Analysis
-
max time kernel
224s -
max time network
230s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 16:07
General
-
Target
2bc932bf53710c0dc37e3a16c0975a1c.exe
-
Size
464KB
-
MD5
2bc932bf53710c0dc37e3a16c0975a1c
-
SHA1
83bd73dd212ac325f61ec9c16d27b9f5368c1926
-
SHA256
caf95c614009163f06b890c747376d3a06513aa6498f3378cafe6391b7470015
-
SHA512
ecb9177e9ac0d39c43d8610578614af8aad09dcc5d8d261197a2e1968c0ceded5c02544b64a9d22b4717abb41f0b8127a62c878296cbe89a7325d94106098c3f
-
SSDEEP
12288:OFzFvBhbCs9GH2wgtsB6+y3PaOPeJDrRnKasZzb:OFz9GiN8fyFeJD9X4zb
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 37 IoCs
-
UAC bypass 3 TTPs 37 IoCs
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe"C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\UCEcQsIQ\VCQgEAwM.exe"C:\Users\Admin\UCEcQsIQ\VCQgEAwM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\ySoMwkUc\GuUYgAIo.exe"C:\ProgramData\ySoMwkUc\GuUYgAIo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exeC:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c77⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WGgUoQME.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACsEMIUE.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgoMgsIo.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eYUwkwcs.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgEUYkkY.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TcQYMsEM.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TuQEMIAA.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VSUgQEIY.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYwUkQgg.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\twgwwgcc.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ywAwMUgU.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmIgAIgY.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqkwAcIo.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qAwEIEIM.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgYsUQUo.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CwoYUUUM.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UUAMEsko.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuAgEEUg.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqcYwAgA.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iyYscoEU.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MkUQMccc.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YqkYIgYk.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kUYosssE.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zUsgQYYg.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\baQwYYcE.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWoskgEY.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ncoEwwEw.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsEIcEso.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgoYAckA.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKgcsYkc.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UycEcssg.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUwkIokE.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EoYAAQAk.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUMYgoMc.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mAgYgQoM.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iYwsoEkA.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\noUggAEE.bat" "C:\Users\Admin\AppData\Local\Temp\2bc932bf53710c0dc37e3a16c0975a1c.exe""4⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\ProgramData\KKAwEQQU\CakogwUQ.exeC:\ProgramData\KKAwEQQU\CakogwUQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD50bae513849d5beb7b5af34881c3d9ac8
SHA157b5ee94bae60b9039552a407998e6a0e2ab1825
SHA256b5b7db8332baedfcddb666ac2403b3468dda7bd263174357dc1223ae353673d0
SHA5122b027d2072e9f7361f68bd3922feabb646a33bd2725d3c10b2f61b0ef9c0cad9cd955c4f328feb7cdcad02cf7dc66834d7be809054658993060fbd18f64ee61d
-
Filesize
475KB
MD55a3b11c21a692164f81e717d5aa83f0c
SHA12fa47f53c61cbbaefe46daaf2e89cbb51f5aba72
SHA25617117f47afb8073aaaf404f5c62260d81d6f6464c18f5032bc8e7306e172132c
SHA5125bc8fe8e6cc852fd96d2b319bdb3c824a4078d35d689044f5c343ba2d1cfee722e554d71f63f48252a9ad8644cb678d0680436cc2b5834258eea3d943cb816f3
-
Filesize
431KB
MD51878f5dc9ad960618875959ec4a142c1
SHA14a3c3e0dd270859745613fe2b9f729f61b5267c4
SHA25684d213826ef63561effe959e9f377e632a8668c8eae544b48fe6dc4f42433d93
SHA51265276150f1531752290c87a8c4fdf46d7cad65debc3b6a039f44265b931d3c7e835f68a5dbf254bc7bc2b265db7904ea3c9ed8df4d853e27ba923f067a4bd276
-
Filesize
28KB
MD51f93b502e78190a2f496c2d9558e069d
SHA16ae6249493d36682270c0d5e3eb3c472fdd2766e
SHA2565c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
SHA512cf07724c203a82c9f202d53f63ea00ab0df2f97484bd3b9abe1a001f2e531f505ddd4ff8f2d5a2769dd9d2d60e9c1d03dd3ab5143542688f944cfd35c6f1cdf3
-
Filesize
4KB
MD5ee421bd295eb1a0d8c54f8586ccb18fa
SHA1bc06850f3112289fce374241f7e9aff0a70ecb2f
SHA25657e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
SHA512dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897
-
Filesize
477KB
MD58ab66d3854c0dc83517fa5501673cae4
SHA1ecd38f8dd61d74a79ff311a25fe8245b5bd45ee3
SHA256d9a85b471420069d96540c9d92ea188c1f73ab45446a61463ab6437344eeeade
SHA5128b7d3ed0536c52cbab83ef3ccd3ad0880b14610ceb04eb634ce4595794cecfd60ef6499f7357f7832413b804cf5a6fe172cdb165c444aa423076fc761ada2dc2
-
Filesize
460KB
MD5efcb681c4d6365ca78a9441129922b1e
SHA10c10f28b3815486da53cb8d9cee2a82c026a0e2d
SHA256555a132b0c6f1521d022b29a1a747e5b0e855695ad6d3096e812d70e3171c20e
SHA5122ce55360a4805ef864339b6f3bf7624b7b6af9c0530dc3f1fedcd8a15b0185a337edf1640f97a8abe590572548835426059a3bd6979913152e0ae585efa6ffab
-
Filesize
1.3MB
MD51602c02ac821bffb5d8d9ac29c351bf1
SHA1e91d21377ca4c55bf8c6d039756320c881190086
SHA256a5c86d133021042b686f5399f7651e75e4f07143b28530a947c7ee2775934a48
SHA512864d243fe5591609cdbee33a7be09aaed84c50e5e5456bdfee3c2e41a355c0d29331410b178328d0791070f816b713ed095c4b1e27bbf61ba3eb31cfc795a8d1
-
Filesize
19B
MD54afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
Filesize
112B
MD5bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
Filesize
888KB
MD50835b9ea154108a24175bf21e128738f
SHA1bbc848c7f00fa388f9324aa104899248a43e437e
SHA256ffd78fc4f5929c5b6174e26305fa453b70e87df4548498b7f034308d3adee9ec
SHA512a4c0f090de228ec9ad46f756cc2ca64e995655e41297c89a6f13036b32aca13935dac7b24fb1e25753ff9277beadc5a240bcc54850ef3f3474c0710c69b88000
-
Filesize
558KB
MD51b929bd2f38b13edb1560349e7384b40
SHA1b8ab5c827b9e5e283581e1cd5df17053820e514f
SHA256ad4e91ba081f1ede27f149d1cd1c9804b62faf3d36a6605e485fd9032ed38272
SHA5122c7717728096c53dee34a95ab764469019fd7595819f407c948a8496123e35cf7d1cc121d938022e3f6b61d725a9af4565c40c8bb19d595c27c4baf6e185ef27
-
Filesize
435KB
MD55ce060a915111ff3e6f585659373e867
SHA19aef6160be6b675065697f524efd6bae8527540e
SHA25623f612819c1467b27e275e92fba989534227714e8c8b3053c705589e816ed732
SHA5129a399c8388e4168bffd019629e96782f9a29ea4a76a91e87d06efb14379962940ae14717b2783ab1ee2501b76383e927588fdd9895fa408d5208f77c6df0b900
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
