Analysis
- max time kernel
101s - max time network
149s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
24/10/2026, 09:12
General
- Target 798.exe
- Size 250KB
- Sample261024-k568lsef57
- SHA256 2f5aecb75a4a9848101551aa300480462b07b1b5ffd54e4ef0d31b90965a2cd9
Score
10/10
Malware Config
Extracted
Family
-
neptunerat
C2
-
193.161.193.99:45108
Attributes
-
filename
USB.exe
-
group
MasonGroup
-
key
I3ujeNhtTGMSOz0g
-
rat_name
MasonRAT
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects DonutLoader 1 IoCs
- Detects NeptuneRAT stealer 2 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 51 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 54 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes a file named after a Windows system binary 1 TTPs 12 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 53 IoCs
- Adds Run key to start application 2 TTPs 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\798.exe"C:\Users\Admin\AppData\Local\Temp\798.exe"1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yr3m5ylr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\yr3m5ylr.exeC:\Users\Admin\AppData\Roaming\yr3m5ylr.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2trbaosp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\RuntimeBroker.exe1⤵
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\2trbaosp.exeC:\Users\Admin\AppData\Roaming\2trbaosp.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\g4g2k1dm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\g4g2k1dm.exeC:\Users\Admin\AppData\Roaming\g4g2k1dm.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dyn2nm2s.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\dyn2nm2s.exeC:\Users\Admin\AppData\Roaming\dyn2nm2s.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vdwzzimf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\vdwzzimf.exeC:\Users\Admin\AppData\Roaming\vdwzzimf.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\f1ecelef.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\f1ecelef.exeC:\Users\Admin\AppData\Roaming\f1ecelef.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0a0hug3z.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\0a0hug3z.exeC:\Users\Admin\AppData\Roaming\0a0hug3z.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yrteldih.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\yrteldih.exeC:\Users\Admin\AppData\Roaming\yrteldih.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1v0aaj5r.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1v0aaj5r.exeC:\Users\Admin\AppData\Roaming\1v0aaj5r.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gigbr4mh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\gigbr4mh.exeC:\Users\Admin\AppData\Roaming\gigbr4mh.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vjxhr32c.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\vjxhr32c.exeC:\Users\Admin\AppData\Roaming\vjxhr32c.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tw33h2j4.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\tw33h2j4.exeC:\Users\Admin\AppData\Roaming\tw33h2j4.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dwngcarx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\dwngcarx.exeC:\Users\Admin\AppData\Roaming\dwngcarx.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\amf5baht.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\amf5baht.exeC:\Users\Admin\AppData\Roaming\amf5baht.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wwfasad5.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\wwfasad5.exeC:\Users\Admin\AppData\Roaming\wwfasad5.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vbsbg2of.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\vbsbg2of.exeC:\Users\Admin\AppData\Roaming\vbsbg2of.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uztkmmqj.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\uztkmmqj.exeC:\Users\Admin\AppData\Roaming\uztkmmqj.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5jfoy1jw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\5jfoy1jw.exeC:\Users\Admin\AppData\Roaming\5jfoy1jw.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5x2inznq.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\5x2inznq.exeC:\Users\Admin\AppData\Roaming\5x2inznq.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xik50rga.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\xik50rga.exeC:\Users\Admin\AppData\Roaming\xik50rga.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dtirtkrp.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\dtirtkrp.exeC:\Users\Admin\AppData\Roaming\dtirtkrp.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\r3mxjb24.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\r3mxjb24.exeC:\Users\Admin\AppData\Roaming\r3mxjb24.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\o2d1cjdu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\o2d1cjdu.exeC:\Users\Admin\AppData\Roaming\o2d1cjdu.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dcpjjp2l.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\dcpjjp2l.exeC:\Users\Admin\AppData\Roaming\dcpjjp2l.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yidkfvgh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\yidkfvgh.exeC:\Users\Admin\AppData\Roaming\yidkfvgh.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\i5j4k0b1.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\i5j4k0b1.exeC:\Users\Admin\AppData\Roaming\i5j4k0b1.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gvkkk5of.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\gvkkk5of.exeC:\Users\Admin\AppData\Roaming\gvkkk5of.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rpl5u45a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\rpl5u45a.exeC:\Users\Admin\AppData\Roaming\rpl5u45a.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3y5yebtm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\3y5yebtm.exeC:\Users\Admin\AppData\Roaming\3y5yebtm.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\f1es5c3g.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\f1es5c3g.exeC:\Users\Admin\AppData\Roaming\f1es5c3g.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qsmqb2qb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\qsmqb2qb.exeC:\Users\Admin\AppData\Roaming\qsmqb2qb.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iiimw4x1.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\iiimw4x1.exeC:\Users\Admin\AppData\Roaming\iiimw4x1.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tpnyub5m.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\tpnyub5m.exeC:\Users\Admin\AppData\Roaming\tpnyub5m.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vqezbc2u.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\vqezbc2u.exeC:\Users\Admin\AppData\Roaming\vqezbc2u.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\j5x5me4c.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"1⤵
