Analysis
-
max time kernel
12s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 13:33
Static task
static1
Behavioral task
behavioral1
Sample
PO_21031566AF_pdf.jar
Resource
win7v20201028
General
-
Target
PO_21031566AF_pdf.jar
-
Size
477KB
-
MD5
0d5327616ab7b563c34ef9a5ab1892d6
-
SHA1
403df150f0a5ae27c837a6a70ed993a6633889b0
-
SHA256
c2b9108a7aedcb313f9df0d16cf1c52e9de3cae6afab5829f8c533924850efb7
-
SHA512
6790cbdc75999ae65ae1353fa529459d5240945ef86dadfe5aa6c55cd8e13c33bcdf1fb35fa627267ae0797c1caa2f86106b0f9336b25572fafac7e3f6891f6e
Malware Config
Extracted
asyncrat
0.5.7B
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49703
chongmei33.publicvm.com:49746
185.165.153.116:2703
185.165.153.116:49703
185.165.153.116:49746
54.37.36.116:2703
54.37.36.116:49703
54.37.36.116:49746
185.244.30.92:2703
185.244.30.92:49703
185.244.30.92:49746
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49703
dongreg202020.duckdns.org:49746
178.33.222.241:2703
178.33.222.241:49703
178.33.222.241:49746
rahim321.duckdns.org:2703
rahim321.duckdns.org:49703
rahim321.duckdns.org:49746
79.134.225.92:2703
79.134.225.92:49703
79.134.225.92:49746
37.120.208.36:2703
37.120.208.36:49703
37.120.208.36:49746
178.33.222.243:2703
178.33.222.243:49703
178.33.222.243:49746
87.98.245.48:2703
87.98.245.48:49703
87.98.245.48:49746
AsyncMutex_6SI8OkPnk
-
aes_key
hGScKRB0VrlS4WpFo0N7AmnZQApV4qsi
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
FEB
-
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
2703,49703,49746
-
version
0.5.7B
Signatures
-
Ratty Rat Payload 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab7b-11.dat family_ratty behavioral2/files/0x000200000001ab7e-18.dat family_ratty -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/7932-894-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/7932-896-0x000000000040C91E-mapping.dmp asyncrat -
Detect jar appended to MSI 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab7b-11.dat jar_in_msi behavioral2/files/0x000200000001ab7e-18.dat jar_in_msi -
Nirsoft 6 IoCs
resource yara_rule behavioral2/files/0x000100000001ab87-24.dat Nirsoft behavioral2/files/0x000100000001ab87-25.dat Nirsoft behavioral2/files/0x000100000001ab87-27.dat Nirsoft behavioral2/files/0x000100000001ab8d-597.dat Nirsoft behavioral2/files/0x000100000001ab8d-613.dat Nirsoft behavioral2/files/0x000100000001ab8d-620.dat Nirsoft -
Executes dropped EXE 4 IoCs
pid Process 3372 oq1N.exe 188 AdvancedRun.exe 416 AdvancedRun.exe 972 jVAPsorbdr.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IxVhFD18YESB.jar javaw.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe oq1N.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe oq1N.exe -
Loads dropped DLL 1 IoCs
pid Process 1984 javaw.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" oq1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" oq1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\oq1N.exe = "0" oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe = "0" oq1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe = "0" oq1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths oq1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features oq1N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\IxVhFD18YESB.jar = "C:\\Users\\Admin\\AppData\\Roaming\\IxVhFD18YESB.jar" REG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 8348 3372 WerFault.exe 77 9272 972 WerFault.exe 106 -
Delays execution with timeout.exe 2 IoCs
pid Process 8324 timeout.exe 7428 timeout.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance javaw.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance javaw.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 980 REG.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 188 AdvancedRun.exe 188 AdvancedRun.exe 188 AdvancedRun.exe 188 AdvancedRun.exe 416 AdvancedRun.exe 416 AdvancedRun.exe 416 AdvancedRun.exe 416 AdvancedRun.exe 984 powershell.exe 984 powershell.exe 1836 powershell.exe 1836 powershell.exe 2060 powershell.exe 2060 powershell.exe 3764 powershell.exe 3764 powershell.exe 376 powershell.exe 376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3372 oq1N.exe Token: SeDebugPrivilege 188 AdvancedRun.exe Token: SeImpersonatePrivilege 188 AdvancedRun.exe Token: SeDebugPrivilege 416 AdvancedRun.exe Token: SeImpersonatePrivilege 416 AdvancedRun.exe Token: SeDebugPrivilege 984 powershell.exe Token: SeDebugPrivilege 1836 powershell.exe Token: SeDebugPrivilege 2060 powershell.exe Token: SeDebugPrivilege 3764 powershell.exe Token: SeDebugPrivilege 376 powershell.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1144 java.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe 1984 javaw.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1144 wrote to memory of 3372 1144 java.exe 77 PID 1144 wrote to memory of 3372 1144 java.exe 77 PID 1144 wrote to memory of 3372 1144 java.exe 77 PID 1144 wrote to memory of 1984 1144 java.exe 78 PID 1144 wrote to memory of 1984 1144 java.exe 78 PID 1984 wrote to memory of 980 1984 javaw.exe 79 PID 1984 wrote to memory of 980 1984 javaw.exe 79 PID 1984 wrote to memory of 1520 1984 javaw.exe 81 PID 1984 wrote to memory of 1520 1984 javaw.exe 81 PID 1984 wrote to memory of 804 1984 javaw.exe 84 PID 1984 wrote to memory of 804 1984 javaw.exe 84 PID 3372 wrote to memory of 188 3372 oq1N.exe 85 PID 3372 wrote to memory of 188 3372 oq1N.exe 85 PID 3372 wrote to memory of 188 3372 oq1N.exe 85 PID 188 wrote to memory of 416 188 AdvancedRun.exe 86 PID 188 wrote to memory of 416 188 AdvancedRun.exe 86 PID 188 wrote to memory of 416 188 AdvancedRun.exe 86 PID 3372 wrote to memory of 1836 3372 oq1N.exe 90 PID 3372 wrote to memory of 1836 3372 oq1N.exe 90 PID 3372 wrote to memory of 1836 3372 oq1N.exe 90 PID 3372 wrote to memory of 984 3372 oq1N.exe 92 PID 3372 wrote to memory of 984 3372 oq1N.exe 92 PID 3372 wrote to memory of 984 3372 oq1N.exe 92 PID 3372 wrote to memory of 2060 3372 oq1N.exe 94 PID 3372 wrote to memory of 2060 3372 oq1N.exe 94 PID 3372 wrote to memory of 2060 3372 oq1N.exe 94 PID 3372 wrote to memory of 3764 3372 oq1N.exe 96 PID 3372 wrote to memory of 3764 3372 oq1N.exe 96 PID 3372 wrote to memory of 3764 3372 oq1N.exe 96 PID 3372 wrote to memory of 376 3372 oq1N.exe 107 PID 3372 wrote to memory of 376 3372 oq1N.exe 107 PID 3372 wrote to memory of 376 3372 oq1N.exe 107 PID 3372 wrote to memory of 972 3372 oq1N.exe 106 PID 3372 wrote to memory of 972 3372 oq1N.exe 106 PID 3372 wrote to memory of 972 3372 