4e353c29e1181d34746cf152514e39fb31156e7b5d7ef4623742ff3fd898cbac

Analysis

max time kernel
111s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MKW Launcher.exe
Size 77.0MB
Sample261104-xd5xpaez8k
SHA256 4e353c29e1181d34746cf152514e39fb31156e7b5d7ef4623742ff3fd898cbac
MD5 cda00800d4371e37f61aa87f33c7b8d0
SHA1 ee0c1bf46c996ac16b877d83ddccea7e33a91480
SHA512 107a54517d26cb8be46d6f178c1e2dacd0bbb141f066b181b8d6214dbd2fd667a92adbecaf0f5a7dbac47e57b8a335b2191828c2c1131447385f08d71ae929a5
SSDEEP 1572864:7p+z0Mn1pzg0davrsLzSq1+kro+vAps0Q1XrBLWEiySwFAt5ofQTa+wc+:7pqnT3dosL2q1+EXzoySRXONR
TLSH
T19A08330F1CC8C673C465C93E255AB2E51953D35E8F27429AC39EC1FEEFA48B89620791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1880	utdcv.exe
4300	utdcv.exe
4388	utdcv.exe

Loads dropped DLL 8 IoCs

pid	Process
1880	utdcv.exe
4300	utdcv.exe
4388	utdcv.exe
4300	utdcv.exe
4300	utdcv.exe
4300	utdcv.exe
4300	utdcv.exe
4300	utdcv.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	utdcv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	utdcv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	utdcv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	utdcv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MKW Launcher.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	utdcv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	utdcv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	utdcv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
464	powershell.exe
464	powershell.exe
1000	powershell.exe
1000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1880	utdcv.exe
Token: SeCreatePagefilePrivilege	1880	utdcv.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeIncreaseQuotaPrivilege	464	powershell.exe
Token: SeSecurityPrivilege	464	powershell.exe
Token: SeTakeOwnershipPrivilege	464	powershell.exe
Token: SeLoadDriverPrivilege	464	powershell.exe
Token: SeSystemProfilePrivilege	464	powershell.exe
Token: SeSystemtimePrivilege	464	powershell.exe
Token: SeProfSingleProcessPrivilege	464	powershell.exe
Token: SeIncBasePriorityPrivilege	464	powershell.exe
Token: SeCreatePagefilePrivilege	464	powershell.exe
Token: SeBackupPrivilege	464	powershell.exe
Token: SeRestorePrivilege	464	powershell.exe
Token: SeShutdownPrivilege	464	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeSystemEnvironmentPrivilege	464	powershell.exe
Token: SeRemoteShutdownPrivilege	464	powershell.exe
Token: SeUndockPrivilege	464	powershell.exe
Token: SeManageVolumePrivilege	464	powershell.exe
Token: 33	464	powershell.exe
Token: 34	464	powershell.exe
Token: 35	464	powershell.exe
Token: 36	464	powershell.exe
Token: SeIncreaseQuotaPrivilege	464	powershell.exe
Token: SeSecurityPrivilege	464	powershell.exe
Token: SeTakeOwnershipPrivilege	464	powershell.exe
Token: SeLoadDriverPrivilege	464	powershell.exe
Token: SeSystemProfilePrivilege	464	powershell.exe
Token: SeSystemtimePrivilege	464	powershell.exe
Token: SeProfSingleProcessPrivilege	464	powershell.exe
Token: SeIncBasePriorityPrivilege	464	powershell.exe
Token: SeCreatePagefilePrivilege	464	powershell.exe
Token: SeBackupPrivilege	464	powershell.exe
Token: SeRestorePrivilege	464	powershell.exe
Token: SeShutdownPrivilege	464	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeSystemEnvironmentPrivilege	464	powershell.exe
