5d18497e0e4ff2e641da35c9505d2599b3d0e6eca6bb7865cdd8d9eef0fff661

Analysis

user interaction
yes
max time kernel
12s
max time network
11s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/10/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MemeSense_patched.cmd
Size 17.3MB
Sample261009-te3beazsat
SHA256 5d18497e0e4ff2e641da35c9505d2599b3d0e6eca6bb7865cdd8d9eef0fff661
MD5 f7744ad25b9ed861865b94b86042ee05
SHA1 9545a1159ae4f2d1a9280a7dae79557c7810c3ab
SHA512 c35e24c3c703394e8c1e48356717661b1359af64518de226927f5039a5636a6985d45fe2ca945140e3bf75041d0cd196d3552fd6e667cec245305f721db805d0
SSDEEP 49152:HgRqFKGRvlGohVf4CjqTRyDQUUNNDXD+NnxiO0ZMGWCJ6L4Ji3ld4lBC314RS9Gg:r
TLSH
T17C072272D0CA35D50D63C1E4AC8A77447C69B7878E8461867BF861B8B1F90B8CE5DCE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3596	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2816	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3596	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe
3596	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2816	powershell.exe
2816	powershell.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2816	3864	cmd.exe	83
PID 3864 wrote to memory of 3596	3864	cmd.exe	84
PID 3864 wrote to memory of 2268	3864	cmd.exe	85
PID 2268 wrote to memory of 3012	2268	powershell.exe	86
PID 3012 wrote to memory of 5964	3012	csc.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MemeSense_patched.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$l=[IO.File]::ReadAllLines('C:\Users\Admin\AppData\Local\Temp\MemeSense_patched.cmd');$i=[array]::IndexOf($l,'__B64__');$p=[string]::Concat($l[($i+1)..($l.Count-1)]);[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe',[Convert]::FromBase64String($p))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe
  "C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand cABhAHIAYQBtACgACgAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMAZQBzAHMATgBhAG0AZQAgAD0AIAAiAGMANABmAGEAZQAwADkAYwAxAGEAMQAyAGMANwBjADcAMwAxADMAYQAzADcAZAAwADAAZAA4AGEANwA2AGMAYgBmADAAMwAwAGQAMwBhADQANABjAGQANwA2AGEANgAyAGMAZQBlADkAYwAzADAAYwA3ADkAZgBkAGMAMAAyADMAIgAsAAoAIAAgACAAIABbAGkAbgB0AF0AJABUAGkAbQBlAG8AdQB0AFMAZQBjACAAPQAgADkAMAAKACkACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAHMAaQBnACAAPQAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAE0AUABhAHQAYwBoAGUAcgAgAHsACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIALAAgAFMAZQB0AEwAYQBzAHQARQByAHIAbwByAD0AdAByAHUAZQApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAE8AcABlAG4AUAByAG8AYwBlAHMAcwAoAHUAaQBuAHQAIABhACwAIABiAG8AbwBsACAAaQAsACAAaQBuAHQAIABwACkAOwAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABSAGUAYQBkAFAAcgBvAGMAZQBzAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAGgALAAgAEkAbgB0AFAAdAByACAAYQAsACAAYgB5AHQAZQBbAF0AIABiACwAIABJAG4AdABQAHQAcgAgAHMALAAgAG8AdQB0ACAASQBuAHQAUAB0AHIAIAByACkAOwAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABXAHIAaQB0AGUAUAByAG8AYwBlAHMAcwBNAGUAbQBvAHIAeQAoAEkAbgB0AFAAdAByACAAaAAsACAASQBuAHQAUAB0AHIAIABhACwAIABiAHkAdABlAFsAXQAgAGIALAAgAEkAbgB0AFAAdAByACAAcwAsACAAbwB1AHQAIABJAG4AdABQAHQAcgAgAHIAKQA7AAoAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACwAIABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAKABJAG4AdABQAHQAcgAgAGgALAAgAEkAbgB0AFAAdAByACAAYQAsACAASQBuAHQAUAB0AHIAIABzACwAIAB1AGkAbgB0ACAAbgAsACAAbwB1AHQAIAB1AGkAbgB0ACAAbwApADsACgAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIALAAgAFMAZQB0AEwAYQBzAHQARQByAHIAbwByAD0AdAByAHUAZQApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgASQBuAHQAUAB0AHIAIABoACkAOwAKAH0ACgAiAEAACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACQAcwBpAGcACgAKACQAYgBhAHMAZQAgAD0AIAAwAHgAMQA0ADAAMAAwADAAMAAwADAATAAKACQAdABhAHIAZwBlAHQAUgB2AGEAIAA9ACAAMAB4ADYARQAxADgARQAKACQAbwByAGkAZwAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMABGACwAMAB4ADgANAAsADAAeAA2ADkALAAwAHgAMAAxACwAMAB4ADAAMAAsADAAeAAwADAAKQAKACQAcABhAHQAYwBoAGUAcwAgAD0AIABAACgACgAgACAAIAAgAEAAewAgAFIAdgBhACAAPQAgADAAeAA2AEUAMQA4AEUAOwAgAEIAeQB0AGUAcwAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAOQAwACwAMAB4ADkAMAAsADAAeAA5ADAALAAwAHgAOQAwACwAMAB4ADkAMAAsADAAeAA5ADAAKQAgAH0ALAAKACAAIAAgACAAQAB7ACAAUgB2AGEAIAA9ACAAMAB4ADYARQAxADkAQgA7ACAAQgB5AHQAZQBzACAAPQAgAFsAYgB5AHQAZQBbAF0AXQAoADAAeAA5ADAALAAwAHgAOQAwACwAMAB4ADkAMAAsADAAeAA5ADAALAAwAHgAOQAwACwAMAB4ADkAMAApACAAfQAsAAoAIAAgACAAIABAAHsAIABSAHYAYQAgAD0AIAAwAHgANgBFADEAQgA3ADsAIABCAHkAdABlAHMAIAA9ACAAWwBiAHkAdABlAFsAXQBdACgAMAB4ADkAMAAsADAAeAA5ADAALAAwAHgAOQAwACwAMAB4ADkAMAAsADAAeAA5ADAALAAwAHgAOQAwACkAIAB9ACwACgAgACAAIAAgAEAAewAgAFIAdgBhACAAPQAgADAAeAA2AEUAMQBEADIAOwAgAEIAeQB0AGUAcwAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAOQAwACwAMAB4ADkAMAApACAAfQAKACkACgAKACQAZABlAGEAZABsAGkAbgBlACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBBAGQAZABTAGUAYwBvAG4AZABzACgAJABUAGkAbQBlAG8AdQB0AFMAZQBjACkACgAkAHAAcgBvAGMAIAA9ACAAJABuAHUAbABsAAoAdwBoAGkAbABlACAAKAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBsAHQAIAAkAGQAZQBhAGQAbABpAG4AZQApACAAewAKACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAUAByAG8AYwBlAHMAcwBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAgACAAIAAgAGkAZgAgACgAJABwAHIAbwBjACkAIAB7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwAAoAfQAKAGkAZgAgACgALQBuAG8AdAAgACQAcAByAG8AYwApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFsAcABhAHQAYwBoAF0AIABwAHIAbwBjAGUAcwBzACAAJwAkAFAAcgBvAGMAZQBzAHMATgBhAG0AZQAnACAAbgBvAHQAIABmAG8AdQBuAGQAIgA7ACAAZQB4AGkAdAAgADEAIAB9AAoACgB0AHIAeQAgAHsAIAAkAGIAYQBzAGUAIAA9ACAAWwBpAG4AdAA2ADQAXQAkAHAAcgBvAGMALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4AQgBhAHMAZQBBAGQAZAByAGUAcwBzACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAVwByAGkAdABlAC0ASABvAHMAdAAgACgAIgBbAHAAYQB0AGMAaABdACAAcABpAGQAPQB7ADAAfQAgAGIAYQBzAGUAPQAwAHgAewAxADoAWAB9ACIAIAAtAGYAIAAkAHAAcgBvAGMALgBJAGQALAAgACQAYgBhAHMAZQApAAoACgAkAGgAIAA9ACAAWwBNAFAAYQB0AGMAaABlAHIAXQA6ADoATwBwAGUAbgBQAHIAbwBjAGUAcwBzACgAMAB4ADEARgBGAEYARgBGACwAIAAkAGYAYQBsAHMAZQAsACAAJABwAHIAbwBjAC4ASQBkACkACgBpAGYAIAAoACQAaAAgAC0AZQBxACAAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvACkAIAB7AAoAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAKAAiAFsAcABhAHQAYwBoAF0AIABPAHAAZQBuAFAAcgBvAGMAZQBzAHMAIABmAGEAaQBsAGUAZAA6ACAAewAwAH0AIgAgAC0AZgAgAFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBHAGUAdABMAGEAcwB0AFcAaQBuADMAMgBFAHIAcgBvAHIAKAApACkACgAgACAAIAAgAGUAeABpAHQAIAAxAAoAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAgAD0AIABbAEkAbgB0AFAAdAByAF0AKABbAGkAbgB0ADYANABdACQAYgBhAHMAZQAgACsAIAAkAHQAYQByAGcAZQB0AFIAdgBhACkACgAgACAAIAAgACQAYgB1AGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANgAKACAAIAAgACAAJAB1AG4AcABhAGMAawBlAGQAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAHcAaABpAGwAZQAgACgAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AbAB0ACAAJABkAGUAYQBkAGwAaQBuAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAByAGUAYQBkACAAPQAgAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFsATQBQAGEAdABjAGgAZQByAF0AOgA6AFIAZQBhAGQAUAByAG8AYwBlAHMAcwBNAGUAbQBvAHIAeQAoACQAaAAsACAAJAB0AGEAcgBnAGUAdAAsACAAJABiAHUAZgAsACAAWwBJAG4AdABQAHQAcgBdADYALAAgAFsAcgBlAGYAXQAkAHIAZQBhAGQAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBhAHQAYwBoACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAA2ADsAIAAkAGkAKwArACkAIAB7ACAAaQBmACAAKAAkAGIAdQBmAFsAJABpAF0AIAAtAG4AZQAgACQAbwByAGkAZwBbACQAaQBdACkAIAB7ACAAJABtAGEAdABjAGgAIAA9ACAAJABmAGEAbABzAGUAOwAgAGIAcgBlAGEAawAgAH0AIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG0AYQB0AGMAaAApACAAewAgACQAdQBuAHAAYQBjAGsAZQBkACAAPQAgACQAdAByAHUAZQA7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQBuAHAAYQBjAGsAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAWwBwAGEAdABjAGgAXQAgAHQAaQBtAGUAZAAgAG8AdQB0ACAAdwBhAGkAdABpAG4AZwAgAGYAbwByACAAdQBuAHAAYQBjAGsAZQBkACAAYwBvAGQAZQAiADsAIABlAHgAaQB0ACAAMQAgAH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFsAcABhAHQAYwBoAF0AIAB1AG4AcABhAGMAawBlAGQAIABjAG8AZABlACAAZABlAHQAZQBjAHQAZQBkADsAIABhAHAAcABsAHkAaQBuAGcAIABwAGEAdABjAGgAIgAKAAoAIAAgACAAIAAkAHAAYQBnAGUAIAA9ACAAWwBJAG4AdABQAHQAcgBdACgAWwBpAG4AdAA2ADQAXQAkAGIAYQBzAGUAIAAtAGIAYQBuAGQAIAAoAC0AYgBuAG8AdAAgADAAeABGAEYARgApACkACgAgACAAIAAgACQAbwBsAGQAIAA9ACAAWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgAFsAdgBvAGkAZABdAFsATQBQAGEAdABjAGgAZQByAF0AOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAKAAkAGgALAAgACQAcABhAGcAZQAsACAAWwBJAG4AdABQAHQAcgBdADAAeAAyADAAMAAwACwAIAAwAHgANAAwACwAIABbAHIAZQBmAF0AJABvAGwAZAApAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAYQB0AGMAaABlAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABhAGQAZAByACAAPQAgAFsASQBuAHQAUAB0AHIAXQAoAFsAaQBuAHQANgA0AF0AJABiAGEAcwBlACAAKwAgAFsAaQBuAHQANgA0AF0AJABwAC4AUgB2AGEAKQAKACAAIAAgACAAIAAgACAAIAAkAHcAcgBpAHQAdABlAG4AIAA9ACAAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvAAoAIAAgACAAIAAgACAAIAAgAFsAdgBvAGkAZABdAFsATQBQAGEAdABjAGgAZQByAF0AOgA6AFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgAJABoACwAIAAkAGEAZABkAHIALAAgACQAcAAuAEIAeQB0AGUAcwAsACAAWwBJAG4AdABQAHQAcgBdACQAcAAuAEIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIABbAHIAZQBmAF0AJAB3AHIAaQB0AHQAZQBuACkACgAgACAAIAAgAH0ACgAgACAAIAAgAFsAdgBvAGkAZABdAFsATQBQAGEAdABjAGgAZQByAF0AOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAKAAkAGgALAAgACQAcABhAGcAZQAsACAAWwBJAG4AdABQAHQAcgBdADAAeAAyADAAMAAwACwAIAAkAG8AbABkACwAIABbAHIAZQBmAF0AJABvAGwAZAApAAoAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBbAHAAYQB0AGMAaABdACAAZABvAG4AZQA6ACAAYwBsAGkAZQBuAHQALQBzAGkAZABlACAAdgBhAGwAaQBkAGEAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUAZAAiAAoAfQAgAGYAaQBuAGEAbABsAHkAIAB7AAoAIAAgACAAIABbAHYAbwBpAGQAXQBbAE0AUABhAHQAYwBoAGUAcgBdADoAOgBDAGwAbwBzAGUASABhAG4AZABsAGUAKAAkAGgAKQAKAH0ACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wrfj5wjq\wrfj5wjq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96FB.tmp" "c:\Users\Admin\AppData\Local\Temp\wrfj5wjq\CSCFE2E6B9AF4A4F569253C4F0F4507B69.TMP"
      4⤵
      PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1
MD5 e30544e6d048b2c1c6129c89835c16dd
SHA1 21d167ff64825d3f8a5c351c3160b670dc14cb60
SHA512 fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b
TLSH
T1F551CB3133B5A1E489167F4619681AC023BF8355F698AF187698521ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 030b8c44d107988cfe3e9c5f77b8bcc28e37b7e68a9a4d8f5f15ae6edadb7e68
MD5 2f8487d960afcaec2240424ebdd89157
SHA1 9790f3a4108a34c1b07ef2a62011d6a1c370547f
SHA512 54ce929d9da51fc6e8d4deaec4f0d9d1673d078a48eb06b7e13d1df3122547bbdcdd1bc06487ddd9646ca7208c8964be2b3af11bd5ab4dc4d7b22ee83bd65b42
TLSH
T168116623F78DC9A0CC85463A409CADA175B687CB81DADECB3EC4C114E0BF589CB601A4
MD5 SHA1 SHA512 TLSH