oq1N.exe 106 PID 3372 wrote to memory of 4140 3372 oq1N.exe 105 PID 3372 wrote to memory of 4140 3372 oq1N.exe 105 PID 3372 wrote to memory of 4140 3372 oq1N.exe 105 PID 3372 wrote to memory of 4220 3372 oq1N.exe 99 PID 3372 wrote to memory of 4220 3372 oq1N.exe 99 PID 3372 wrote to memory of 4220 3372 oq1N.exe 99 PID 3372 wrote to memory of 4316 3372 oq1N.exe 103 PID 3372 wrote to memory of 4316 3372 oq1N.exe 103 PID 3372 wrote to memory of 4316 3372 oq1N.exe 103 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1520 attrib.exe 804 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\PO_21031566AF_pdf.jar1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\oq1N.exeC:\Users\Admin\oq1N.exe2⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4787e1b6-47c6-4178-90a9-613d0fc83d9a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4787e1b6-47c6-4178-90a9-613d0fc83d9a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\4787e1b6-47c6-4178-90a9-613d0fc83d9a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Users\Admin\AppData\Local\Temp\4787e1b6-47c6-4178-90a9-613d0fc83d9a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4787e1b6-47c6-4178-90a9-613d0fc83d9a\AdvancedRun.exe" /SpecialRun 4101d8 1884⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:4220
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4316
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4140
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"3⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\4278ac30-0173-40fb-ac21-37a32ca7ef79\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4278ac30-0173-40fb-ac21-37a32ca7ef79\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\4278ac30-0173-40fb-ac21-37a32ca7ef79\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵PID:7148
-
C:\Users\Admin\AppData\Local\Temp\4278ac30-0173-40fb-ac21-37a32ca7ef79\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\4278ac30-0173-40fb-ac21-37a32ca7ef79\AdvancedRun.exe" /SpecialRun 4101d8 71485⤵PID:6188
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:6704
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:6620
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:7000
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:4044
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:6056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:7308
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:7404
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:7456
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:7920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:7016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:4540
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:7340
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:2036
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:8608
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:8656
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:8732
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:9076
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:9144
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:9112
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:7644
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:5248
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:5316
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:8780
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:5756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:5880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:9652
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:9672
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:9708
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:9396
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force4⤵PID:9488
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force4⤵PID:8956
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵PID:9412
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:8324
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"4⤵PID:9300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 21284⤵
- Program crash
PID:9272
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4544
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:4008
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4664
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4340
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:4912
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4108
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5196
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:5252
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5320
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:6096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:6136
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:4760
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:5652
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5776
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5348
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:6116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:5708
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:6808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:6824
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:6868
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:6728
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:6600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:6684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:7776
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force3⤵PID:7816
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force3⤵PID:7860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵PID:3000
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
PID:7428
-
-
-
C:\Users\Admin\oq1N.exe"C:\Users\Admin\oq1N.exe"3⤵PID:4772
-
-
C:\Users\Admin\oq1N.exe"C:\Users\Admin\oq1N.exe"3⤵PID:7932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 22003⤵
- Program crash
PID:8348
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\IxVhFD18YESB.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "IxVhFD18YESB.jar" /d "C:\Users\Admin\AppData\Roaming\IxVhFD18YESB.jar" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:980
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\IxVhFD18YESB.jar3⤵
- Views/modifies file attributes
PID:1520
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IxVhFD18YESB.jar3⤵
- Views/modifies file attributes
PID:804
-
-