfbjacenohylthzhswhcewtmzjqnrwq

Path C:\Users\Admin\AppData\Local\Temp\epfbjacenohylthzhswhcewtmzjqnrwq
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

handoff_dbg_4328_e597ad3.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4328_e597ad3.txt
Size 474B
SHA256 18b3e7b9a9ef8808781183555d54f55edaf08d75c59f2fddb03ae379db6b77d9
MD5 b1e0282efc04cfed0a686e476de37751
SHA1 2c3344367e60351a9382984515160fa69e150c87
SHA512 8132b5d9ba6544265c85265ba08d4de164a6a7587808779eb955eb9a738f7283118b50ac5bfd3b17a7bc51fbc3b9e221f0babe64a18323411c10aefb9a1f8107
TLSH
T182F01A3D88DA48CFFDC12519F607B9A536D5B202B3D2C81E73EC636070C59325B08134
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4328_e597ad3.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4328_e597ad3.txt
Size 612B
SHA256 9e80f1df8f53646f5dbcaf6c497748a3e2f98f141cf261acd74f01537fc83a8f
MD5 65da89d26b3bae0fdc252f14f3070870
SHA1 9567f97950fca0c9d0b9be1ad6d88aa7a536d085
SHA512 175c6c356698383ac2102e24c91e12e9fd8e4a53760133fb22871aee7078441367883e9d7ab43d31ade4cf3b32d65a67d8931eb648a37804d9b0459601d747f7
TLSH
T153F0DF3C88DA48CFFDC12419FA03F9AA3691B142B7D6C85E77EC632030898725B48574
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1372-79-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-110-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-55-0x0000000001640000-0x0000000001680000-memory.dmp

Download

memory/1372-159-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-161-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-162-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-71-0x0000000001640000-0x0000000001680000-memory.dmp

Download

memory/1372-131-0x0000000000AD0000-0x0000000000ADB000-memory.dmp

Download

memory/1372-171-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-77-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-99-0x0000000003290000-0x0000000003291000-memory.dmp

Download

memory/1372-109-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-166-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-157-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-108-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-107-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-61-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1372-106-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-167-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-56-0x0000000001640000-0x0000000001680000-memory.dmp

Download

memory/1372-102-0x0000000003220000-0x0000000003221000-memory.dmp

Download

memory/1372-104-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1372-93-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/3624-111-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3624-116-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3624-113-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3692-146-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3692-149-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4328-31-0x0000000006570000-0x00000000068CB000-memory.dmp

Download

memory/4328-41-0x0000000007F90000-0x0000000007FC6000-memory.dmp

Download

memory/4328-53-0x00000000081D0000-0x00000000081D8000-memory.dmp

Download

memory/4328-51-0x0000000008190000-0x00000000081A5000-memory.dmp

Download

memory/4328-50-0x0000000008180000-0x0000000008190000-memory.dmp

Download

memory/4328-49-0x0000000008150000-0x0000000008161000-memory.dmp

Download

memory/4328-48-0x0000000008140000-0x000000000814A000-memory.dmp

Download

memory/4328-47-0x0000000008050000-0x00000000080F3000-memory.dmp

Download

memory/4328-46-0x0000000007F70000-0x0000000007F90000-memory.dmp

Download

memory/4328-43-0x0000000070480000-0x00000000707DB000-memory.dmp

Download

memory/4328-42-0x00000000702D0000-0x000000007031C000-memory.dmp

Download

memory/4328-26-0x0000000005C50000-0x0000000005C72000-memory.dmp

Download

memory/4328-39-0x0000000008EC0000-0x000000000947A000-memory.dmp

Download

memory/4328-38-0x0000000007C60000-0x0000000007C82000-memory.dmp

Download

memory/4328-37-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Download

memory/4328-36-0x0000000006FF0000-0x000000000700A000-memory.dmp

Download

memory/4328-35-0x0000000008280000-0x00000000088FC000-memory.dmp

Download

memory/4328-34-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Download

memory/4328-33-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Download

memory/4328-24-0x0000000003780000-0x00000000037B6000-memory.dmp

Download

memory/4328-25-0x0000000005E40000-0x000000000648A000-memory.dmp

Download

memory/4328-27-0x0000000006490000-0x00000000064F6000-memory.dmp

Download

memory/4328-28-0x0000000006500000-0x0000000006566000-memory.dmp

Download

memory/4328-52-0x00000000081E0000-0x00000000081FC000-memory.dmp

Download

memory/4608-118-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4608-114-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4608-117-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5304-148-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5304-150-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5428-152-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5428-154-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5980-115-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5980-120-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5980-112-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/6056-0-0x00007FF8C444F000-0x00007FF8C4450000-memory.dmp

Download

memory/6056-13-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-14-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-11-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-9-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-8-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-7-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-6-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-5-0x0000016B7DEA0000-0x0000016B7DEC2000-memory.dmp

Download

memory/6056-2-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download

memory/6056-1-0x00007FF8C42C0000-0x00007FF8C4C64000-memory.dmp

Download