Submit Download

RES96FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES96FB.tmp
Size 1KB
SHA256 45d0daa52ca23d41866043addbde26f51ab2205163144a61cd7f089370b55604
MD5 ef433325f8262f4939ab76b7723dc3d6
SHA1 a35784826829cfde40b4663626586b8262bf15b9
SHA512 a8f03ebe07392002a3506774635d21831b63d524bad57b04cee1d653792db90dbaf77a428c9f82b929755b22e0b76e4444cf5998dc18c7e10d3db58a19a8bf07
TLSH
T14821AB0543E9470BF0775731A9F6272FA274FDA4EF72939B894042282CA1604EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jva3zql2.ids.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jva3zql2.ids.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

__patch.log

Path C:\Users\Admin\AppData\Local\Temp\__patch.log
Size 3KB
SHA256 e82afce9a71b6b72c5eb94e4a9cfc0b476d2f205bfac7352da63e08e7cc04ce0
MD5 97d25291f838fc090eafb4a259ed8004
SHA1 a58d7454a13ce8c2c32b785be5eaf661abf8ce43
SHA512 dee52e04cebc6df124b3c3dffbb6f1547fe21e7ac545ac6a0da0007ce7f57a15f676b7f08ac0d2360a0739d7f51fe65abf0961c03d39720cd8872ad472d6ee5a
TLSH
T15D6134B3E84B900AE242429F7277A0E2BDDB0497D7DDDC9659CDC7FC1021845A74329D
MD5 SHA1 SHA512 TLSH