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\j5x5me4c.exeC:\Users\Admin\AppData\Roaming\j5x5me4c.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lud1rau2.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\lud1rau2.exeC:\Users\Admin\AppData\Roaming\lud1rau2.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ab5xho34.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\ab5xho34.exeC:\Users\Admin\AppData\Roaming\ab5xho34.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hbixzv4y.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\hbixzv4y.exeC:\Users\Admin\AppData\Roaming\hbixzv4y.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5yy0sdrp.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\5yy0sdrp.exeC:\Users\Admin\AppData\Roaming\5yy0sdrp.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yxirmjqw.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\yxirmjqw.exeC:\Users\Admin\AppData\Roaming\yxirmjqw.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\arlvlm1h.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\arlvlm1h.exeC:\Users\Admin\AppData\Roaming\arlvlm1h.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2bzbqb5q.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\2bzbqb5q.exeC:\Users\Admin\AppData\Roaming\2bzbqb5q.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vi5uresi.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\vi5uresi.exeC:\Users\Admin\AppData\Roaming\vi5uresi.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jqe0015l.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\jqe0015l.exeC:\Users\Admin\AppData\Roaming\jqe0015l.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sqcugjj2.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\sqcugjj2.exeC:\Users\Admin\AppData\Roaming\sqcugjj2.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\e2ondsjf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\e2ondsjf.exeC:\Users\Admin\AppData\Roaming\e2ondsjf.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wn3if0fa.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\wn3if0fa.exeC:\Users\Admin\AppData\Roaming\wn3if0fa.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vok2esjg.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Roaming\vok2esjg.exeC:\Users\Admin\AppData\Roaming\vok2esjg.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\m1rti2pb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\m1rti2pb.exeC:\Users\Admin\AppData\Roaming\m1rti2pb.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xamw3vvs.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\xamw3vvs.exeC:\Users\Admin\AppData\Roaming\xamw3vvs.exe1⤵
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0o3had2b.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\0o3had2b.exeC:\Users\Admin\AppData\Roaming\0o3had2b.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nb5e12a2.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\nb5e12a2.exeC:\Users\Admin\AppData\Roaming\nb5e12a2.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wfwa524f.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\wfwa524f.exeC:\Users\Admin\AppData\Roaming\wfwa524f.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4e2moelt.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\4e2moelt.exeC:\Users\Admin\AppData\Roaming\4e2moelt.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yz0vabzq.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\yz0vabzq.exeC:\Users\Admin\AppData\Roaming\yz0vabzq.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ktshfrc3.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\ktshfrc3.exeC:\Users\Admin\AppData\Roaming\ktshfrc3.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xk1hh5rv.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\xk1hh5rv.exeC:\Users\Admin\AppData\Roaming\xk1hh5rv.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wioys02o.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\wioys02o.exeC:\Users\Admin\AppData\Roaming\wioys02o.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wbbay2jo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\wbbay2jo.exeC:\Users\Admin\AppData\Roaming\wbbay2jo.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\a3wnbmaz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\a3wnbmaz.exeC:\Users\Admin\AppData\Roaming\a3wnbmaz.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ksxkj22v.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\ksxkj22v.exeC:\Users\Admin\AppData\Roaming\ksxkj22v.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5p2gqo03.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\5p2gqo03.exeC:\Users\Admin\AppData\Roaming\5p2gqo03.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qryjm3jm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\qryjm3jm.exeC:\Users\Admin\AppData\Roaming\qryjm3jm.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0azdpq3y.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\0azdpq3y.exeC:\Users\Admin\AppData\Roaming\0azdpq3y.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\h1l1xb23.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\h1l1xb23.exeC:\Users\Admin\AppData\Roaming\h1l1xb23.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\032xlop3.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Roaming\032xlop3.exeC:\Users\Admin\AppData\Roaming\032xlop3.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eghdmelw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\eghdmelw.exeC:\Users\Admin\AppData\Roaming\eghdmelw.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ueeexnxe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\ueeexnxe.exeC:\Users\Admin\AppData\Roaming\ueeexnxe.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\do22atgw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\do22atgw.exeC:\Users\Admin\AppData\Roaming\do22atgw.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gmq4vxlb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\gmq4vxlb.exeC:\Users\Admin\AppData\Roaming\gmq4vxlb.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qzu0ls2u.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\qzu0ls2u.exeC:\Users\Admin\AppData\Roaming\qzu0ls2u.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zivsgbx4.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\zivsgbx4.exeC:\Users\Admin\AppData\Roaming\zivsgbx4.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ntexms11.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\ntexms11.exeC:\Users\Admin\AppData\Roaming\ntexms11.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xx0wb5bo.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\xx0wb5bo.exeC:\Users\Admin\AppData\Roaming\xx0wb5bo.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\apgidtkj.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\apgidtkj.exeC:\Users\Admin\AppData\Roaming\apgidtkj.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zxtjculw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\zxtjculw.exeC:\Users\Admin\AppData\Roaming\zxtjculw.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pxrs5m5v.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\pxrs5m5v.exeC:\Users\Admin\AppData\Roaming\pxrs5m5v.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Hide Artifacts
1Hidden Files and Directories
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe.log
g4g2k1dm.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2mem3lzr.dii.ps1
RuntimeBroker.exe
yr3m5ylr.exe
memory/1096-4-0x0000012342170000-0x0000012342180000-memory.dmp
memory/1096-3-0x0000012342170000-0x0000012342180000-memory.dmp
memory/1096-5-0x0000012344DB0000-0x0000012344DD2000-memory.dmp
memory/1096-13-0x0000012342170000-0x0000012342180000-memory.dmp
memory/3804-53-0x000001492F3F0000-0x000001492F402000-memory.dmp
memory/4848-0-0x0000000000560000-0x00000000005A4000-memory.dmp
memory/4848-1-0x0000000000E60000-0x0000000000E70000-memory.dmp
memory/4848-2-0x0000000000E60000-0x0000000000E70000-memory.dmp
memory/6056-17-0x000001EAE3BE0000-0x000001EAE3BF5000-memory.dmp
memory/6056-20-0x000001EAFE810000-0x000001EAFE822000-memory.dmp