Token: SeRemoteShutdownPrivilege	464	powershell.exe
Token: SeUndockPrivilege	464	powershell.exe
Token: SeManageVolumePrivilege	464	powershell.exe
Token: 33	464	powershell.exe
Token: 34	464	powershell.exe
Token: 35	464	powershell.exe
Token: 36	464	powershell.exe
Token: SeShutdownPrivilege	1880	utdcv.exe
Token: SeCreatePagefilePrivilege	1880	utdcv.exe
Token: SeIncreaseQuotaPrivilege	464	powershell.exe
Token: SeSecurityPrivilege	464	powershell.exe
Token: SeTakeOwnershipPrivilege	464	powershell.exe
Token: SeLoadDriverPrivilege	464	powershell.exe
Token: SeSystemProfilePrivilege	464	powershell.exe
Token: SeSystemtimePrivilege	464	powershell.exe
Token: SeProfSingleProcessPrivilege	464	powershell.exe
Token: SeIncBasePriorityPrivilege	464	powershell.exe
Token: SeCreatePagefilePrivilege	464	powershell.exe
Token: SeBackupPrivilege	464	powershell.exe
Token: SeRestorePrivilege	464	powershell.exe
Token: SeShutdownPrivilege	464	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeSystemEnvironmentPrivilege	464	powershell.exe
Token: SeRemoteShutdownPrivilege	464	powershell.exe
Token: SeUndockPrivilege	464	powershell.exe
Token: SeManageVolumePrivilege	464	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1880	2568	MKW Launcher.exe	85
PID 1880 wrote to memory of 4364	1880	utdcv.exe	86
PID 4364 wrote to memory of 464	4364	cmd.exe	88
PID 1880 wrote to memory of 4300	1880	utdcv.exe	89
PID 1880 wrote to memory of 4388	1880	utdcv.exe	90
PID 1880 wrote to memory of 4468	1880	utdcv.exe	96
PID 4468 wrote to memory of 1000	4468	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\MKW Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\MKW Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\7zS80A10019\utdcv.exe
  .\utdcv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwBdADoAOgBuAGUAdwAoACQAZgBhAGwAcwBlACkACgAgACAAIAAgACQATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcACgAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEMAbwB1AG4AdAAtAEMAaQBtACgAWwBzAHQAcgBpAG4AZwBdACQAYwBsAGEAcwBzACwAIABbAHMAdAByAGkAbgBnAF0AJABuAHMAKQAgAHsACgAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAByAGUAdAB1AHIAbgAgAEAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAkAG4AcwAgAC0AQwBsAGEAcwBzAE4AYQBtAGUAIAAkAGMAbABhAHMAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4AQwBvAHUAbgB0ACAAfQAKACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAByAGUAdAB1AHIAbgAgAC0AMQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgACQAZwBwAHUAcwAgAD0AIABAACgAKQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAJABnAHAAdQBzACAAPQAgAEAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsACgAgACAAIAAgACAAIAAgACAAWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgACAAIAAgACAAIAAgAE4AYQBtAGUAIAA9ACAAJABfAC4ATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGEAcAB0AGUAcgBSAEEATQAgAD0AIAAkAF8ALgBBAGQAYQBwAHQAZQByAFIAQQBNAAoAIAAgACAAIAAgACAAIAAgACAAIABQAE4AUABEAGUAdgBpAGMAZQBJAEQAIAA9ACAAJABfAC4AUABOAFAARABlAHYAaQBjAGUASQBEAAoAIAAgACAAIAAgACAAIAAgACAAIABBAGQAYQBwAHQAZQByAEMAbwBtAHAAYQB0AGkAYgBpAGwAaQB0AHkAIAA9ACAAJABfAC4AQQBkAGEAcAB0AGUAcgBDAG8AbQBwAGEAdABpAGIAaQBsAGkAdAB5AAoAIAAgACAAIAAgACAAIAAgACAAIABXAGkAZAB0AGgAIAA9ACAAJABfAC4AQwB1AHIAcgBlAG4AdABIAG8AcgBpAHoAbwBuAHQAYQBsAFIAZQBzAG8AbAB1AHