Analysis
- max time kernel
128s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
29/10/2026, 22:49
General
- Target TgWsProxy_windows_7_64bit.exe
- Size 19.8MB
- Sample261029-2r2jmsty3j
- SHA256 80d1bd904e36903507e5d70c256eb4ea8d4befbe4bf01f9aeb70c7009e3203ab
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 55 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 47 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 47 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 47 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"19⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"20⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"22⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"56⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'56⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"56⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"55⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'54⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"54⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"53⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'52⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"52⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'51⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"51⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'50⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"50⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'49⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"49⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'48⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"48⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'47⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"47⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'46⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"46⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'45⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"45⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'44⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"44⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'43⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"43⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'42⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"42⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'41⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"41⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'40⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"40⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'39⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"39⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'38⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"38⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'37⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"37⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'36⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"36⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'35⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"35⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'34⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"34⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'33⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"33⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'32⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'31⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"31⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'30⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"30⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'29⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"29⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'28⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"28⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'27⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"27⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'26⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"26⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'25⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"25⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'24⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"24⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"23⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"22⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'21⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"21⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'20⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"20⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'19⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"19⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'18⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"18⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'17⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"17⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'16⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"16⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"15⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"14⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"13⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"12⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"11⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"10⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"9⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"8⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"7⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"6⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"C:\Users\Admin\AppData\Local\Temp\Hackmgr.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TgWsProxy_windows_7_64bit.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Hackmgr.exe
__PSScriptPolicyTest_o1ywactf.w1l.ps1
memory/368-75-0x000001E4EB410000-0x000001E4EB42E000-memory.dmp
memory/556-251-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/820-149-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/900-580-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1060-441-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1308-2-0x000002C2A3390000-0x000002C2A33A0000-memory.dmp
memory/1308-8-0x000002C2A32E0000-0x000002C2A3302000-memory.dmp
memory/1348-507-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-23-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-375-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-158-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-285-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-544-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-477-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-64-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-111-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-65-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-405-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-203-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-442-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-332-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-240-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1348-581-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1404-91-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1404-89-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1420-36-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1420-37-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1468-497-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1648-206-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1676-343-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1752-138-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1876-172-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1928-432-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/1964-102-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2008-228-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2216-479-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2288-451-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2328-50-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2328-318-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2328-48-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2428-354-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2480-506-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2512-553-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2616-183-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2636-127-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2636-525-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2636-404-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2640-61-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2640-63-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/2864-386-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3112-414-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3152-562-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3268-377-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3644-488-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3656-365-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3716-77-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3716-78-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3804-296-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/3832-0-0x0000000000BA0000-0x0000000001F7E000-memory.dmp
memory/3832-1-0x000000001CC60000-0x000000001CC70000-memory.dmp
memory/4048-331-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4188-571-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4196-217-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4224-469-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4336-194-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4360-284-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4400-423-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4564-273-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4572-534-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4668-114-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4668-116-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4832-590-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4848-543-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4864-161-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4916-516-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4944-262-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4952-395-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4956-239-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4960-307-0x0000000000C40000-0x0000000001894000-memory.dmp
memory/4992-460-0x0000000000C40000-0x0000000001894000-memory.dmp