Submit Download

c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe

Path C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe
Size 12.6MB
SHA256 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023
MD5 77f110a9f1e432ae6a85669ee6e04224
SHA1 398ff0fae1cc7a1b99019c675ba0f42f9d8d333a
SHA512 2f5261cea35e092f04079b9c04811da21320658417fceb4229baafb75bc65bdedaa0701d2cff38da31a93e5d53620b2fac37077fa7b039890e4976480e84b461
SSDEEP 196608:aZCE+RSPD4vjbbcViPLpZ0BYPCqZJZ0NVpzwkpcVSkZD0J92GjLErija9v:aZrtBVur0KP30NEeRoO2WYv
TLSH
T1D5D622D465D4A37DC8818238F5455AEAF0D46C9E1DF9CA1AFF96C4327B70A48C8B1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrfj5wjq.dll

Path C:\Users\Admin\AppData\Local\Temp\wrfj5wjq\wrfj5wjq.dll
Size 3KB
SHA256 b257b9dcc4f554b14da5cdbd5d3c00f2e6396da2eea40112e3d2f73b24998e0b
MD5 1ee11e94b6e44b105c523f81c9969116
SHA1 f86bca01f0567aec6771507320f66cce28cf58ff
SHA512 fb50a6a015cb0dae8695d356727f65187de4efffde0ceeb13faa2eb02cc5cadf78b8bab8d687c3e52e8fa2bfe01508f0c1c9ad119c5bf64043d76b600e7cb54e
TLSH
T16071E00BD7E84667E0BA4B35AEB3472767F4F9608B73877F155102187DA12744A30BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFE2E6B9AF4A4F569253C4F0F4507B69.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wrfj5wjq\CSCFE2E6B9AF4A4F569253C4F0F4507B69.TMP
Size 652B
SHA256 d44e65966e70a17ba9b118fa0c33512960472f3197df181dcbcefe65c2ed9fa3
MD5 f7837a7664c1d00aec982e8f4caf3a92
SHA1 0f15e9a34217b82d6d09f944fd0c8cfa56e66bc4
SHA512 6c9e6a85340fd150d092d4b740a542ad2dde30b12c8b6eebfb7a96b17a48e8d578e47f3edef42d263ea96fe2395fdcbf53c18e0478be22132b356bfa668767cc
TLSH
T10AF05E0A63F8420EF0F75B30BDF6936791A8BC64DE3293EE594003592874A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wrfj5wjq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wrfj5wjq\wrfj5wjq.0.cs
Size 748B
SHA256 48591a7a696571e5f54a60a92ea58a5f158aea47d5919649c27b96e0f3a73493
MD5 ae8e00e1525d06a4138dc814fdce1244
SHA1 535945451775ddb090d22e15ec40e560fb5298ce
SHA512 9b9364c3862c1f9dc26a4d196f86d6097b359aec597e7c56285982e9f8ee15e9f30aa2e32296cbffc47d5b1fc0a36cf075b4b066962c8344cdeb8bac930663c3
TLSH
T10901F7043356A7614472CA3E8A97D0DEFA03403226FF4D14ABFC67334F4A146D53A359
MD5 SHA1 SHA512 TLSH

Submit Download

wrfj5wjq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wrfj5wjq\wrfj5wjq.cmdline
Size 369B
SHA256 4d0b1255f5cd1b19df453187208a79179275c66dc34899a603b09111d7e22418
MD5 5870efa454c4b6180278ab3b5169368c
SHA1 4a0433b5cc9a0f569ef2aecb1b193c422eb49f5b
SHA512 09ef3b1f9fbc40f59c45678dae74fb7624ca9c60bf541803b1b8dd905926158b56b5829cdee67c6147c61b672bf5a17c3d06603f1dc31fb377acb9da7b5c577b
TLSH
T14CE0686A428BC7BD05DA100723ADC4FCC2F206837A903F946040441DD01780827D1749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2268-44-0x000001CC70D40000-0x000001CC70D48000-memory.dmp

Download

memory/2816-2-0x00000289CEEC0000-0x00000289CEED0000-memory.dmp

Download

memory/2816-15-0x00000289D1B00000-0x00000289D1D1D000-memory.dmp

Download

memory/2816-11-0x00000289CEEC0000-0x00000289CEED0000-memory.dmp

Download

memory/2816-3-0x00000289D1150000-0x00000289D1172000-memory.dmp

Download