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgAEgAZQBpAGcAaAB0ACAAPQAgACQAXwAuAEMAdQByAHIAZQBuAHQAVgBlAHIAdABpAGMAYQBsAFIAZQBzAG8AbAB1AHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAH0AKQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAJABpAG4AZgBvACAAPQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAZwBwAHUAcwAgAD0AIAAkAGcAcAB1AHMACgAgACAAIAAgACAAIAB0AGgAZQByAG0AYQBsAEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcATQBTAEEAYwBwAGkAXwBUAGgAZQByAG0AYQBsAFoAbwBuAGUAVABlAG0AcABlAHIAYQB0AHUAcgBlACcAIAAnAHIAbwBvAHQAXAB3AG0AaQAnAAoAIAAgACAAIAAgACAAZgBhAG4AQwBvAHUAbgB0ACAAPQAgAEMAbwB1AG4AdAAtAEMAaQBtACAAJwBXAGkAbgAzADIAXwBGAGEAbgAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgACAAIABkAGkAbQBtAEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcAVwBpAG4AMwAyAF8AUABoAHkAcwBpAGMAYQBsAE0AZQBtAG8AcgB5ACcAIAAnAHIAbwBvAHQAXABjAGkAbQB2ADIAJwAKACAAIAAgACAAIAAgAGMAYQBjAGgAZQBDAG8AdQBuAHQAIAA9ACAAQwBvAHUAbgB0AC0AQwBpAG0AIAAnAFcAaQBuADMAMgBfAEMAYQBjAGgAZQBNAGUAbQBvAHIAeQAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgACAAIABwAG8AcgB0AEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgAH0ACgAgACAAIAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABpAG4AZgBvACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQACgAgACAA
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwBdADoAOgBuAGUAdwAoACQAZgBhAGwAcwBlACkACgAgACAAIAAgACQATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcACgAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEMAbwB1AG4AdAAtAEMAaQBtACgAWwBzAHQAcgBpAG4AZwBdACQAYwBsAGEAcwBzACwAIABbAHMAdAByAGkAbgBnAF0AJABuAHMAKQAgAHsACgAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAByAGUAdAB1AHIAbgAgAEAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAkAG4AcwAgAC0AQwBsAGEAcwBzAE4AYQBtAGUAIAAkAGMAbABhAHMAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4AQwBvAHUAbgB0ACAAfQAKACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAByAGUAdAB1AHIAbgAgAC0AMQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgACQAZwBwAHUAcwAgAD0AIABAACgAKQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAJABnAHAAdQBzACAAPQAgAEAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsACgAgACAAIAAgACAAIAAgACAAWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgACAAIAAgACAAIAAgAE4AYQBtAGUAIAA9ACAAJABfAC4ATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGEAcAB0AGUAcgBSAEEATQAgAD0AIAAkAF8ALgBBAGQAYQBwAHQAZQByAFIAQQBNAAoAIAAgACAAIAAgACAAIAAgACAAIABQAE4AUABEAGUAdgBpAGMAZQBJAEQAIAA9ACAAJABfAC4AUABOAFAARABlAHYAaQBjAGUASQBEAAoAIAAgACAAIAAgACAAIAAgACAAIABBAGQAYQBwAHQAZQByAEMAbwBtAHAAYQB0AGkAYgBpAGwAaQB0AHkAIAA9ACAAJABfAC4AQQBkAGEAcAB0AGUAcgBDAG8AbQBwAGEAdABpAGIAaQBsAGkAdAB5AAoAIAAgACAAIAAgACAAIAAgACAAIABXAGkAZAB0AGgAIAA9ACAAJABfAC4AQwB1AHIAcgBlAG4AdABIAG8AcgBpAHoAbwBuAHQAYQBsAFIAZQBzAG8AbAB1AHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgAEgAZQBpAGcAaAB0ACAAPQAgACQAXwAuAEMAdQByAHIAZQBuAHQAVgBlAHIAdABpAGMAYQBsAFIAZQBzAG8AbAB1AHQAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAH0AKQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAJABpAG4AZgBvACAAPQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAZwBwAHUAcwAgAD0AIAAkAGcAcAB1AHMACgAgACAAIAAgACAAIAB0AGgAZQByAG0AYQBsAEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcATQBTAEEAYwBwAGkAXwBUAGgAZQByAG0AYQBsAFoAbwBuAGUAVABlAG0AcABlAHIAYQB0AHUAcgBlACcAIAAnAHIAbwBvAHQAXAB3AG0AaQAnAAoAIAAgACAAIAAgACAAZgBhAG4AQwBvAHUAbgB0ACAAPQAgAEMAbwB1AG4AdAAtAEMAaQBtACAAJwBXAGkAbgAzADIAXwBGAGEAbgAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgACAAIABkAGkAbQBtAEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcAVwBpAG4AMwAyAF8AUABoAHkAcwBpAGMAYQBsAE0AZQBtAG8AcgB5ACcAIAAnAHIAbwBvAHQAXABjAGkAbQB2ADIAJwAKACAAIAAgACAAIAAgAGMAYQBjAGgAZQBDAG8AdQBuAHQAIAA9ACAAQwBvAHUAbgB0AC0AQwBpAG0AIAAnAFcAaQBuADMAMgBfAEMAYQBjAGgAZQBNAGUAbQBvAHIAeQAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgACAAIABwAG8AcgB0AEMAbwB1AG4AdAAgAD0AIABDAG8AdQBuAHQALQBDAGkAbQAgACcAVwBpAG4AMwAyAF8AUABvAHIAdABDAG8AbgBuAGUAYwB0AG8AcgAnACAAJwByAG8AbwB0AFwAYwBpAG0AdgAyACcACgAgACAAIAAgAH0ACgAgACAAIAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABpAG4AZgBvACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQACgAgACAA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\Users\Admin\AppData\Local\Temp\7zS80A10019\utdcv.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS80A10019\utdcv.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\utdcv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,15234003485862415175,16812238333319898117,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\7zS80A10019\utdcv.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS80A10019\utdcv.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\utdcv" --mojo-platform-channel-handle=1876 --field-trial-handle=1796,i,15234003485862415175,16812238333319898117,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:4388
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgACQAcAByAGkAbgBjAGkAcABhAGwAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBJAGQAZQBuAHQAaQB0AHkAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdAAoACkACgAgACAAIAAgAGkAZgAgACgAJABwAHIAaQBuAGMAaQBwAGEAbAAuAEkAcwBJAG4AUgBvAGwAZQAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEIAdQBpAGwAdABJAG4AUgBvAGwAZQBdADoAOgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACkAKQAgAHsAIABlAHgAaQB0ACAAMAAgAH0ACgAgACAAIAAgAGUAeABpAHQAIAAxAAoAIAAgAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgACQAcAByAGkAbgBjAGkAcABhAGwAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBJAGQAZQBuAHQAaQB0AHkAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdAAoACkACgAgACAAIAAgAGkAZgAgACgAJABwAHIAaQBuAGMAaQBwAGEAbAAuAEkAcwBJAG4AUgBvAGwAZQAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEIAdQBpAGwAdABJAG4AUgBvAGwAZQBdADoAOgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACkAKQAgAHsAIABlAHgAaQB0ACAAMAAgAH0ACgAgACAAIAAgAGUAeABpAHQAIAAxAAoAIAAgAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 9fbf39f1d43e5e120b5fa394bc13d5b136729e0ec652f853517cc8606a31ed4a
MD5 69df76b642c84514b2719d984cdc6bc8
SHA1 0847c23ca1e677c925b5f821467a92a5ccc4892d
SHA512 fbf0479f78749d22aad377ef031d45574d63ddb940a882f68f2fc0646cd8411a0b68f254f47308b0018d86ed862ed66cb5f03a0a67a6712acce005716c6ed7cd
TLSH
T16971C0323275F0D4C9567F071A2819C063BF4396EA98AF4CB29C621ED92751BDB221F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ea438f8453bde591c6f5c2f74e312c13002e8938f07ff6619f2be3138bf54581
MD5 13cad647adc2193e6bfdc9241ff5397f
SHA1 2a2ae7496fb4308417e55052e5c8491fc25835f2
SHA512 187d30fcf6d6428f3fb0672e51448aee12a10ad3d7ccaf3daf8aad18ab6875b56b59d9d71d7e8bd87ddbae4e79854a4792dc69ba20e82e065058d36e4547078a
