donutloader | 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torrent (1).exe
Size 1.5MB
Sample261114-d65b3sct2y
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader quasar loader module persistence privilege_escalation rat spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6D14F6DAC4C83A0E876468CF4054D970F9D50856
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral4/memory/5564-1-0x000002D0B05E0000-0x000002D0B0765000-memory.dmp	family_donutloader

PulsaRAT library module 3 IoCs

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module

resource	yara_rule
behavioral4/memory/5564-5-0x000002D0C9060000-0x000002D0C91E6000-memory.dmp	pulsarat_module
behavioral4/memory/5564-6-0x000002D0B08A0000-0x000002D0B08D0000-memory.dmp	pulsarat_module
behavioral4/memory/464-35-0x0000023D73AB0000-0x0000023D73C36000-memory.dmp	pulsarat_module

Quasar payload 2 IoCs

resource	yara_rule
behavioral4/memory/5564-5-0x000002D0C9060000-0x000002D0C91E6000-memory.dmp	family_quasar
behavioral4/memory/464-35-0x0000023D73AB0000-0x0000023D73C36000-memory.dmp	family_quasar

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3308	powershell.exe
2600	powershell.exe
3020	powershell.exe
3728	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yz04lh1y.pme.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_libqnpu4.raa.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s451lmkc.c4g.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_erepxn50.23d.psm1	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent (1).exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5564	Torrent (1).exe
6068	Torrent (1).exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3308	powershell.exe
3308	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
3728	powershell.exe
3728	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	Torrent (1).exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	464	Torrent (1).exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	6068	Torrent (1).exe
Token: SeDebugPrivilege	5860	Torrent (1).exe
Token: SeDebugPrivilege	3728	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3308	5564	Torrent (1).exe	88
PID 464 wrote to memory of 2600	464	Torrent (1).exe	92
PID 6068 wrote to memory of 3020	6068	Torrent (1).exe	103
PID 5860 wrote to memory of 3728	5860	Torrent (1).exe	108

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3308

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 98dafae3f38ce98dd71e89235381463ec496980e3c074a6868232aa5bf9cb3fd
MD5 231f1e28b8165bc4ef0276da6b502baa
SHA1 9083344efb9047c16566a386820dc9417361b71e
SHA512 7dabcdc8319e32369f11637300844847c8d71e8b5435ef55493c914a9d9d0ac0ced666d0fd9ff86e9d98e0ea161771dca4da38209ce71572501ae8040b930f06
TLSH
T13F215733F3CC86A4C89A413650CEAC1036B797DB419EDFABBB84D155A43F699CF61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wlp1epfm.jvo.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlp1epfm.jvo.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe
Size 1.5MB
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-37-0x00007FF6F9FB0000-0x00007FF6FA141000-memory.dmp

Download

memory/464-35-0x0000023D73AB0000-0x0000023D73C36000-memory.dmp

Download

memory/3308-24-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-41-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-10-0x00000156FF7B0000-0x00000156FF7D2000-memory.dmp

Download

memory/3308-28-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-27-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-26-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-25-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-23-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-22-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/3308-21-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-6-0x000002D0B08A0000-0x000002D0B08D0000-memory.dmp

Download

memory/5564-15-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-18-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-17-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-1-0x000002D0B05E0000-0x000002D0B0765000-memory.dmp

Download

memory/5564-16-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-12-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-14-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-13-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-30-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-19-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-29-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-42-0x00007FF6F9FB0000-0x00007FF6FA141000-memory.dmp

Download

memory/5564-7-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-4-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-11-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-20-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-43-0x000002D0C8E80000-0x000002D0C8EBE000-memory.dmp

Download

memory/5564-46-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-47-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5564-5-0x000002D0C9060000-0x000002D0C91E6000-memory.dmp

Download

memory/5564-3-0x00007FFAEF8EF000-0x00007FFAEF8F0000-memory.dmp

Download

memory/5860-79-0x00007FF6F9FB0000-0x00007FF6FA141000-memory.dmp

Download

memory/6068-62-0x00007FF6F9FB0000-0x00007FF6FA141000-memory.dmp

Download