TLSH
T149319A2FB35DC496D885153B206D6C41327A82D7809E8FDB3A81D214F46F784CB65B84
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
TLSH
T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
TLSH
T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\ffmpeg.dll
Size 2.7MB
SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
MD5 fa145097e0274da929aacd68c31338ab
SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
TLSH
T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\libEGL.dll
Size 467KB
SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
MD5 5db499ae909083620e47eeea1623b2af
SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
TLSH
T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\libGLESv2.dll
Size 7.4MB
SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
MD5 57c23aa2c39f11528e56a48ea1824036
SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
TLSH
T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
TLSH
T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\resources.pak
Size 5.1MB
SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
MD5 0e69910860463d5045ec257234bd8dd4
SHA1 33c923c33129d1dccf0bb2dcbe8af983a7000444
SHA512 f6bb7c7b51bb202877739801498522095637caf8a03e2e1f2c6319fede3d3ca656f552061e171ec5e35e176c267fe278c326805d760add1371590bed58e12375
SSDEEP 98304:Ct1j25juJgWPVcz+cd31rJ7JBXbwHgf3IvVrwrWBpcdmTHWCF3UlfPcauPFcHNp:Ctp8CJPdB831FJ5wHwOVkrWBQmTHWo0l
TLSH
T1EE363320F6385C36D0F0A2BE816812738B39D8139665781DB1DF932C5F7CA5E85B47AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\resources\app.asar
Size 6.0MB
SHA256 e95a1aa50ff84e39496679cb799b29474afba0b09db0c836c43fe09b57d3e038
MD5 b66e60173cea05735c1b5e5c7f8b910c
SHA1 2ff9464a4c83a8636273ef632ccdf76b1240d0b6
SHA512 9bbb06a3fe8a0697cd318ad404bd72fdbebf663894e28367ddd04e904abd0d20498f541c7a2137e326bb65469d2879dca40b28935e4cb017a8aa55dbdcc7050e
SSDEEP 49152:PG1/si0+5ApXl2Pdj6PMu/yYUFpKw/l5Dh1nFwBGtQtFndq0hzmSplQztsS650g2:2
TLSH
T1CC5633406F38ADAF076CD538705F9D192F908FA2A05CE59795E0A4CB141FB82E67FC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
TLSH
T176D48FA3B345CF67C1642DB0BACAD656B5B43449BF4A062B7368A3BE37396311F14072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\vk_swiftshader.dll
Size 5.0MB
SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
MD5 583b1d71cd7b847ba02d734c508cd92f
SHA1 d63966aeafa951d51967620c606e9b97399699c4
SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
TLSH
T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS80A10019\vulkan-1.dll
Size 925KB
SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
MD5 47af18d68dc7cf271f0a92707f783f64
SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
TLSH
T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2qm5ojb0.4qz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qm5ojb0.4qz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-185-0x000001EC66400000-0x000001EC66424000-memory.dmp

Download

memory/464-184-0x000001EC66400000-0x000001EC6642A000-memory.dmp

Download

memory/464-176-0x000001EC63FE0000-0x000001EC64002000-memory.dmp

Download

memory/464-186-0x000001EC66760000-0x000001EC66922000-memory.dmp

Download

memory/464-187-0x000001EC66E60000-0x000001EC67388000-memory.dmp

Download